Login
[x]
Log in using an account from:
Fedora Account System
Red Hat Associate
Red Hat Customer
Or login using a Red Hat Bugzilla account
Forgot Password
Login:
Hide Forgot
Create an Account
Red Hat Bugzilla – Attachment 606084 Details for
Bug 847402
CVE-2012-3524 dbus: privilege escalation when libdbus is used in setuid/setgid application
[?]
New
Simple Search
Advanced Search
My Links
Browse
Requests
Reports
Current State
Search
Tabular reports
Graphical reports
Duplicates
Other Reports
User Changes
Plotly Reports
Bug Status
Bug Severity
Non-Defaults
|
Product Dashboard
Help
Page Help!
Bug Writing Guidelines
What's new
Browser Support Policy
5.0.4.rh83 Release notes
FAQ
Guides index
User guide
Web Services
Contact
Legal
This site requires JavaScript to be enabled to function correctly, please enable it.
[patch]
updated glib patch
0001-Don-t-access-environment-variables-or-run-dbus-launc.patch (text/plain), 7.68 KB, created by
Colin Walters
on 2012-08-22 00:49:18 UTC
(
hide
)
Description:
updated glib patch
Filename:
MIME Type:
Creator:
Colin Walters
Created:
2012-08-22 00:49:18 UTC
Size:
7.68 KB
patch
obsolete
>From 8b576ab9c3827e285a17ee9fdbcc19b1f7bbf63a Mon Sep 17 00:00:00 2001 >From: Colin Walters <walters@verbum.org> >Date: Tue, 21 Aug 2012 18:00:56 -0400 >Subject: [PATCH] Don't access environment variables or run dbus-launch when > setuid > >Some programs attempt to use libglib (or even libgio) when setuid. >For a long time, GTK+ simply aborted if launched in this >configuration, but we never had a real policy for GLib. > >I'm not sure whether we should advertise such support. However, given >that there are real-world programs that do this currently, we can make >them safer with not too much effort. > >Better to fix a problem caused by an interaction between two >components in *both* places if possible. > >How to determine whether or not we're running in a privilege-escalated >path is operating system specific. Note that GTK+'s code to check >euid versus uid worked historically on Unix, more modern systems have >filesystem capabilities and SELinux domain transitions, neither of >which are captured by the uid comparison. > >On Linux/glibc, the way this works is that the kernel sets an >AT_SECURE flag in the ELF auxiliary vector, and glibc looks for it on >startup. If found, then glibc sets a public-but-undocumented >__libc_enable_secure variable which we can use. Unfortunately, while >it *previously* worked to check this variable, a combination of newer >binutils and RPM break it: >http://www.openwall.com/lists/owl-dev/2012/08/14/1 > >So for now on Linux/glibc, we fall back to the historical Unix version >until we get glibc fixed. > >On some BSD variants, there is a issetugid() function. On other Unix >variants, we fall back to what GTK+ has been doing. >--- > configure.ac | 15 ++++++++++++-- > gio/gdbusaddress.c | 5 +++++ > glib/genviron.c | 7 +++++++ > glib/glib-private.c | 4 +++- > glib/glib-private.h | 4 ++++ > glib/gutils.c | 59 +++++++++++++++++++++++++++++++++++++++++++++++++++++ > 6 files changed, 91 insertions(+), 3 deletions(-) > >diff --git a/configure.ac b/configure.ac >index 9e9d714..738d983 100644 >--- a/configure.ac >+++ b/configure.ac >@@ -586,9 +586,20 @@ AC_TRY_COMPILE([#include <dirent.h>], [DIR *dir;], > # Checks for library functions. > AC_FUNC_VPRINTF > AC_FUNC_ALLOCA >-AC_CHECK_FUNCS(mmap posix_memalign memalign valloc fsync pipe2) >+AC_CHECK_FUNCS(mmap posix_memalign memalign valloc fsync pipe2 issetugid) > AC_CHECK_FUNCS(atexit on_exit timegm gmtime_r) > >+AC_CACHE_CHECK([for __libc_enable_secure], glib_cv_have_libc_enable_secure, >+ [AC_TRY_LINK([#include <unistd.h> >+ extern int __libc_enable_secure;], >+ [return __libc_enable_secure;], >+ glib_cv_have_libc_enable_secure=yes, >+ glib_cv_have_libc_enable_secure=no)]) >+AS_IF([test x$glib_cv_have_libc_enable_secure = xyes], [ >+ AC_DEFINE(HAVE_LIBC_ENABLE_SECURE, 1, >+ [Define if you have the __libc_enable_secure variable (GNU libc, eglibc)]) >+]) >+ > AC_CHECK_SIZEOF(char) > AC_CHECK_SIZEOF(short) > AC_CHECK_SIZEOF(long) >@@ -985,7 +996,7 @@ AC_MSG_RESULT(unsigned $glib_size_type) > > # Check for some functions > AC_CHECK_FUNCS(lstat strerror strsignal memmove vsnprintf stpcpy strcasecmp strncasecmp poll getcwd vasprintf setenv unsetenv getc_unlocked readlink symlink fdwalk memmem) >-AC_CHECK_FUNCS(chown lchmod lchown fchmod fchown link utimes getgrgid getpwuid) >+AC_CHECK_FUNCS(chown lchmod lchown fchmod fchown link utimes getgrgid