Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.devel > #100966 > unrolled thread

Debian package manager privilege escalation attack

Back to article view | Back to linux.debian.devel

Contents

  Debian package manager privilege escalation attack Timothy M Butterworth <timothy.m.butterworth@gmail.com> - 2021-08-12 05:40 +0200
    Re: Debian package manager privilege escalation attack Brian Thompson <brian@hashvault.io> - 2021-08-12 06:00 +0200
      Re: Debian package manager privilege escalation attack Andrey Rahmatullin <wrar@debian.org> - 2021-08-12 07:50 +0200
        Re: Debian package manager privilege escalation attack Brian Thompson <brian@hashvault.io> - 2021-08-12 08:20 +0200
          Re: Debian package manager privilege escalation attack Andrey Rahmatullin <wrar@debian.org> - 2021-08-12 08:30 +0200
            Re: Debian package manager privilege escalation attack Paul Tagliamonte <paultag@debian.org> - 2021-08-12 15:00 +0200
    Re: Debian package manager privilege escalation attack Andrey Rahmatullin <wrar@debian.org> - 2021-08-12 07:40 +0200
      Re: Debian package manager privilege escalation attack Vincent Bernat <bernat@debian.org> - 2021-08-12 08:40 +0200
        Re: Debian package manager privilege escalation attack Andrey Rahmatullin <wrar@debian.org> - 2021-08-12 08:40 +0200
          Re: Debian package manager privilege escalation attack Vincent Bernat <bernat@debian.org> - 2021-08-12 09:00 +0200
        Re: Debian package manager privilege escalation attack Ansgar <ansgar@43-1.org> - 2021-08-12 10:40 +0200
          Re: Debian package manager privilege escalation attack Vincent Bernat <bernat@debian.org> - 2021-08-12 11:20 +0200
        Re: Debian package manager privilege escalation attack Philipp Kern <pkern@debian.org> - 2021-08-12 11:20 +0200
        Re: Debian package manager privilege escalation attack David Kalnischkies <david@kalnischkies.de> - 2021-08-12 13:50 +0200
        Re: Debian package manager privilege escalation attack Kyle Edwards <kyle.edwards@kitware.com> - 2021-08-12 14:40 +0200
          Re: Debian package manager privilege escalation attack Andrey Rahmatullin <wrar@debian.org> - 2021-08-12 14:50 +0200
    Re: Debian package manager privilege escalation attack Niels Thykier <niels@thykier.net> - 2021-08-12 07:40 +0200
      Re: Debian package manager privilege escalation attack Andrey Rahmatullin <wrar@debian.org> - 2021-08-12 08:20 +0200
        Re: Debian package manager privilege escalation attack Brian Thompson <brian@hashvault.io> - 2021-08-12 08:30 +0200
          Re: Debian package manager privilege escalation attack Andrey Rahmatullin <wrar@debian.org> - 2021-08-12 08:40 +0200
          Re: Debian package manager privilege escalation attack Polyna-Maude Racicot-Summerside <debian@polynamaude.com> - 2021-08-12 12:30 +0200
            Re: Debian package manager privilege escalation attack Philipp Kern <pkern@debian.org> - 2021-08-12 13:50 +0200
              Re: Debian package manager privilege escalation attack Marc Haber <mh+debian-devel@zugschlus.de> - 2021-08-12 18:00 +0200
                Re: Debian package manager privilege escalation attack Philipp Kern <pkern@debian.org> - 2021-08-12 20:10 +0200
                  Re: Debian package manager privilege escalation attack Russ Allbery <rra@debian.org> - 2021-08-12 21:10 +0200
      Re: Debian package manager privilege escalation attack Brian Thompson <brian@hashvault.io> - 2021-08-12 08:20 +0200
        Re: Debian package manager privilege escalation attack Holger Levsen <holger@layer-acht.org> - 2021-08-12 15:20 +0200
          Re: Debian package manager privilege escalation attack Holger Levsen <holger@layer-acht.org> - 2021-08-12 18:10 +0200
          Re: Debian package manager privilege escalation attack Wouter Verhelst <wouter@debian.org> - 2021-08-16 16:50 +0200

Page 2 of 2 — ← Prev page 1 [2]

#100987

[Multipart message — attachments visible in raw view] — view raw

Hi,

On 2021-08-12 2:25 a.m., Brian Thompson wrote:
> On Thu, 2021-08-12 at 11:19 +0500, Andrey Rahmatullin wrote:
>> On Thu, Aug 12, 2021 at 01:12:37AM -0500, Brian Thompson wrote:
>>> Would you agree that there is an issue with sudo access that is
>>> enabled
>>> by default on most Debian and Debian-based distributions? The bug
>>> may
>>> not be in apt, but it definitely lives somewhere.
>> Do you think "sudo access" itself is a "privilege escalation attack"?
> 
> I do not. I think that the possibility of dangerously configured sudo
> access is a vulnerability.
>
So this is not a *privilege escalation attack* but more a warning to all
user that "using sudo can be used to do stuff as root" ?

