[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20150905020818.GA28755@hunt>
Date: Fri, 4 Sep 2015 19:08:18 -0700
From: Seth Arnold <seth.arnold@...onical.com>
To: cve-assign@...re.org
Cc: siddharth@...hat.com, fw@...eb.enyo.de, oss-security@...ts.openwall.com
Subject: Re: Re: CVE Request for glusterfs: fuse check return
value of setuid
On Fri, Sep 04, 2015 at 08:42:10PM -0400, cve-assign@...re.org wrote:
> > https://bugzilla.redhat.com/show_bug.cgi?id=1254488
> > http://review.gluster.org/#/c/10780/
> > https://github.com/gluster/glusterfs/commit/b5ceb1a9de9af563b0f91e2a3138fa5a95cad9f6
> - the only goal in calling setuid is to execute /bin/mount (or
> /bin/umount) from a process with both an effective UID of 0 and a
> real UID of 0. This is a requirement of the util-linux mount
> program. See the "if we're really root and aren't running setuid"
> comment in mount.c. Otherwise, for the types of mount usage in
> question, mount would print "mount: only root can do that" and
> exit.
This is an excellent analysis but does it hinge upon the util-linux "aren't
running suid" behaviour in mount? Does it matter that the busybox mount,
for example, doesn't appear to have this same requirement? I don't see
any corresponding code in:
http://sources.debian.net/src/busybox/1:1.22.0-15/util-linux/mount.c/
I'm certainly no busybox expert but nothing looks like a corresponding
uid == 0 && euid == 0 check. The call to sanitize_env_if_suid() even
suggests setuid execution is expected and anticipated.
Thanks
Download attachment "signature.asc" of type "application/pgp-signature" (474 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
