RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Bug 732756 - opencryptoki: don't add root to pkcs11 group
Summary: opencryptoki: don't add root to pkcs11 group
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: opencryptoki
Version: 6.1
Hardware: Unspecified
OS: Unspecified
medium
medium
Target Milestone: rc
: ---
Assignee: Dan Horák
QA Contact: BaseOS QE Security Team
URL:
Whiteboard:
Depends On: 730654
Blocks: 833818
TreeView+ depends on / blocked
 
Reported: 2011-08-23 13:58 UTC by Steve Grubb
Modified: 2012-06-20 12:23 UTC (History)
6 users (show)

Fixed In Version: opencryptoki-2.4-2.el6
Doc Type: Bug Fix
Doc Text:
Clone Of: 730654
: 833818 (view as bug list)
Environment:
Last Closed: 2011-12-06 11:48:54 UTC
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2011:1572 0 normal SHIPPED_LIVE opencryptoki bug fix and enhancement update 2011-12-06 00:39:04 UTC

Description Steve Grubb 2011-08-23 13:58:34 UTC
+++ This bug was initially created as a clone of Bug #730654 +++

Description of problem:
Upon installation of the opencryptoki packages, pkcs11 group is created and root user is added to the group:

http://pkgs.fedoraproject.org/gitweb/?p=opencryptoki.git;a=blob;f=opencryptoki.spec;h=ba9557de#l190

The purpose of this group is to restrict access to pkcsslotd's shared memory (which is root:pkcs11, 660).  root user should not need access to the group to be able to access the shared memory.  However, if root is removed from pkcs11, root can no longer use opencryptoki.

This is due to a bogus check in the attach_shared_memory(), that requires explicit group membership regardless of the current effective privileges:

http://opencryptoki.git.sourceforge.net/git/gitweb.cgi?p=opencryptoki/opencryptoki;a=blob;f=usr/lib/pkcs11/api/shrd_mem.c.in;h=42022c72#l354

Note that elsewhere in the code, similar check is only done when both uid and euid != 0:

http://opencryptoki.git.sourceforge.net/git/gitweb.cgi?p=opencryptoki/opencryptoki;a=blob;f=usr/lib/pkcs11/common/new_host.c;hb=7f52b1ac#l543

It's unclear to me what the benefit of the check should be, as shared memory permissions are still checked.

Steps to Reproduce:
It can be demonstrated that root does not need to be in the pkcs11.  Start root shell with privileges that do not include pkcs11 group.  Ensure that root belongs to the group in the /etc/group.

// check what we do not currently have pkcs11 group
# id
uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023

// but it is in the /etc/group
# id root
uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel),498(pkcs11)

// root can use opencryptoki
# pkcsconf -t
Token #1 Info:
        Label: IBM OS PKCS#11                  
        Manufacturer: IBM Corp.                       
        Model: IBM SoftTok     
 ...

// remove root from the group
# vigr

# id root
uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel)

// root can no longer use opencryptoki, even though effective permissions
// have not changed
# pkcsconf -t
Error initializing the PKCS11 library: 0x2 (CKR_HOST_MEMORY)


CCing Steve, as he's recently been after killing root supplementary groups, which can be a problem for programs what do not drop group privileges correctly.

--- Additional comment from sgrubb on 2011-08-15 11:18:39 EDT ---

Created attachment 518278 [details]
Patch attempting to fix the bug

This probably fixes the bug.

--- Additional comment from thoger on 2011-08-16 03:41:24 EDT ---

+ relevant spec file change.

Does it make sense to leave similar code in new_host.c mentioned in comment #0?

--- Additional comment from sgrubb on 2011-08-16 08:17:05 EDT ---

Those start off like this:
if ( userid != 0 && euserid != 0 ) { // Root or effective Root is ok

So, I think they are OK. Also note that bug 724007 is asking for supplemental groups to be dropped.

Comment 6 errata-xmlrpc 2011-12-06 11:48:54 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHBA-2011-1572.html


Note You need to log in before you can comment on or make changes to this bug.