Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 17 Dec 2014 12:27:30 -0500
From: Daniel Kahn Gillmor <>
Subject: Re: What is the "Grinch" polkit/wheel group issue?

On 12/17/2014 12:00 PM, Marcus Meissner wrote:

> This probably needs a CVE too, or does it have one?
> Although it seems that the user is in the "wheel" group for this to be exploitable
> and is hard to specify what actions should be safed by another query or which should not.

from your first link:

>> Wheel is a special user group that controls access to the su command, 
>> which allows a user to masquerade as another user.  When a Linux system 
>> is built, the default user is assigned to the wheel group that allows 
>> for administrative task execution within the system. For example, if 
>> the file is owned by user XYZ and group wheel, it will run as 
>> XYZ:wheel, no matter who executes the file.

This paragraph suggests so many things which are simply wrong, confused,
or irrelevant that i don't know what to make of the rest of the article.

 * modern debian GNU/Linux systems do not have a wheel group at all.  No
particular versions or flavors of "Linux system"

 * on systems where members of group wheel really do have unrestricted
access to the su command, having wheel in the first place *is* the
vulnerability -- it is a misconfiguration to expect an account to be
non-privileged if it is a member of wheel.

 * the last sentence appears to be about setuid/setgid binaries, but
makes no mention that the overwhelming majority of binaries are not

Later on, the post suggests that wheel group membership is related to
sudo privileges.

It also seems to assume that polkit always permits access for members of
group wheel.  I can find no such configuration on a modern debian system.

I don't think there's anything significant in this ambiguous,
underspecified, and confused report.


Download attachment "signature.asc" of type "application/pgp-signature" (950 bytes)

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.