We are so lucky that someone wrote a article on the subject and you
shared it with us.

But this is not a privilege escalation attack, it's something that is
planned and known.

1. Read apt documentation, it is said that script will be executed as root.
2. Read sudo documentation, it is said that allowing user access to some
program as root should be as limited as possible.
3. Read sudo documentation, the goal is allowing to run a root.

Now if people start doing stuff they don't master than it's not
privilege escalation but much more something like another manifestation
of human stupidity. And this, there won't be a number of article
sufficient to make people change.

If I'd have apt access under sudo and would like root access, this would
be the last method I'd use. There's so many more, starting by modifying
a existing package and adding a backdoor to it, the updating the system.
Adding SSH keys, adding a line to sudoers, etc.

This is only a article made to get people onto a website and see
publicity or whatever goal the author set. There's nothing genuine in there.

-- 
Polyna-Maude R.-Summerside
-Be smart, Be wise, Support opensource development

[toc] | [prev] | [next] | [standalone]

#100988

On 2021-08-12 12:23, Polyna-Maude Racicot-Summerside wrote:
> Now if people start doing stuff they don't master than it's not
> privilege escalation but much more something like another manifestation
> of human stupidity. And this, there won't be a number of article
> sufficient to make people change.
[...]
> This is only a article made to get people onto a website and see
> publicity or whatever goal the author set. There's nothing genuine in 
> there.

I think it's less about human stupidity than about all the knowledge you 
need to acquire (and retain) to securely administer a system. It is not 
easy. The concern expressed here is pretty much common knowledge among 
sysadmins of ye olde times. Of course you can abuse this, and yes it got 
easier recently. The boundary that sudo provides is very blurry, hard to 
understand and full of footguns. People need to come up with better 
boundaries - or in this case they might already exist. Basically you 
need to be able to validate the request and execute it in a secure 
environment. At basically every shared environment people come up with 
some way to allow package installation, but it's not easy to find the 
right instructions on how to do this properly on Debian[1]. I'm not 
aware of a well-trotten path for maintaining a system where users do not 
need root. Throw in some reluctance to deal with "newfangled things" (to 
establish new, maybe controversial boundaries) and you end up with every 
one fighting for themselves.

Now of course there's value in people having this knowledge and 
companies should recognize this value. But from communication and 
awareness we learn, no?

Kind regards
Philipp Kern

[1] E.g. thinking of https://debian-handbook.info/browse/stable/

[toc] | [prev] | [next] | [standalone]

#100996

On Thu, 12 Aug 2021 13:44:24 +0200, Philipp Kern <pkern@debian.org>
wrote:
>On 2021-08-12 12:23, Polyna-Maude Racicot-Summerside wrote:
>> Now if people start doing stuff they don't master than it's not
>> privilege escalation but much more something like another manifestation
>> of human stupidity. And this, there won't be a number of article
>> sufficient to make people change.
>[...]
>> This is only a article made to get people onto a website and see
>> publicity or whatever goal the author set. There's nothing genuine in 
>> there.
>
>I think it's less about human stupidity than about all the knowledge you 
>need to acquire (and retain) to securely administer a system. It is not 
>easy. The concern expressed here is pretty much common knowledge among 
>sysadmins of ye olde times.

I think the essence of the article is, that on some apt/dpkg using
distributions, a "normal" user gets sudo rights to do apt only (I have
never seen that on Debian, do we do this in some corner case?) and is
able to escalate to root from that trivially, even without doctoring
some malicious package, just shell out from dpkg's conffile prompt to
a full root shell.

