Date: Mon, 30 Jul 2012 10:52:25 +0200 From: Ludwig Nussel <ludwig.nussel@...e.de> To: oss-security@...ts.openwall.com Subject: Re: libdbus hardening Simon McVittie wrote: > On 10/07/12 14:09, Sebastian Krahmer wrote: >> We are going to add a libdbus hardening patch: >> >> https://bugzilla.novell.com/show_bug.cgi?id=697105 >> >> This is because some suid binaries (Xorg and others) are linked against libdbus > > The tl;dr: version if (e.g.) your Xorg binary still uses HAL and is also > setuid, ensure that it cleans its environment using a whitelist before > its first use of libdbus, libhal, any other non-trivial library, or exec(). > > In off-list discussion with the other D-Bus upstream maintainers, > consensus was that binaries with greater privileges than their parent > process (setuid or VFS capabilities) must not use non-trivial libraries > [...] > In particular, we do not support use of libdbus in setuid binaries that > do not sanitize their environment before their first call into libdbus. PAM modules of systemd and consolekit use libdbus though. PAM can't scrub the environment before calling modules as those modules may want to do something with the information gained from the original environment (like e.g. pam_xauth). cu Ludwig -- (o_ Ludwig Nussel //\ V_/_ http://www.suse.de/ SUSE LINUX Products GmbH, GF: Jeff Hawn, Jennifer Guild, Felix Imendörffer, HRB 16746 (AG Nürnberg)
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.