getpwuid getresuid) > AC_CHECK_FUNCS(getmntent_r setmntent endmntent hasmntopt getfsstat getvfsstat) > # Check for high-resolution sleep functions > AC_CHECK_FUNCS(splice) >diff --git a/gio/gdbusaddress.c b/gio/gdbusaddress.c >index fac22b7..bddc71d 100644 >--- a/gio/gdbusaddress.c >+++ b/gio/gdbusaddress.c >@@ -37,6 +37,7 @@ > #include "giostream.h" > #include "gasyncresult.h" > #include "gsimpleasyncresult.h" >+#include "glib-private.h" > #include "gdbusprivate.h" > #include "giomodule-priv.h" > #include "gdbusdaemon.h" >@@ -1014,6 +1015,10 @@ get_session_address_dbus_launch (GError **error) > gchar *old_dbus_verbose; > gboolean restore_dbus_verbose; > >+ /* Don't run binaries as root if we're setuid. */ >+ if (GLIB_PRIVATE_CALL (g_check_setuid) ()) >+ return NULL; >+ > ret = NULL; > machine_id = NULL; > command_line = NULL; >diff --git a/glib/genviron.c b/glib/genviron.c >index aed4b63..da66ef5 100644 >--- a/glib/genviron.c >+++ b/glib/genviron.c >@@ -40,6 +40,7 @@ > #include <windows.h> > #endif > >+#include "glib-private.h" > #include "gmem.h" > #include "gmessages.h" > #include "gstrfuncs.h" >@@ -252,6 +253,12 @@ g_getenv (const gchar *variable) > { > g_return_val_if_fail (variable != NULL, NULL); > >+ /* Don't access any environment variables when we're running as a >+ * privileged process. >+ */ >+ if (GLIB_PRIVATE_CALL (g_check_setuid) ()) >+ return NULL; >+ > return getenv (variable); > } > >diff --git a/glib/glib-private.c b/glib/glib-private.c >index 3946e77..3506782 100644 >--- a/glib/glib-private.c >+++ b/glib/glib-private.c >@@ -38,7 +38,9 @@ glib__private__ (void) > g_wakeup_signal, > g_wakeup_acknowledge, > >- g_get_worker_context >+ g_get_worker_context, >+ >+ g_check_setuid > }; > > return &table; >diff --git a/glib/glib-private.h b/glib/glib-private.h >index fde0be8..87da6f3 100644 >--- a/glib/glib-private.h >+++ b/glib/glib-private.h >@@ -25,6 +25,8 @@ > > G_GNUC_INTERNAL > GMainContext * g_get_worker_context (void); >+G_GNUC_INTERNAL >+gboolean g_check_setuid (void); > > #define GLIB_PRIVATE_CALL(symbol) (glib__private__()->symbol) > >@@ -40,6 +42,8 @@ typedef struct { > /* See gmain.c */ > GMainContext * (* g_get_worker_context) (void); > /* Add other private functions here, initialize them in glib-private.c */ >+ >+ gboolean (* g_check_setuid) (void); > } GLibPrivateVTable; > > GLibPrivateVTable *glib__private__ (void); >diff --git a/glib/gutils.c b/glib/gutils.c >index 38b5e44..25d3db0 100644 >--- a/glib/gutils.c >+++ b/glib/gutils.c >@@ -60,6 +60,7 @@ > #include "gutils.h" > > #include "glib-init.h" >+#include "glib-private.h" > #include "genviron.h" > #include "gfileutils.h" > #include "ggettext.h" >@@ -2409,3 +2410,61 @@ g_get_tmp_dir (void) > } > > #endif >+ >+/* Private API: >+ * >+ * Returns %TRUE if the current process was executed as setuid (or an >+ * equivalent __libc_enable_secure is available). See: >+ * http://osdir.com/ml/linux.lfs.hardened/2007-04/msg00032.html >+ */ >+gboolean >+g_check_setuid (void) >+{ >+ /* TODO: get __libc_enable_secure exported from glibc. >+ * See http://www.openwall.com/lists/owl-dev/2012/08/14/1 >+ */ >+#if 0 && defined(HAVE_LIBC_ENABLE_SECURE) >+ { >+ /* See glibc/include/unistd.h */ >+ extern int __libc_enable_secure; >+ return __libc_enable_secure; >+ } >+#elif defined(HAVE_ISSETUGID) >+ /* BSD: http://www.freebsd.org/cgi/man.cgi?query=issetugid&sektion=2 */ >+ return issetugid (); >+#elif defined(G_OS_UNIX) >+ uid_t ruid, euid, suid; /* Real, effective and saved user ID's */ >+ gid_t rgid, egid, sgid; /* Real, effective and saved group ID's */ >+ >+ static gsize check_setuid_initialised; >+ static gboolean is_setuid; >+ >+ if (g_once_init_enter (&check_setuid_initialised)) >+ { >+#ifdef HAVE_GETRESUID >+ /* These aren't in the header files, so we prototype them here. >+ */ >+ int getresuid(uid_t *ruid, uid_t *euid, uid_t *suid); >+ int getresgid(gid_t *rgid, gid_t *egid, gid_t *sgid); >+ >+ if (getresuid (&ruid, &euid, &suid) != 0 || >+ getresgid (&rgid, &egid, &sgid) != 0) >+#endif /* HAVE_GETRESUID */ >+ { >+ suid = ruid = getuid (); >+ sgid = rgid = getgid (); >+ euid = geteuid (); >+ egid = getegid (); >+ } >+ >+ is_setuid = (ruid != euid || ruid != suid || >+ rgid != egid || rgid != sgid); >+ >+ g_once_init_leave (&check_setuid_initialised, 1); >+ } >+ return is_setuid; >+#else >+ return FALSE; >+#endif >+} >+ >-- >1.7.11.4 >
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
Attachments on
bug 847402
:
606063
|
606064
|
606084
|
606355
|
606392