Bug 229372 - usernetctl preserves original gid and egid
Summary: usernetctl preserves original gid and egid
Alias: None
Product: Fedora
Classification: Fedora
Component: initscripts
Version: 6
Hardware: All
OS: Linux
Target Milestone: ---
Assignee: Bill Nottingham
QA Contact: Brock Organ
Depends On:
TreeView+ depends on / blocked
Reported: 2007-02-20 17:50 UTC by Miloslav Trmač
Modified: 2014-03-17 03:05 UTC (History)
1 user (show)

Fixed In Version: 8.53-1
Doc Type: Bug Fix
Doc Text:
Clone Of:
Last Closed: 2007-04-19 19:56:16 UTC
Type: ---

Attachments (Terms of Use)

Description Miloslav Trmač 2007-02-20 17:50:01 UTC
usernetctl currently does nothing with the gid and egid of the invoking user, so
/sbin/ifup and all further processes are executed with gid of the invoking user.
 This seems to be potentially insecure (e.g. creating files readable and
writable by the invoking user);  currently this causes a SELinux denial in the
following situation:

Steps to Reproduce:
1.eth0 has USERNETCTL=yes, BOOTPROTO=dhcp
2.user runs /sbin/ifup eth0
3.this eventually runs /sbin/dhclient-script, with egid=$user euid=0
  gid=$user uid=0
4.this eventually runs (cp -fp /etc/resolv.conf /etc/resolv.conf.predhclient)
5.cp creates /etc/resolv.conf.predhclient, which is now owned by root:$user
6.cp attempts to fchown()s /etc/resolv.conf.predhclient to root:root, which is
  prohibited by SELinux

Version-Release number of selected component (if applicable):

Comment 1 Bill Nottingham 2007-04-19 19:56:16 UTC
Fixed, will be in 8.53-1.

Note You need to log in before you can comment on or make changes to this bug.