[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <509965F8.60505@halfdog.net>
Date: Tue, 06 Nov 2012 19:33:12 +0000
From: halfdog <me@...fdog.net>
To: oss-security@...ts.openwall.com
CC: vladz <vladz@...zero.fr>
Subject: Re: TTY handling when executing code in different
lower-privileged context (su, virt containers)
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
vladz wrote:
>
> On Mon, Nov 05, 2012 at 07:22:37PM +0000, halfdog wrote:
>> During programming experiments I found some class of
>> vulnerabilities [1], that seem to be rediscovered again from time
>> to time, but since attack value is questionable, it was not fixed
>> yet.
>
> Nice. I was just wondering why the SIGSTOP signal is used here?
> Sending a string starting with "exit;" to close the child process
> also does the trick, no? ...
I'm not sure if there are cases where this is really required. I added
it to support setups like [root-shell] -> su -> [bad-binary].
The shell with foreground process will no process the input. When
suspending the parent, shell will process input, last line of input is
"fg" to get normal su running again.
I would think of using it that way: [bad-binary] is started by admin
via su on error or other user process performs attach-exec-transform
(like with vserver example). [bad-binary] then backdoors root account
(modify sudoers, add ssh keys, make libc world writable), clears the
screen, writes out some large banner or error message, so that admin
does not see the injected commands and then launches the [good-binary].
Therefore it might be useful to temporarily suspend the process
executed from shell.
>> I would like to propose following "fix" for this problem:
>> Modification of man-page of su making this a known problem or
>> feature, not a bug.
>
> Changing the man page is a good idea. Administrators (good ones)
> should never have to open users's interactive shells. I mean,
> beside being a security problem, it's kind of invasion of privacy.
> ;)
Not to a standard user account. But some daemons come with own account
and that might be hot candidates. For example the postgresql default
configuration allows psql maintenance connections only from user
"postgres" on localhost (via shared mem if I remember correctly).
Therefore su to "postgres" for database in- or exports might be used
quite frequently, perhaps someone could confirm that or bring even
other examples.
- --
http://www.halfdog.net/
PGP: 156A AE98 B91F 0114 FE88 2BD8 C459 9386 feed a bee
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
iEYEARECAAYFAlCZZecACgkQxFmThv7tq+79IACdHNfY7k1/c5+9UvwO7Pznmy2E
WxQAnjZruvgAdAhoniCLGKLvGkwBq7bN
=kaTH
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
