Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1567041

RE: [PATCH 2/2] fs: Harden against open(..., O_CREAT, 02777) in a setgid directory

Show all headers | View raw

> Currently, if you open("foo", O_WRONLY | O_CREAT | ..., 02777) in a
> directory that is setgid and owned by a different gid than current's
fsgid, you
> end up with an SGID executable that is owned by the directory's GID.  This
is
> a Bad Thing (tm).  Exploiting this is nontrivial because most ways of
creating a
> new file create an empty file and empty executables aren't particularly
> interesting, but this is nevertheless quite dangerous.
> 
> Harden against this type of attack by detecting this particular corner
case
> (unprivileged program creates SGID executable inode in SGID directory
> owned by a different GID) and clearing the new inode's SGID bit.

Nasty.

I'd love to see a test for this in xfstests and/or pjdfstests...

Frank


---
This email has been checked for viruses by Avast antivirus software.
https://www.avast.com/antivirus

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH 2/2] fs: Harden against open(..., O_CREAT, 02777) in a setgid directory Andy Lutomirski <luto@kernel.org> - 2017-01-25 22:10 +0100
  Re: [PATCH 2/2] fs: Harden against open(..., O_CREAT, 02777) in a  setgid directory Ben Hutchings <ben@decadent.org.uk> - 2017-01-25 22:40 +0100
    Re: [PATCH 2/2] fs: Harden against open(..., O_CREAT, 02777) in a  setgid directory Andy Lutomirski <luto@amacapital.net> - 2017-01-25 22:50 +0100
  RE: [PATCH 2/2] fs: Harden against open(..., O_CREAT, 02777) in a setgid directory "Frank Filz" <ffilzlnx@mindspring.com> - 2017-01-26 00:30 +0100
  Re: [PATCH 2/2] fs: Harden against open(..., O_CREAT, 02777) in a  setgid directory Willy Tarreau <w@1wt.eu> - 2017-01-26 01:00 +0100

csiph-web