Report forwarded
to bug-guix@gnu.org: bug#28751; Package guix.
(Sun, 08 Oct 2017 19:26:02 GMT) (full text, mbox, link).
Acknowledgement sent
to ludo@gnu.org (Ludovic Courtès):
New bug report received and forwarded. Copy sent to bug-guix@gnu.org.
(Sun, 08 Oct 2017 19:26:02 GMT) (full text, mbox, link).
Subject: GuixSD setuid-programs handling creates setuid binaries in the store
Date: Sun, 08 Oct 2017 21:25:15 +0200
On GuixSD, ‘activate-setuid-programs’ in (gnu build activation) would
create setuid-root binaries under /gnu/store for all the programs listed
under ‘setuid-programs’ in the ‘operating-system’ declaration.
‘activate-setuid-programs’ in (gnu build activation) does this:
(define (make-setuid-program prog)
(let ((target (string-append %setuid-directory
"/" (basename prog))))
(link-or-copy prog target)
(chown target 0 0)
(chmod target #o6555)))
which amounts to:
1. ln /gnu/store/…/bin/su /run/setuid-programs/su
2. chmod +s /run/setuid-programs/su
meaning that *both* ‘su’ files become setuid root.
This leads to setuid-root files in the store, which is a violation of a
fundamental assumption that setuid files cannot exist in the store.
Detailed announcement and fix coming.
Ludo’.
Added tag(s) security.
Request was from ludo@gnu.org (Ludovic Courtès)
to control@debbugs.gnu.org.
(Sun, 08 Oct 2017 19:33:02 GMT) (full text, mbox, link).
Severity set to 'important' from 'normal'
Request was from ludo@gnu.org (Ludovic Courtès)
to control@debbugs.gnu.org.
(Sun, 08 Oct 2017 19:33:02 GMT) (full text, mbox, link).
Information forwarded
to bug-guix@gnu.org: bug#28751; Package guix.
(Sun, 08 Oct 2017 19:34:01 GMT) (full text, mbox, link).
On Sun, Oct 08, 2017 at 09:54:22PM +0200, Ludovic Courtès wrote:
> ludo@gnu.org (Ludovic Courtès) skribis:
>
> > ludo@gnu.org (Ludovic Courtès) skribis:
> >
> >> On GuixSD, ‘activate-setuid-programs’ in (gnu build activation) would
> >> create setuid-root binaries under /gnu/store for all the programs listed
> >> under ‘setuid-programs’ in the ‘operating-system’ declaration.
> >
> > Fixed by
> > <https://git.savannah.gnu.org/cgit/guix.git/commit/?id=5e66574a128937e7f2fcf146d146225703ccfd5d>.
>
> Detailed announcement at:
>
> https://lists.gnu.org/archive/html/guix-devel/2017-10/msg00090.html
FYI, this was assigned CVE-2017-1000455.
I just received the attached JSON from the Distributed Weakness Filing
project (DWF) in response to my CVE application.
I assume it will show up in the regular places (MITRE etc) eventually.
Having thought about this bug for a while, I think it was not too bad in
practice. The setuid executable files could be copied or preserved
somehow by an attacker whether they were in the store or in
/run/setuid-programs.
Subject: Re: bug#28751: GuixSD setuid-programs handling creates setuid
binaries in the store
Date: Sat, 30 Dec 2017 01:28:09 +0100
Leo Famulari <leo@famulari.name> skribis:
> On Sun, Oct 08, 2017 at 09:54:22PM +0200, Ludovic Courtès wrote:
>> ludo@gnu.org (Ludovic Courtès) skribis:
>> > ludo@gnu.org (Ludovic Courtès) skribis:
>> >
>> >> On GuixSD, ‘activate-setuid-programs’ in (gnu build activation) would
>> >> create setuid-root binaries under /gnu/store for all the programs listed
>> >> under ‘setuid-programs’ in the ‘operating-system’ declaration.
>> >
>> > Fixed by
>> > <https://git.savannah.gnu.org/cgit/guix.git/commit/?id=5e66574a128937e7f2fcf146d146225703ccfd5d>.
>>
>> Detailed announcement at:
>>
>> https://lists.gnu.org/archive/html/guix-devel/2017-10/msg00090.html
>
> FYI, this was assigned CVE-2017-1000455.
>
> I just received this JSON from the Distributed Weakness Filing project
> (DWF) in response to my CVE application:
>
> {"data_version": "4.0","references": {"reference_data": [{"url": "https://lists.gnu.org/archive/html/guix-devel/2017-10/msg00090.html"}]},"description": {"description_data": [{"lang": "eng","value": "GuixSD prior to Git commit 5e66574a128937e7f2fcf146d146225703ccfd5d used POSIX hard links incorrectly, leading the creation of setuid executables in \"the store\", violating a fundamental security assumption of GNU Guix."}]},"data_type": "CVE","affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"version": {"version_data": [{"version_value": "All versions of GuixSD prior to Git commit 5e66574a128937e7f2fcf146d146225703ccfd5d"}]},"product_name": "GuixSD"}]},"vendor_name": "GNU Guix"}]}},"CVE_data_meta": {"DATE_ASSIGNED": "2017-12-29","ID": "CVE-2017-1000455","ASSIGNER": "kurt@seifried.org","REQUESTER": "leo@famulari.name"},"data_format": "MITRE","problemtype": {"problemtype_data": [{"description": [{"lang": "eng","value": "Insecure Permissions"}]}]}}
>
> I assume it will show up in the regular places (MITRE etc) eventually.
Great, thanks for following up!
Ludo’.
bug archived.
Request was from Debbugs Internal Request <help-debbugs@gnu.org>
to internal_control@debbugs.gnu.org.
(Sat, 27 Jan 2018 12:24:04 GMT) (full text, mbox, link).
Debbugs is free software and licensed under the terms of the
GNU Public License version 2. The current version can be
obtained from https://bugs.debian.org/debbugs-source/.