Bug 1092738

Summary:	local roots able to access any IPA-managed user accounts (even disabled ones)
Product:	Red Hat Enterprise Linux 6	Reporter:	Swartz <netvent>
Component:	ipa	Assignee:	Martin Kosek <mkosek>
Status:	CLOSED NOTABUG	QA Contact:	Namita Soman <nsoman>
Severity:	high	Docs Contact:
Priority:	unspecified
Version:	6.5	CC:	rcritten, ssorce
Target Milestone:	rc
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2014-04-30 03:12:28 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Swartz 2014-04-29 21:05:47 UTC

Description of problem:
Local root (on any enrolled IPA-client machines) can become (su) any IPA-user thereby bypassing any security policy rules.

Version-Release number of selected component (if applicable):
IPA 3.0

How reproducible:
Very

Steps to Reproduce:
1. Setup IPA server, enroll an IPA-client machine (PC1)
2. Create a regular user account (bob) on IPA server.
3. Create HBAC policies that prevents bob accessing PC1.
4. Become local root on PC1
5. su bob

Actual results:
Local root on PC1 becomes bob. In fact, local root can become any IPA-managed user even a disabled user.

Expected results:
Local roots should NOT be able to become any user they feel like for accounts that are centrally managed by IPA-server.

Additional info:
The need to grant local root privileges on a machine is a fairly common scenario. This should not compromise the remainder of IPA-managed hosts and accounts.

For example, ActiveDirectory specifically prevents local admins from becoming any domain user they might like. For that they need to be a domain admin. NFS has root_squash to counter a similar scenario where root on one box should not have full access permissions on another exported filesystem. 

This comes down to this: one compromised IPA-client machine could lead to all IPA-managed accounts and hosts becoming vulnerable.

Comment 2 Simo Sorce 2014-04-30 03:12:28 UTC

Hi Swartz,
the root account on any linux machine is all powerful and can do anything it wants, it can even create local users and impersonate them w/o issue.

I suggest you take the time to understand what is the security model on Linux and what the root account can do (anything, including modifying the running kernel).

In any case a compromised machine cannot really do anything more, in a IPA environment, than what it can do in any other environment.

Unless the compromised machine steals actually active credentials it cannot influence other machines unless you are using insecure services that implictly trust any client.

In the NFS case for example root-squash is really not something you can trust any security upon, if you are concerned about access to NFS services you need to run NFS with sec=krb5, where each user access is authenticated via kerberos credentials.

If you are interested in a way to confine what users (including root) can do I suggest you read up on SELinux and capabilities and how to confine users of all kinds.

I am going to close this as NOTABUG, because there is nothing unaccounted for in what you are describing in the report, this is all known stuff.