Bug 2181477
| Summary: | Rules to enable dracut execution are too loose | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 8 | Reporter: | Renaud Métrich <rmetrich> |
| Component: | fapolicyd | Assignee: | Radovan Sroka <rsroka> |
| Status: | CLOSED MIGRATED | QA Contact: | BaseOS QE Security Team <qe-baseos-security> |
| Severity: | low | Docs Contact: | |
| Priority: | low | ||
| Version: | 8.7 | CC: | qguo |
| Target Milestone: | rc | Keywords: | MigratedToJIRA, Triaged |
| Target Release: | --- | Flags: | pm-rhel:
mirror+
|
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2023-08-16 14:58:33 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
This is somehow expected. We allowed root because we had lot of issues with execution of the files during system upgrade and other scenarios like dracut. Moreover root can kill fapolicyd anytime so it's hard to fight against. This bug is going to be migrated. Contact point for migration questions or issues: rsroka Guidance for Bugzilla users to test their Jira account or create one if needed: https://redhat.service-now.com/help?id=kb_article_view&sysparm_article=KB0016394 https://redhat.service-now.com/help?id=kb_article_view&sysparm_article=KB0016694 https://redhat.service-now.com/help?id=kb_article_view&sysparm_article=KB0016774 |
Description of problem: IMHO the rules added to enable dracut execution are too loose (/etc/fapolicyd/rules.d/20-dracut.rules): -------- 8< ---------------- 8< ---------------- 8< ---------------- 8< -------- allow perm=any uid=0 : dir=/var/tmp/ allow perm=any uid=0 trust=1 : all -------- 8< ---------------- 8< ---------------- 8< ---------------- 8< -------- I think there are 2 issues: 1. the "allow perm=any uid=0 : dir=/var/tmp/" rule is not needed at all, dracut executes fine (at least with default command "dracut -f") with just second rule -------- 8< ---------------- 8< ---------------- 8< ---------------- 8< -------- # cat /etc/fapolicyd/rules.d/20-dracut.rules # Carve out an exception for dracut's initramfs building #allow perm=any uid=0 : dir=/var/tmp/ allow perm=any uid=0 trust=1 : all # systemctl restart fapolicyd # dracut /tmp/initrd.img $(uname -r) -------- 8< ---------------- 8< ---------------- 8< ---------------- 8< -------- 2. the "allow perm=any uid=0 trust=1 : all" rule allows root user to execute any crafted program -------- 8< ---------------- 8< ---------------- 8< ---------------- 8< -------- # cat > hello.c << EOF #include <stdio.h> int main(int argc, char *argv[]) { printf("Hello!\n"); return 0; } EOF # gcc -o hello hello.c # ./hello Hello! -------- 8< ---------------- 8< ---------------- 8< ---------------- 8< -------- I think if there is no other choice but this second rule, then a comment in the rules file should clearly mention that this opens the world for root user a lot more than just dracut. Version-Release number of selected component (if applicable): fapolicyd-1.1.3-8.el8_7.1.x86_64 How reproducible: Always, see above.