Bug 635412 - unsafe chroot() calls in mingetty
Summary: unsafe chroot() calls in mingetty
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: mingetty
Version: rawhide
Hardware: All
OS: Linux
low
medium
Target Milestone: ---
Assignee: Petr Pisar
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2010-09-19 15:25 UTC by Vincent Danen
Modified: 2010-11-08 14:01 UTC (History)
2 users (show)

Fixed In Version: mingetty-1.08-5.fc14
Clone Of:
: 640933 (view as bug list)
Environment:
Last Closed: 2010-10-30 23:44:35 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)

Description Vincent Danen 2010-09-19 15:25:00 UTC
Noticed a Debian bug report [1] that indicates that the way mingetty calls chroot() makes it fairly trivial to break out of it.  They also note that the chroot(), chdir(), and nice() calls do no error checking.  A patch is attached to the bug report.

I've looked, and nowhere in Fedora (or RHEL) can I see us using any of these options (--chroot, --chdir, or --nice); we just call mingetty with the TTY to listen to and no further options.  So this isn't something we likely need to worry about fixing in older releases for two reasons: 1) it's not used by default and 2) it would be a low impact local-only issue.

It would, however, be a bug that should be fixed for future versions of Fedora.

[1] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=597382

Comment 1 Fedora Update System 2010-10-26 16:45:18 UTC
mingetty-1.08-5.fc14 has been submitted as an update for Fedora 14.
https://admin.fedoraproject.org/updates/mingetty-1.08-5.fc14

Comment 2 Fedora Update System 2010-10-26 16:46:00 UTC
mingetty-1.08-5.fc13 has been submitted as an update for Fedora 13.
https://admin.fedoraproject.org/updates/mingetty-1.08-5.fc13

Comment 3 Fedora Update System 2010-10-26 16:46:20 UTC
mingetty-1.08-5.fc12 has been submitted as an update for Fedora 12.
https://admin.fedoraproject.org/updates/mingetty-1.08-5.fc12

Comment 4 Fedora Update System 2010-10-27 22:29:29 UTC
mingetty-1.08-5.fc12 has been pushed to the Fedora 12 testing repository.  If problems still persist, please make note of it in this bug report.
 If you want to test the update, you can install it with 
 su -c 'yum --enablerepo=updates-testing update mingetty'.  You can provide feedback for this update here: https://admin.fedoraproject.org/updates/mingetty-1.08-5.fc12

Comment 5 Fedora Update System 2010-10-30 23:44:25 UTC
mingetty-1.08-5.fc12 has been pushed to the Fedora 12 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 6 Fedora Update System 2010-11-01 20:59:32 UTC
mingetty-1.08-5.fc13 has been pushed to the Fedora 13 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 7 Fedora Update System 2010-11-04 23:31:38 UTC
mingetty-1.08-5.fc14 has been pushed to the Fedora 14 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 8 Bernie Innocenti 2010-11-08 13:54:09 UTC
Fixing a few unintentional changes in the ticket metadata.


Note You need to log in before you can comment on or make changes to this bug.