unofficial mirror of bug-guix@gnu.org 
 help / color / mirror / code / Atom feed
* bug#28751: GuixSD setuid-programs handling creates setuid binaries in the store
@ 2017-10-08 19:25 Ludovic Courtès
  2017-10-08 19:32 ` Ludovic Courtès
  0 siblings, 1 reply; 5+ messages in thread
From: Ludovic Courtès @ 2017-10-08 19:25 UTC (permalink / raw)
  To: 28751

On GuixSD, ‘activate-setuid-programs’ in (gnu build activation) would
create setuid-root binaries under /gnu/store for all the programs listed
under ‘setuid-programs’ in the ‘operating-system’ declaration.

‘activate-setuid-programs’ in (gnu build activation) does this:

  (define (make-setuid-program prog)
    (let ((target (string-append %setuid-directory
                                 "/" (basename prog))))
      (link-or-copy prog target)
      (chown target 0 0)
      (chmod target #o6555)))

which amounts to:

  1. ln /gnu/store/…/bin/su /run/setuid-programs/su
  2. chmod +s /run/setuid-programs/su

meaning that *both* ‘su’ files become setuid root.

This leads to setuid-root files in the store, which is a violation of a
fundamental assumption that setuid files cannot exist in the store.

Detailed announcement and fix coming.

Ludo’.

^ permalink raw reply	[flat|nested] 5+ messages in thread

* bug#28751: GuixSD setuid-programs handling creates setuid binaries in the store
  2017-10-08 19:25 bug#28751: GuixSD setuid-programs handling creates setuid binaries in the store Ludovic Courtès
@ 2017-10-08 19:32 ` Ludovic Courtès
  2017-10-08 19:54   ` Ludovic Courtès
  0 siblings, 1 reply; 5+ messages in thread
From: Ludovic Courtès @ 2017-10-08 19:32 UTC (permalink / raw)
  To: 28751

ludo@gnu.org (Ludovic Courtès) skribis:

> On GuixSD, ‘activate-setuid-programs’ in (gnu build activation) would
> create setuid-root binaries under /gnu/store for all the programs listed
> under ‘setuid-programs’ in the ‘operating-system’ declaration.

Fixed by
<https://git.savannah.gnu.org/cgit/guix.git/commit/?id=5e66574a128937e7f2fcf146d146225703ccfd5d>.

Ludo’.

^ permalink raw reply	[flat|nested] 5+ messages in thread

* bug#28751: GuixSD setuid-programs handling creates setuid binaries in the store
  2017-10-08 19:32 ` Ludovic Courtès
@ 2017-10-08 19:54   ` Ludovic Courtès
  2017-12-29 23:09     ` Leo Famulari
       [not found]     ` <20171229223329.GA25194@jasmine.lan>
  0 siblings, 2 replies; 5+ messages in thread
From: Ludovic Courtès @ 2017-10-08 19:54 UTC (permalink / raw)
  To: 28751-done

ludo@gnu.org (Ludovic Courtès) skribis:

> ludo@gnu.org (Ludovic Courtès) skribis:
>
>> On GuixSD, ‘activate-setuid-programs’ in (gnu build activation) would
>> create setuid-root binaries under /gnu/store for all the programs listed
>> under ‘setuid-programs’ in the ‘operating-system’ declaration.
>
> Fixed by
> <https://git.savannah.gnu.org/cgit/guix.git/commit/?id=5e66574a128937e7f2fcf146d146225703ccfd5d>.

Detailed announcement at:

  https://lists.gnu.org/archive/html/guix-devel/2017-10/msg00090.html

Ludo’.

^ permalink raw reply	[flat|nested] 5+ messages in thread

* bug#28751: GuixSD setuid-programs handling creates setuid binaries in the store
  2017-10-08 19:54   ` Ludovic Courtès
@ 2017-12-29 23:09     ` Leo Famulari
       [not found]     ` <20171229223329.GA25194@jasmine.lan>
  1 sibling, 0 replies; 5+ messages in thread
From: Leo Famulari @ 2017-12-29 23:09 UTC (permalink / raw)
  To: 28751


[-- Attachment #1.1: Type: text/plain, Size: 1104 bytes --]

On Sun, Oct 08, 2017 at 09:54:22PM +0200, Ludovic Courtès wrote:
> ludo@gnu.org (Ludovic Courtès) skribis:
> 
> > ludo@gnu.org (Ludovic Courtès) skribis:
> >
> >> On GuixSD, ‘activate-setuid-programs’ in (gnu build activation) would
> >> create setuid-root binaries under /gnu/store for all the programs listed
> >> under ‘setuid-programs’ in the ‘operating-system’ declaration.
> >
> > Fixed by
> > <https://git.savannah.gnu.org/cgit/guix.git/commit/?id=5e66574a128937e7f2fcf146d146225703ccfd5d>.
> 
> Detailed announcement at:
> 
>   https://lists.gnu.org/archive/html/guix-devel/2017-10/msg00090.html

FYI, this was assigned CVE-2017-1000455.

