Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.security > #5490

Re: Which one is better solution?

Show all headers | View raw

[Multipart message — attachments visible in raw view] - view raw

As far as I know, pkexec doesn't validate arguments, so it might not be
ideal if you are worried about people trying to trick it.

On Sat, Dec 15, 2018 at 6:15 AM JungHwan Kang <ultractgm@gmail.com> wrote:

> Sometimes, I use a sudo command with -s options for keeping
> environment variables for users account(sudoer). I also know -s option
> runs the shell specified by the SHELL environment variable. But the
> SHELL environment variable can be manipulated by other users having
> the same privilege.
>
> So, I think an adversary is able to abuse the changing SHELL
> environment variable for privilege escalation like a video below. (I
> assume the adversary owned the permission for executing a shell on a
> remote)
>
> https://youtu.be/JSQjIm7377o (unlisted state)
>
> I know it is uncertain when the sudo is executed with -s option by sudoer.
>
> Anyway, I have thought of the solutions to the issue below.
>  - using a pkexec of a Policy kit,
>  - disable a ptrace function via kernel.yama.ptrace_scope, CAP_SYS_PTRACE.
>
> Could you give some advice and comments?
>
> Thx.
>
>

Back to linux.debian.security | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Which one is better solution? JungHwan Kang <ultractgm@gmail.com> - 2018-12-15 12:20 +0100
  Re: Which one is better solution? Shea Alterio <krusete@gmail.com> - 2018-12-15 12:30 +0100
    Re: Which one is better solution? Ruslanas Gžibovskis <ruslanas@lpic.lt> - 2018-12-15 17:30 +0100
      Re: Which one is better solution? Cindy-Sue Causey <butterflybytes@gmail.com> - 2018-12-15 22:30 +0100
      Re: Which one is better solution? Elmar Stellnberger <estellnb@gmail.com> - 2018-12-16 09:00 +0100
        u+S  WAS: Which one is better solution? Geert Stappers <stappers@stappers.nl> - 2018-12-16 10:20 +0100

csiph-web