[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <50164B49.30205@suse.de>
Date: Mon, 30 Jul 2012 10:52:25 +0200
From: Ludwig Nussel <ludwig.nussel@...e.de>
To: oss-security@...ts.openwall.com
Subject: Re: libdbus hardening
Simon McVittie wrote:
> On 10/07/12 14:09, Sebastian Krahmer wrote:
>> We are going to add a libdbus hardening patch:
>>
>> https://bugzilla.novell.com/show_bug.cgi?id=697105
>>
>> This is because some suid binaries (Xorg and others) are linked against libdbus
>
> The tl;dr: version if (e.g.) your Xorg binary still uses HAL and is also
> setuid, ensure that it cleans its environment using a whitelist before
> its first use of libdbus, libhal, any other non-trivial library, or exec().
>
> In off-list discussion with the other D-Bus upstream maintainers,
> consensus was that binaries with greater privileges than their parent
> process (setuid or VFS capabilities) must not use non-trivial libraries
> [...]
> In particular, we do not support use of libdbus in setuid binaries that
> do not sanitize their environment before their first call into libdbus.
PAM modules of systemd and consolekit use libdbus though. PAM can't
scrub the environment before calling modules as those modules may want
to do something with the information gained from the original
environment (like e.g. pam_xauth).
cu
Ludwig
--
(o_ Ludwig Nussel
//\
V_/_ http://www.suse.de/
SUSE LINUX Products GmbH, GF: Jeff Hawn, Jennifer Guild, Felix Imendörffer, HRB 16746 (AG Nürnberg)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
