Date: Wed, 17 Dec 2014 16:50:19 -0500 From: Daniel Micay <danielmicay@...il.com> To: oss-security@...ts.openwall.com Subject: Re: What is the "Grinch" polkit/wheel group issue? If the compromised user is an administator, an unsandboxed process running as that user can trivially obtain root access. A small shell script or function wrapping su / sudo is all it takes to escalate privileges. There's no need to exploit a privesc vulnerability by obtaining a package with a vulnerable setuid/setgid/setcap binary or enabled-by-default service. Any process running as that user can obtain an X11 handle and sniff the input events. Wayland will change that, but it's only truly valuable in combination with some form of process isolation. There's only a strong distinction between root and the administrator's regular user account if they aren't a sudoer and never switch to root via su within their session. If root logins are only done from virtual consoles, then the attacker may actually need to resort to hacks like this - but I doubt that user would be in the wheel group... Since the typical usage of wheel is access to sudo, I don't see any problem with this polkit rule. It's acknowledging that the distinction between root and an admin user's account (in wheel) has very little relevance to security, and is more about preventing accidents. Download attachment "signature.asc" of type "application/pgp-signature" (820 bytes)
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.