[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20190712115326.5db9130a@jabberwock.cb.piermont.com>
Date: Fri, 12 Jul 2019 11:53:26 -0400
From: "Perry E. Metzger" <perry@...rmont.com>
To: Jordan Glover <Golden_Miller83@...tonmail.ch>
Cc: oss-security@...ts.openwall.com, Simon McVittie <smcv@...ian.org>
Subject: Re: Privileged File Access from Desktop Applications
On Fri, 12 Jul 2019 14:40:19 +0000 Jordan Glover
<Golden_Miller83@...tonmail.ch> wrote:
> > > I think you might be misunderstanding the scope of D-Bus.
> >
> > Not really. The whole point is that instead of having the
> > operating system alone as part of your file security
> > implementation you now have a brand new service, an IPC
> > mechanism, and loads of other stuff, instead of having your app
> > just do open(2) and write(2) etc.
>
> Do you mean that IPC and D-bus aren't part of the OS? Then what is?
There's already a file i/o mechanism in the kernel, and it's already
doing access control. You're building a second one. This is bad.
Again, if you need fine grained access grants, there's a mechanism
for that which has been intensely studied for decades now, which is
capabilities. Building ad-hoc secondary file i/o handlers isn't going
to be as secure as a capability system, and is going to yield yet
more surface area for attackers, not to mention adding complexity
which makes reasoning about the security of the system harder.
None of this should require saying, but apparently it does.
> > It seems architecturally bad from a security perspective. The
> > number the number of trusted entities, the number of moving
> > parts, the number of mechanisms, and thus the number of ways
> > things can go wrong keeps going up. This is a mistake. And btw,
> > this is a major piece of mechanism being added just to handle the
> > problem of someone wanting to pop open an editor inside a GUI to
> > edit a system config file, which is not a major attack vector.
> > But, now I have to worry about this new file access service
> > providing an attack surface that didn't exist before.
> >
> > What's the right way to handle this stuff? Capabilities,
> > probably. It's what they're designed for.
>
> They're completely not designed for this case. Setting
> CAP_DAC_OVERRIDE or CAP_SYS_ADMIN is very close to SUID root. See:
> https://grsecurity.net/false_boundaries_and_arbitrary_code_execution.php
Those aren't capabilities. Those are this POSIX mechanism that got
the same name for no good reason and doesn't do anything like what an
actual capability system does.
Perry
--
Perry E. Metzger perry@...rmont.com
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