Greetings
Marc
-- 
-------------------------------------- !! No courtesy copies, please !! -----
Marc Haber         |   " Questions are the         | Mailadresse im Header
Mannheim, Germany  |     Beginning of Wisdom "     | 
Nordisch by Nature | Lt. Worf, TNG "Rightful Heir" | Fon: *49 621 72739834

[toc] | [prev] | [next] | [standalone]

#100998

On 2021-08-12 17:56, Marc Haber wrote:
> On Thu, 12 Aug 2021 13:44:24 +0200, Philipp Kern <pkern@debian.org>
> wrote:
>> On 2021-08-12 12:23, Polyna-Maude Racicot-Summerside wrote:
>>> Now if people start doing stuff they don't master than it's not
>>> privilege escalation but much more something like another 
>>> manifestation
>>> of human stupidity. And this, there won't be a number of article
>>> sufficient to make people change.
>> [...]
>>> This is only a article made to get people onto a website and see
>>> publicity or whatever goal the author set. There's nothing genuine in
>>> there.
>> 
>> I think it's less about human stupidity than about all the knowledge 
>> you
>> need to acquire (and retain) to securely administer a system. It is 
>> not
>> easy. The concern expressed here is pretty much common knowledge among
>> sysadmins of ye olde times.
> 
> I think the essence of the article is, that on some apt/dpkg using
> distributions, a "normal" user gets sudo rights to do apt only (I have
> never seen that on Debian, do we do this in some corner case?) and is
> able to escalate to root from that trivially, even without doctoring
> some malicious package, just shell out from dpkg's conffile prompt to
> a full root shell.

You know that this is a bad idea (granting sudo to apt without a 
wrapper). I know that this is a bad idea. That was my point. Plus that 
this is a very common trope in multi-user settings that you want to hand 
out some privilege to install packages.

Kind regards
Philipp Kern

[toc] | [prev] | [next] | [standalone]

#100999

Philipp Kern <pkern@debian.org> writes:

> You know that this is a bad idea (granting sudo to apt without a
> wrapper). I know that this is a bad idea. That was my point. Plus that
> this is a very common trope in multi-user settings that you want to hand
> out some privilege to install packages.

Right, but this is a sudo problem, not an apt problem (which I suspect you
agree with, but I think it's important to make it clear).  sudo makes it
very convenient to give direct access to regular tools and this is almost
always a mistake.  As you say, that's been long-standing sysadmin lore
that arguably even predates sudo and goes back to limited setuid shells
and other tricks.

If you want to give people escalated privilege to run a thing, that thing
should be a custom-written wrapper that does only one thing and only does
the thing that you want to let them do, not a general tool that may have
other options or may change later.  And ideally you do it via an RPC
because setuid programs in UNIX are a giant pile of foot-guns.  Otherwise,
just be aware that you're basically trusting them with root with slightly
better logging and don't rely too much on the security boundary.

I think it's in some ways unfortunate that sudo has become so popular
because it makes this mistake so easy and so common.  I have found
privilege escalation vulnerabilities in almost every non-trivial sudo
configuration that I've looked at, not due to some bug in sudo but due to
bugs in the understanding of sudo and what it can and can't do by the
people writing the configuration.  It is *extremely hard* to configure
sudo correctly in anything other than "logged access to root" mode.

-- 
Russ Allbery (rra@debian.org)              <https://www.eyrie.org/~eagle/>

[toc] | [prev] | [next] | [standalone]

#100974

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

On Thu, 2021-08-12 at 07:38 +0200, Niels Thykier wrote:
> Timothy M Butterworth:
> > All,
> > 
> > I just ran across this article
> > https://blog.ikuamike.io/posts/2021/package_managers_privesc/ I
> > tested
> > the attacks on Debian 11 and they work successfully giving me a root
> > shell prompt.
> > 
> > Tim
> > 
> 
> Hi Tim,
> 
> All of the attacks presented assumes that the local user has "sudo"
> permissions to run apt and use that as the basis for escalating
> privileges (not commenting on yum or snap).
> 
> I think it is a good demonstration of how some sudo policies are too
> lenient and can be exploited.  Though I am not sure this is a bug in
> apt, as I do not think apt ever promised to be "safe" to use from a
> constrained sudo policy.
> 

Would you agree that there is an issue with sudo access that is enabled
by default on most Debian and Debian-based distributions? The bug may
not be in apt, but it definitely lives somewhere.

