Bug 1388034 - Bash/DNF Security Bypass
Summary: Bash/DNF Security Bypass
Keywords:
Status: CLOSED NOTABUG
Alias: None
Product: Fedora
Classification: Fedora
Component: PackageKit
Version: 23
Hardware: x86_64
OS: Linux
unspecified
high
Target Milestone: ---
Assignee: Richard Hughes
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2016-10-24 09:36 UTC by customercare
Modified: 2016-10-24 10:00 UTC (History)
8 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2016-10-24 10:00:00 UTC
Type: Bug


Attachments (Terms of Use)

Description customercare 2016-10-24 09:36:19 UTC
Description of problem:

it's possible to bypass the security around dnf, by entering known commands into bash, to let the package get installed, even if root would not allow it.

This should not be possible.


Version-Release number of selected component (if applicable):

bash-4.3.42-5.fc23.x86_64
bash-completion-2.1-8.20150513git1950590.fc23.noarch
dnf-1.1.10-1.fc23.noarch
dnf-conf-1.1.10-1.fc23.noarch
dnfdaemon-0.3.16-1.fc23.noarch
dnf-plugin-system-upgrade-0.7.1-1.fc23.noarch
dnf-yum-1.1.10-1.fc23.noarch
python2-dnf-1.1.10-1.fc23.noarch
python2-dnf-plugin-system-upgrade-0.7.1-1.fc23.noarch
python3-dnf-1.1.10-1.fc23.noarch
python3-dnfdaemon-0.3.16-1.fc23.noarch
python3-dnf-plugin-system-upgrade-0.7.1-1.fc23.noarch
yumex-dnf-4.1.6-1.fc23.noarch


How reproducible:


Sorry, systemoutput is in german, but you should catch the important part,
that the installtion is done without a password, but the erase is denied due to lack of root privileges.

[marius@eve ~]$ elinks  "https://www.stadehandball.de/?action=results&tabtype=0&file=ol-16-17.l98&st=8" 
bash: elinks: Befehl nicht gefunden...
Soll das Paket »elinks« installiert werden, welches den Befehl »elinks« bereitstellt? [N/y] y


 * Warten in Warteschlange... 
Die folgenden Pakete müssen installiert werden:
 elinks-0.12-0.47.pre6.fc23.x86_64	A text-mode Web browser
Mit Änderungen fortfahren? [N/y] y


 * Warten in Warteschlange... 
 * Warten auf Legitimation... 
 * Warten in Warteschlange... 
 * Pakete werden heruntergeladen... 
 * Daten werden abgefragt... 
 * Änderungen werden getestet... 
 * Pakete werden installiert... (packages get installed )
 
[marius@eve ~]$ dnf erase elinks
Abhängigkeiten sind aufgelöst.
================================================================================================================================================================================================================================================================================
 Package                                                       Arch                                                          Version                                                                       Paketquelle                                                    Größe
================================================================================================================================================================================================================================================================================
Entfernen:
 elinks                                                        x86_64                                                        0.12-0.47.pre6.fc23                                                           @fedora                                                        2.9 M

Transaktionsübersicht
================================================================================================================================================================================================================================================================================
Entfernen  1 Paket

Installationsgröße: 2.9 M
Ist dies in Ordnung? [j/N]: j
Transaktionsüberprüfung wird ausgeführt
Transaktionsprüfung war erfolgreich.
Transaktion wird getestet
Transaktionstest war erfolgreich.
Transaktion wird ausgeführt
Transaktionssperre kann nicht erhalten werden (angemeldet als: marius).
Fehler: Transaktion konnte nicht durchgeführt werden.
[marius@eve ~]$ 


Actual results:

root password is not asked to install a package

Expected results:

root password is asked OR the entire request context is skipped, because the user does not have admin rights.

Additional info:

The user "marius" is the "default" user to open the desktop session with, which means hes autologgedin.

Comment 1 customercare 2016-10-24 09:40:04 UTC
wasn't there "private" flag once, to set bugs as security sensitive?

Comment 2 Ville Skyttä 2016-10-24 09:47:02 UTC
I don't think this has anything to do with bash-completion, and I believe the command not found -> install bash hook is actually implemented in PackageKit, not dnf. Reassigning for comments if the described functionality is intentional (please re-reassign to something else if PK is not the correct component).

Comment 3 Rex Dieter 2016-10-24 10:00:00 UTC
It is by design for 'admin' users (members of wheel group), see:

https://fedoraproject.org/wiki/Privilege_escalation_policy

In particular,

"Add, remove, or downgrade any system-wide application or shared resource (packaged or otherwise), with the exception that for installing Fedora-signed packages from administrator-configured repositories, the requirement to ask for a password is waived for members of the wheel group who are local and active."


Note You need to log in before you can comment on or make changes to this bug.