Bug 2241240
| Summary: | Allow update-ca-trust to be run by unprivileged user | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | rptaylor |
| Component: | ca-certificates | Assignee: | Bob Relyea <rrelyea> |
| Status: | CLOSED ERRATA | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
| Severity: | medium | Docs Contact: | |
| Priority: | low | ||
| Version: | 38 | CC: | asosedki, cllang, crypto-team, fkrenzel, jorton, paul.wouters, rrelyea, tm |
| Target Milestone: | --- | Keywords: | Triaged |
| Target Release: | --- | Flags: | fedora-admin-xmlrpc:
mirror+
|
| Hardware: | x86_64 | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | ca-certificates-2023.2.62_v7.0.401-3.fc40 | Doc Type: | If docs needed, set a value |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2023-10-07 17:31:10 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
rptaylor
2023-09-28 19:33:53 UTC
Until it doesn't, here's a thing that works for me
$ mkdir -p rw-dir/{edk2,java,openssl,pem}
$ unshare -rm sh -c 'mount --bind rw-dir /etc/pki/ca-trust/extracted && update-ca-trust'
p11-kit trust makes the directory unwritable after updating its contents: https://github.com/p11-glue/p11-kit/blob/master/trust/save.c#L362-L385 https://github.com/p11-glue/p11-kit/blob/master/trust/save.c#L627-L634 So the issue here is in the update-ca-trust script. This was a fun exercise, PR at https://src.fedoraproject.org/rpms/ca-certificates/pull-request/8. Bob, would you mind reviewing? So here's the deal, in general we don't want someone to run update-ca-trust as a non-privelleged user. Running this changes the trusted roots for everyone on the system. So the fundamental ask is flawed, we won't just be making update-ca-trust work for anyone. That being said. Clemen's patch is a generally good idea for solving this (with some tweaks). It doesn't actually meant what the bug says, but it does provide a way for the user to get what they want in the container. To be clear: Expected Results: $ update-ca-trust # unprivileged $ echo $? 0 is never going to happen anymore then Expected Results: $ su #unprivileged, no password # whoami # root is never going to happen. Fear not, I am fully aware of the security implications of running update-ca-trust on a conventional Linux system and am not suggesting unprivileged users should be able to normally run it in that context. However, the code does not exist solely in the context of a conventional Linux system. IMHO update-ca-trust should just be a tool to read and write cert files, and it is the responsibility of the operating environment to enforce appropriate security policies e.g. via ownership and permissions of system directories. I am very grateful to see the --output option being discussed and implemented <3 and I think this illustrates a clearer delineation of the relevant security considerations than my "hack" of sudo chown fedora: /etc/pki/ca-trust/extracted/ Thank you for supporting container-native solutions! Yeah, My comment is more of an expectation. As originally written, the expected results is clearly not what we want. Adding a feature to update-ca-trust which lets it run on an arbitrary directory (and thus carry the existing protections from the filesystem). FEDORA-2023-0f2f12457f has been submitted as an update to Fedora 40. https://bodhi.fedoraproject.org/updates/FEDORA-2023-0f2f12457f FEDORA-2023-271dd7d5f4 has been submitted as an update to Fedora 40. https://bodhi.fedoraproject.org/updates/FEDORA-2023-271dd7d5f4 FEDORA-2023-271dd7d5f4 has been pushed to the Fedora 40 stable repository. If problem still persists, please make note of it in this bug report. |