[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <5491FA9B.8050508@gmail.com>
Date: Wed, 17 Dec 2014 16:50:19 -0500
From: Daniel Micay <danielmicay@...il.com>
To: oss-security@...ts.openwall.com
Subject: Re: What is the "Grinch" polkit/wheel group issue?
If the compromised user is an administator, an unsandboxed process
running as that user can trivially obtain root access.
A small shell script or function wrapping su / sudo is all it takes to
escalate privileges. There's no need to exploit a privesc vulnerability
by obtaining a package with a vulnerable setuid/setgid/setcap binary or
enabled-by-default service.
Any process running as that user can obtain an X11 handle and sniff the
input events. Wayland will change that, but it's only truly valuable in
combination with some form of process isolation.
There's only a strong distinction between root and the administrator's
regular user account if they aren't a sudoer and never switch to root
via su within their session. If root logins are only done from virtual
consoles, then the attacker may actually need to resort to hacks like
this - but I doubt that user would be in the wheel group...
Since the typical usage of wheel is access to sudo, I don't see any
problem with this polkit rule. It's acknowledging that the distinction
between root and an admin user's account (in wheel) has very little
relevance to security, and is more about preventing accidents.
Download attachment "signature.asc" of type "application/pgp-signature" (820 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
