Bug 1075787

Summary: gnustep-base: gdomap chroot's to /tmp for 'extra security'
Product: [Other] Security Response Reporter: Vincent Danen <vdanen>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED WONTFIX QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: jochen
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2015-08-22 06:55:18 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1075791, 1075792    
Bug Blocks:    

Description Vincent Danen 2014-03-12 20:02:00 UTC 
A Debian bug report [1] noted that gdomap daemon used by GNUstep chroots itself to /tmp for "another level of paranoia", however it is chrooting to a directory that is writable and readable by every other user on the system.  It should be chrooting to an empty directory (like /var/empty) where nothing can influence the environment or be overritten by the daemon itself.

In Tools/gdomap.c:

4974 #if     !defined(__svr4__)
4975   /*
4976    * As another level of paranoia - restrict this process to /tmp
4977    */
4978 #ifndef __MINGW__
4979   if (chdir("/tmp") < 0)
4980     {
4981       snprintf(ebuf, sizeof(ebuf), "Unable to change directory to /tmp");
4982       gdomap_log(LOG_CRIT);
4983       exit(EXIT_FAILURE);
4984     }
4985
4986   if (geteuid() == 0)
4987     {
4988       if (chroot("/tmp") < 0)
4989         {
4990           snprintf(ebuf, sizeof(ebuf), "Unable to change root to /tmp");
4991           gdomap_log(LOG_CRIT);
4992           exit(EXIT_FAILURE);
4993         }
4994       chdir("/");
4995     }
4996 #endif /* __MINGW__ */
4997 #endif /* __svr4__ */

[1] https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=741441
Comment 1 Vincent Danen 2014-03-12 20:11:50 UTC 
Created gnustep-base tracking bugs for this issue:

Affects: fedora-all [bug 1075791]
Affects: epel-6 [bug 1075792]