* [bug#73750] [PATCH] gnu: system: %default-privileged-programs: Set ping capabilities
@ 2024-10-11 19:49 Rutherther via Guix-patches via
0 siblings, 0 replies; only message in thread
From: Rutherther via Guix-patches via @ 2024-10-11 19:49 UTC (permalink / raw)
To: 73750; +Cc: Rutherther
Ping and ping6 don't need setuid, they can work with
cap_net_raw capability only. This means that even if
ping or ping6 had a vulnerability that could be
used for execution as root, it can't anymore if
the program is not setuid.
* gnu/system.scm (%default-privileged-programs): Remove ping, ping6 setuid
programs, add ping, ping6 programs with cap_net_raw=ep capabilities
Change-Id: Ie409b477f548dbff3318eec33d0d2ca16a1b3209
---
gnu/system.scm | 43 ++++++++++++++++++++++++-------------------
1 file changed, 24 insertions(+), 19 deletions(-)
diff --git a/gnu/system.scm b/gnu/system.scm
index 44f93f91d1..c0cda6baa4 100644
--- a/gnu/system.scm
+++ b/gnu/system.scm
@@ -1249,25 +1249,30 @@ (define (operating-system-environment-variables os)
(define %default-privileged-programs
(let ((shadow (@ (gnu packages admin) shadow)))
- (map file-like->setuid-program
- (list (file-append shadow "/bin/passwd")
- (file-append shadow "/bin/chfn")
- (file-append shadow "/bin/sg")
- (file-append shadow "/bin/su")
- (file-append shadow "/bin/newgrp")
- (file-append shadow "/bin/newuidmap")
- (file-append shadow "/bin/newgidmap")
- (file-append inetutils "/bin/ping")
- (file-append inetutils "/bin/ping6")
- (file-append sudo "/bin/sudo")
- (file-append sudo "/bin/sudoedit")
- (file-append fuse-2 "/bin/fusermount")
- (file-append fuse "/bin/fusermount3")
-
- ;; To allow mounts with the "user" option, "mount" and "umount" must
- ;; be setuid-root.
- (file-append util-linux "/bin/mount")
- (file-append util-linux "/bin/umount")))))
+ (cons*
+ (privileged-program
+ (program (file-append inetutils "/bin/ping"))
+ (capabilities "cap_net_raw=ep"))
+ (privileged-program
+ (program (file-append inetutils "/bin/ping6"))
+ (capabilities "cap_net_raw=ep"))
+ (map file-like->setuid-program
+ (list (file-append shadow "/bin/passwd")
+ (file-append shadow "/bin/chfn")
+ (file-append shadow "/bin/sg")
+ (file-append shadow "/bin/su")
+ (file-append shadow "/bin/newgrp")
+ (file-append shadow "/bin/newuidmap")
+ (file-append shadow "/bin/newgidmap")
+ (file-append sudo "/bin/sudo")
+ (file-append sudo "/bin/sudoedit")
+ (file-append fuse-2 "/bin/fusermount")
+ (file-append fuse "/bin/fusermount3")
+
+ ;; To allow mounts with the "user" option, "mount" and "umount" must
+ ;; be setuid-root.
+ (file-append util-linux "/bin/mount")
+ (file-append util-linux "/bin/umount"))))))
(define %setuid-programs
;; Do not add to this list or use it in new code! It's defined only to ease
base-commit: b8fd792ea267cb920da0651074a533d8abf00488
--
2.46.0
^ permalink raw reply related [flat|nested] only message in thread
only message in thread, other threads:[~2024-10-11 19:51 UTC | newest]
Thread overview: (only message) (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2024-10-11 19:49 [bug#73750] [PATCH] gnu: system: %default-privileged-programs: Set ping capabilities Rutherther via Guix-patches via
Code repositories for project(s) associated with this external index
https://git.savannah.gnu.org/cgit/guix.git
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.