[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <2ECE9D9EEF1F524185270138AE23265955AB0414@S0MSMAIL112.arc.local>
Date: Tue, 13 Jun 2017 12:32:10 +0000
From: Fiedler Roman <Roman.Fiedler@....ac.at>
To: "oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com>
Subject: Re: Vixie/ISC Cron group crontab to root escalation
> From: Jakub Wilk [mailto:jwilk@...lk.net]
>
> * Fiedler Roman <Roman.Fiedler@....ac.at>, 2017-06-13, 07:45:
> >>>Thanks, perhaps a comment in the code can't hurt...
> >>>Or even O_NODEV which does not exist, or O_PATH (linux only)..
> >>
> >>As there is a O_DIRECTORY it would be more orthogonal to have
> O_REGULAR (open
> >>only a regular file). But that becomes more and more icky as we're
> running
> >>out of 32 bits of O_*)
> >
> >Why not stop that at all and have an O_POLICY,
>
> With help of O_PATH, you can implement almost any sanity check in
> userspace.
> No need to reinvent this particular wheel.
Well, partially: what O_PATH can do, you could also do before O_PATH using
repeated single-level open(NO_FOLLOW)/fstat-checks. So you had to do all the
verification by yourself. fts [1] does that the same in a secure manner. But
often implementation was too complex using syscalls or not easy to do using
the library, so not many programmers did it. The resulting programs were more
prone to be vulnerable.
With O_PATH/fts und own fstat calls, you can also do all the things mentioned
above, but again, I fear, not many will use them, there for convenience
syscalls/libraries should help out.
So decision could be a) do nothing, b) blow up libc or c) blow up syscall
interface. Specific libraries or programming best practices might not be easy
enough to be applied.
LG Roman
[1] https://www.freebsd.org/cgi/man.cgi?query=fts&sektion=3
Download attachment "smime.p7s" of type "application/pkcs7-signature" (4814 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