I just received the attached JSON from the Distributed Weakness Filing
project (DWF) in response to my CVE application.

I assume it will show up in the regular places (MITRE etc) eventually.

Having thought about this bug for a while, I think it was not too bad in
practice. The setuid executable files could be copied or preserved
somehow by an attacker whether they were in the store or in
/run/setuid-programs.

[-- Attachment #1.2: CVE-2017-1000455.json --]
[-- Type: text/plain, Size: 979 bytes --]

{"data_version": "4.0","references": {"reference_data": [{"url": "https://lists.gnu.org/archive/html/guix-devel/2017-10/msg00090.html"}]},"description": {"description_data": [{"lang": "eng","value": "GuixSD prior to Git commit 5e66574a128937e7f2fcf146d146225703ccfd5d used POSIX hard links incorrectly, leading the creation of setuid executables in \"the store\", violating a fundamental security assumption of GNU Guix."}]},"data_type": "CVE","affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"version": {"version_data": [{"version_value": "All versions of GuixSD prior to Git commit 5e66574a128937e7f2fcf146d146225703ccfd5d"}]},"product_name": "GuixSD"}]},"vendor_name": "GNU Guix"}]}},"CVE_data_meta": {"DATE_ASSIGNED": "2017-12-29","ID": "CVE-2017-1000455","ASSIGNER": "kurt@s
 eifried.org","REQUESTER": "leo@famulari.name"},"data_format": "MITRE","problemtype": {"problemtype_data": [{"description": [{"lang": "eng","value": "Insecure Permissions"}]}]}}

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

^ permalink raw reply	[flat|nested] 5+ messages in thread

* bug#28751: GuixSD setuid-programs handling creates setuid binaries in the store
       [not found]     ` <20171229223329.GA25194@jasmine.lan>
@ 2017-12-30  0:28       ` Ludovic Courtès
  0 siblings, 0 replies; 5+ messages in thread
From: Ludovic Courtès @ 2017-12-30  0:28 UTC (permalink / raw)
  To: Leo Famulari; +Cc: 28751

Leo Famulari <leo@famulari.name> skribis:

> On Sun, Oct 08, 2017 at 09:54:22PM +0200, Ludovic Courtès wrote:
>> ludo@gnu.org (Ludovic Courtès) skribis:
>> > ludo@gnu.org (Ludovic Courtès) skribis:
>> >
>> >> On GuixSD, ‘activate-setuid-programs’ in (gnu build activation) would
>> >> create setuid-root binaries under /gnu/store for all the programs listed
>> >> under ‘setuid-programs’ in the ‘operating-system’ declaration.
>> >
>> > Fixed by
>> > <https://git.savannah.gnu.org/cgit/guix.git/commit/?id=5e66574a128937e7f2fcf146d146225703ccfd5d>.
>> 
>> Detailed announcement at:
>> 
>>   https://lists.gnu.org/archive/html/guix-devel/2017-10/msg00090.html
>
> FYI, this was assigned CVE-2017-1000455.
>
> I just received this JSON from the Distributed Weakness Filing project
> (DWF) in response to my CVE application:
>
> {"data_version": "4.0","references": {"reference_data": [{"url": "https://lists.gnu.org/archive/html/guix-devel/2017-10/msg00090.html"}]},"description": {"description_data": [{"lang": "eng","value": "GuixSD prior to Git commit 5e66574a128937e7f2fcf146d146225703ccfd5d used POSIX hard links incorrectly, leading the creation of setuid executables in \"the store\", violating a fundamental security assumption of GNU Guix."}]},"data_type": "CVE","affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"version": {"version_data": [{"version_value": "All versions of GuixSD prior to Git commit 5e66574a128937e7f2fcf146d146225703ccfd5d"}]},"product_name": "GuixSD"}]},"vendor_name": "GNU Guix"}]}},"CVE_data_meta": {"DATE_ASSIGNED": "2017-12-29","ID": "CVE-2017-1000455","ASSIGNER": "kurt@seifried.org","REQUESTER": "leo@famulari.name"},"data_format": "MITRE","problemtype": {"problemtype_data": [{"description": [{"lang": "eng","value": "Insecure Permissions"}]}]}}
>
> I assume it will show up in the regular places (MITRE etc) eventually.

Great, thanks for following up!

Ludo’.

^ permalink raw reply	[flat|nested] 5+ messages in thread

end of thread, other threads:[~2017-12-30  0:29 UTC | newest]

Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2017-10-08 19:25 bug#28751: GuixSD setuid-programs handling creates setuid binaries in the store Ludovic Courtès
2017-10-08 19:32 ` Ludovic Courtès
2017-10-08 19:54   ` Ludovic Courtès
2017-12-29 23:09     ` Leo Famulari
     [not found]     ` <20171229223329.GA25194@jasmine.lan>
2017-12-30  0:28       ` Ludovic Courtès

Code repositories for project(s) associated with this public inbox

	https://git.savannah.gnu.org/cgit/guix.git

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).