[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20150402153825.GX6817@brightrain.aerifal.cx>
Date: Thu, 2 Apr 2015 11:38:25 -0400
From: Rich Felker <dalias@...c.org>
To: musl@...ts.openwall.com, busybox@...ybox.net
Subject: Re: Re: Busybox on musl is affected by CVE-2015-1817
On Wed, Apr 01, 2015 at 10:49:40AM +0200, u-wsnj@...ey.se wrote:
> Hi Harald,
>
> On Wed, Apr 01, 2015 at 10:11:51AM +0200, Harald Becker wrote:
> > There is a big difference if you talk about suid
> > *root* programs or other suid usage.
> >
> > The former is definitely very dangerous and should be used with extreme care
> > (I think this is the case we are talking about), the later use may even be
> > used to drop privileges (not to raise), or to temporarily hop to the
>
> You are right about a remarkable difference between suid root and suid
> somethingelse, just because root has the very special role in Unix.
The difference is there but it's not as remarkable as you think. As
soon as you can get control of uid==suid_target_uid, you can do nasty
things as that user like modifying the binary that's suid to that
user, so that the next user who invokes it invokes malicious code.
suid is pretty much across-the-board evil.
> Besides root vs non-root I doubt there is any clear line between "raising"
> and "dropping" privileges, you replace one set of allowed operations by
> a different one, that's it. Note that root does not need suid to drop
> its privileges.
"Dropping" privileges in the sense of suid just means setting the
effective and saved uids for the process to the real (invoking,
returned by getuid()) uid.
> > privileges of a different user (may be allowing access to some files only by
> > using specific commands).
>
> As soon as a program is setuid it has to be written for the purpose
> of very reliably checking and limiting what it does on behalf of who,
> independently of how it can potentially be invoked "out of context".
> This is known to be hard, I believe it is harder to do reliably than
> e.g. issue a request to a daemon - talking about the complexity level.
Yes. Said differently, the difference is a huge and perpetually
expanding attack surface (all process state inheritable across exec)
versus a tiny attack surface (one unix socket).
Please don't misinterpret this -- I'm not saying that busybox should
be implementing a "ping daemon". Rather we should be using the
functionality the kernel gave us for avoiding suid (SOCK_DGRAM ICMP)
when it's available and making it possible for users to get a fully
functional busybox without the need for suid.
> > When used with care and as intended, suid and sgid is a nice feature, but
>
> Unfortunately I can not really appreciate its beauty which appears to hide
> the complexity and/or move it to other parties (like the dynamic linker
> or the software maintenance infrastructure). Yes it "looks simple and
> efficient" but is it, really?
It's not.
> > nowadays there are too many Unix novices, who misunderstand or misuse this,
> > punching big holes in every security concern.
>
> Unfortunately even seasoned gurus easily create / fail to notice holes!
> :(
I'd much rather eliminate the opportunity for the hole from the start.
Rich
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
