Messages in this thread | | | Date | Tue, 21 Dec 2021 11:41:27 -0500 | Subject | Re: [PATCH] exec: Make suid_dumpable apply to SUID/SGID binaries irrespective of invoking users | From | Waiman Long <> |
| |
On 12/21/21 10:55, Eric W. Biederman wrote: > Waiman Long <longman@redhat.com> writes: > >> The begin_new_exec() function checks for SUID or SGID binaries by >> comparing effective uid and gid against real uid and gid and using >> the suid_dumpable sysctl parameter setting only if either one of them >> differs. >> >> In the special case that the uid and/or gid of the SUID/SGID binaries >> matches the id's of the user invoking it, the suid_dumpable is not >> used and SUID_DUMP_USER will be used instead. The documentation for the >> suid_dumpable sysctl parameter does not include that exception and so >> this will be an undocumented behavior. >> >> Eliminate this undocumented behavior by adding a flag in the linux_binprm >> structure to designate a SUID/SGID binary and use it for determining >> if the suid_dumpable setting should be applied or not. > I see that you are making the code match the documentation. > What harm/problems does this mismatch cause in practice? > What is the motivation for this change? > > I am trying to see the motivation but all I can see is that > in the case where suid and sgid do nothing in practice the code > does not change dumpable. The point of dumpable is to refuse to > core dump when it is not safe. In this case since nothing happened > in practice it is safe. > > So how does this matter in practice. If there isn't a good > motivation my feel is that it is the documentation that needs to be > updated rather than the code. > > There are a lot of warts to the suid/sgid handling during exec. This > just doesn't look like one of them
This patch is a minor mitigation in response to the security vulnerability as posted in https://www.openwall.com/lists/oss-security/2021/10/20/2 (aka CVE-2021-3864). In particular, the Su PoC (tested on CentOS 7) showing that the su invokes /usr/sbin/unix_chkpwd which is also a SUID binary. The initial su invocation won't generate a core dump because the real uid and euid differs, but the second unix_chkpwd invocation will. This patch eliminates this hole by making sure that all SUID binaries follow suid_dumpable setting.
Cheers, Longman
| |