unofficial mirror of bug-guix@gnu.org 
 help / color / mirror / Atom feed
* bug#52011: pkexec: PATH environment variable
@ 2021-11-21  8:03 Hamzeh Nasajpour
  2021-11-21 14:52 ` Liliana Marie Prikler
  0 siblings, 1 reply; 3+ messages in thread
From: Hamzeh Nasajpour @ 2021-11-21  8:03 UTC (permalink / raw)
  To: 52011

The `PATH` environment variable is hard-code here: 
https://github.com/freedesktop/polkit/blob/master/src/programs/pkexec.c#L882-L886

We don't have any executable in these paths in guix:
```
/usr/sbin:/usr/bin:/sbin:/bin:/root/bin
``` 

Replicate the issue:
1. Run the `pkexec`
2. Enter your password
3. run `echo $PATH` in the opened terminal
4. You will see this path: `/usr/sbin:/usr/bin:/sbin:/bin:/root/bin`
5. You can't run most of the commands. (`ls`, `passwd`, `chpasswd` and so on.)

Expected Behavior:
Running all of the commands without any error.

Isn't it? Should not we patch the `PATH` environment variable in `pkexec` source codes? Either way, some applications like `lxqt-admin-user` and `lxqt-admin-time` has an issue and they can't run the commands via `pkexec`. I get this error when I want to change user password via `lxqt-admin-user`. It's using `pkexec` to change password.

```
/run/current-system/profile/bin/lxqt-admin-user-helper: line 7: exec: passwd: not found
``` 

--

Hamzeh Nasajpour
PantherX Team




^ permalink raw reply	[flat|nested] 3+ messages in thread

* bug#52011: pkexec: PATH environment variable
  2021-11-21  8:03 bug#52011: pkexec: PATH environment variable Hamzeh Nasajpour
@ 2021-11-21 14:52 ` Liliana Marie Prikler
  2021-11-28  7:39   ` Hamzeh Nasajpour
  0 siblings, 1 reply; 3+ messages in thread
From: Liliana Marie Prikler @ 2021-11-21 14:52 UTC (permalink / raw)
  To: Hamzeh Nasajpour, 52011

Hi,

Am Sonntag, den 21.11.2021, 11:33 +0330 schrieb Hamzeh Nasajpour:
> The `PATH` environment variable is hard-code here: 
> 
> https://github.com/freedesktop/polkit/blob/master/src/programs/pkexec.c#L882-L886
> 
> We don't have any executable in these paths in guix:
> ```
> /usr/sbin:/usr/bin:/sbin:/bin:/root/bin
> ``` 
> 
> Replicate the issue:
> 1. Run the `pkexec`
> 2. Enter your password
> 3. run `echo $PATH` in the opened terminal
> 4. You will see this path: `/usr/sbin:/usr/bin:/sbin:/bin:/root/bin`
> 5. You can't run most of the commands. (`ls`, `passwd`, `chpasswd`
> and so on.)
> 
> Expected Behavior:
> Running all of the commands without any error.
> 
> Isn't it? Should not we patch the `PATH` environment variable in
> `pkexec` source codes? Either way, some applications like `lxqt-
> admin-user` and `lxqt-admin-time` has an issue and they can't run the
> commands via `pkexec`. I get this error when I want to change user
> password via `lxqt-admin-user`. It's using `pkexec` to change
> password.
I'm getting some flashbacks from my ITSec courses here.  pkexec is
protecting itself against a malicious PATH attack.  The paths are
chosen somewhat arbitrarily, but on traditional distros this ought to
ensure, that no privilege escalation occurs.  We could inject
/run/current-system, given that /run likewise ought to be root-writable 
only, but I'm not sure how much that helps.  The obvious solution is to
use canonical (store) paths with pkexec.

Cheers





^ permalink raw reply	[flat|nested] 3+ messages in thread

* bug#52011: pkexec: PATH environment variable
  2021-11-21 14:52 ` Liliana Marie Prikler
@ 2021-11-28  7:39   ` Hamzeh Nasajpour
  0 siblings, 0 replies; 3+ messages in thread
From: Hamzeh Nasajpour @ 2021-11-28  7:39 UTC (permalink / raw)
  To: Liliana Marie Prikler, 52011

Hi Lillana,

Thanks for your response and sorry for delay.

> We could inject /run/current-system, given that /run likewise ought to be root-writable 
> only, but I'm not sure how much that helps.  The obvious solution is to
> use canonical (store) paths with pkexec.

Honestly, I couldn't find out your solution. Can you clarify it?

Regards,

-- 

Hamzeh Nasajpour
PantherX Team




^ permalink raw reply	[flat|nested] 3+ messages in thread

end of thread, other threads:[~2021-11-28  7:41 UTC | newest]

Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-11-21  8:03 bug#52011: pkexec: PATH environment variable Hamzeh Nasajpour
2021-11-21 14:52 ` Liliana Marie Prikler
2021-11-28  7:39   ` Hamzeh Nasajpour

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).