Bug 542839
| Summary: | asterisk security issues - write to rootfs | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Wolfgang Rupprecht <wolfgang.rupprecht> |
| Component: | asterisk | Assignee: | Jeffrey C. Ollie <jeff> |
| Status: | CLOSED ERRATA | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
| Severity: | medium | Docs Contact: | |
| Priority: | low | ||
| Version: | 12 | CC: | itamar, jeff, michal |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | asterisk-1.6.1.10-1.fc12 | Doc Type: | Bug Fix |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2009-11-30 23:18:45 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
Wolfgang Rupprecht
2009-11-30 22:30:07 UTC
This is loosely related to Bug 541657 and the discussion of /.asterisk_history I think that this should already be fixed by asterisk-1.6.1.10-1.fc12, which is in updates-testing. I just requested that asterisk-1.6.1.10-1.fc12 be pushed to updates because there's a new security release (asterisk-1.6.1.11-1.fc12). Basically this is happening because if Asterisk is started up when the current directory is a directory that the Asterisk user cannot access, it changes it's working directory to '/'. I worked around it by adding an explicit 'cd /var/spool/asterisk' to the init script. Digium should probably be notified of this issue and a better fix for this implemented. Also, I see that /.asterisk_history is owned by root. Are you manually running Asterisk as root? The Asterisk packages are set up to run Asterisk as a special Asterisk user to minimize the consequences of any bugs. I'm starting asterisk in the default way via the startup scripts. Restarts are always via "service astersisk restart". The one time asterisk is invoked as root is when I'm trying to connect up to the running daemon and getting an asterisk shell via 'asterisk -rn'. I can't really su to asterisk because the shell is marked as "nologin". I'm not sure what the lesser of the evils are. Maybe asterisk should have a real shell? I guess I'm not sure what types of exploits that opens up. Ah, so it's probably the 'asterisk -rn' process that is writing the .asterisk_history file. I'm not sure what to do about that other than to file a bug upstream and see if they can provide a fix. From the modtime it looks like it may actually have been an invocation of "asterisk -rx 'database put cidname $key \"$myclid\"'" that occurred out of a homegrown script that is run from the daily cron run as user root. Maybe I can avoid the issue by cd-ing to a more reasonable directory in my script. Yes, cd'ing to a different directory is the easiest workaround. It appears to me that /usr/sbin/asterisk -rx 'logger reload' from /etc/logrotate.d/asterisk writes to /.asterisk_history. Would setting of HOME here to, say, /usr/share/asterisk help or it writes to cwd? I am not sure what to do with 'asterisk -r' which writes to /root/.asterisk_history. SELinux is not very happy. Re: comment #2 > I think that this should already be fixed by asterisk-1.6.1.10-1.fc12 ... Well, I have here asterisk-1.6.1.11-1.fc12 and it is not fixed. I added in /etc/logrotate.d/asterisk "HOME=/var/lib/asterisk " before /usr/sbin/asterisk... and with that this writes /var/lib/asterisk/.asterisk_history but selinux is still unhappy(cf. bug 541657). I guess that changing that to "HOME=/var/tmp " would help. There is not much in that history file from logrotate anyway. |