> Thanks,
> ~Niels
> 
-----BEGIN PGP SIGNATURE-----

iQJHBAEBCgAxFiEE9fpVo96/flopdKOfgw2Ncu3Nhn0FAmEUu9UTHGJyaWFuQGhh
c2h2YXVsdC5pbwAKCRCDDY1y7c2Gfb8QD/sH4ko8qsI7Dxyf4t8oM7bRWnGeyYXG
C+e/7kb8ePKXJcSIspbzlEHefsp/chqjWQnA8f3Kqjdn77eGVecxk5O7cyN0nJyC
Ih3LyLvuU2CoeLsPw7+0g4Ta81sdNh22xl/M1V3Fkbg5E1AWL7dSLwuj7LzgH5Fo
w/YudfGKiyZD7gtdgOP3rfae0rLsgxklUsZQOSEEHyYGuwWZRhwNimWnytKI9XC2
z4LrAxeW07e3GA/RjUWp86/+Lub7RchirCvkV2HpAFRY88mBQbHGLjskyRma3FQ4
rfkuGOQ8R34MHuth7HeSjzuKQhqQ7FRFbH5n0rPB1O20jnjbtO/0UuQ88Foha2Um
+S//kLXXpPEo/52nBGnT9KmRTTaMAmqbZPTuE2F5T2hLtNBhgK8HPEcMpn7jW1vT
EYYg3aoNvO6pFe0jL9gGomViS+JoCcFkXQI4xaPqkQchjOkTaQNym8alxDiZqwEk
rKq8Fz3mTlMYQHpuTM9qNLPCkTWlMg+mFsEarZJcWtjrHiqIKFFPAH+G9SMqHRxD
LUcU0iKcoZtBvtSnDnt8QFhwc9eWPFqitoPihliAkfORC7KMmMJ5QgEd0TN/5r6n
LmyVo7n8zF2D1ZwUAty3WfWMpRgx8TC2keXsuLWyqW9EZO/PSQplO86tjzYDYWfg
WgY5vDsL7eMzFg==
=QmLv
-----END PGP SIGNATURE-----

[toc] | [prev] | [next] | [standalone]

#100994

[Multipart message — attachments visible in raw view] — view raw

On Thu, Aug 12, 2021 at 01:12:37AM -0500, Brian Thompson wrote:
> Would you agree that there is an issue with sudo access that is enabled
> by default on most Debian and Debian-based distributions? The bug may
> not be in apt, but it definitely lives somewhere.

if those users are not trustworthy than the bug is giving them sudo,
nothing else. (Debian does not give sudo to users by default. The default
is to set a root password.)

if you give someone a gun for hunting (animals) and that person uses
the gun for hunting people, the problem is not in the configuration of
that gun, but that someone.


-- 
cheers,
	Holger

 ⢀⣴⠾⠻⢶⣦⠀
 ⣾⠁⢠⠒⠀⣿⡁  holger@(debian|reproducible-builds|layer-acht).org
 ⢿⡄⠘⠷⠚⠋⠀  OpenPGP: B8BF54137B09D35CF026FE9D 091AB856069AAA1C
 ⠈⠳⣄

Change is coming whether you like it or not.

[toc] | [prev] | [next] | [standalone]

#100997

[Multipart message — attachments visible in raw view] — view raw

On Thu, Aug 12, 2021 at 01:19:23PM +0000, Holger Levsen wrote:
> if those users are not trustworthy than the bug is giving them sudo,
> nothing else. (Debian does not give sudo to users by default. The default
> is to set a root password.)
> 
> if you give someone a gun for hunting (animals) and that person uses
> the gun for hunting people, the problem is not in the configuration of
> that gun, but that someone.

after some thinking I'd like to s#hunting (animals)#self defense#.

[toc] | [prev] | [next] | [standalone]

#101060

On Thu, Aug 12, 2021 at 01:19:23PM +0000, Holger Levsen wrote:
> On Thu, Aug 12, 2021 at 01:12:37AM -0500, Brian Thompson wrote:
> > Would you agree that there is an issue with sudo access that is enabled
> > by default on most Debian and Debian-based distributions? The bug may
> > not be in apt, but it definitely lives somewhere.
> 
> if those users are not trustworthy than the bug is giving them sudo,
> nothing else. (Debian does not give sudo to users by default. The default
> is to set a root password.)

Well, if you choose not to enter a root password, then the installed
system will have sudo with a "the user created at install time can run
everything as root through sudo" configuration, which essentially is the
same thing.

-- 
     w@uter.{be,co.za}
wouter@{grep.be,fosdem.org,debian.org}

[toc] | [prev] | [standalone]

Page 2 of 2 — ← Prev page 1 [2]

Back to top | Article view | linux.debian.devel

csiph-web