Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 4 Feb 2020 13:27:11 +0100
From: Solar Designer <solar@...nwall.com>
To: oss-security@...ts.openwall.com
Subject: Re: CVE-2020-7221: mariadb: possible local mysql to root user exploit in mysql_install_db script setting permissions of /usr/lib64/mysql/plugin/auth_pam_tool_dir/auth_pam_tool

On Tue, Feb 04, 2020 at 11:26:04AM +0100, Matthias Gerstner wrote:
> For Deb/RPM packaging MariaDB continues to suggest to use the following
> dir and file modes [2], [3]:
> 
> mysql:root  0700 /usr/lib/mysql/plugin/auth_pam_tool_dir
>  root:root 04755 /usr/lib/mysql/plugin/auth_pam_tool_dir/auth_pam_tool
> 
> I personally suggest the following directory mode instead:
> 
> root:mysql  0750 /usr/lib/mysql/plugin/auth_pam_tool_dir

Why not simply

root:mysql 04710 /usr/lib/mysql/plugin/auth_pam_tool

without the directory?  I see only one reason: it's a bigger change
relative to the current implementation, which is more work now, but
perhaps this cleanup is worth it longer-term.

The approach with a directory (or several) is sometimes useful to limit
access to a file yet avoid use of ACLs, but the case above looks simple
enough not to require this complication.
 
Alexander

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.