Red Hat Bugzilla – Bug 903303
haproxy: Fails to properly drop supplementary groups after setuid / setgid calls
Last modified: 2013-11-21 06:27:04 EST
+++ This bug was initially created as a clone of Bug #903293 +++ Description of problem: As noted in bug #894626 and in: [1] http://www.openwall.com/lists/oss-security/2013/01/23/7 haproxy previously failed to drop supplementary groups properly when trying to drop root privileges. By itself this problem is not a security flaw, but still serious enough the upstream fix: [2] git.1wt.eu/web?p=haproxy.git;a=commitdiff;h=ab012dd3 to be backported into all of the affected versions. Version-Release number of selected component (if applicable): haproxy-1.4.22-1.el6 How reproducible: Always Steps to Reproduce: 1. See https://bugzilla.redhat.com/show_bug.cgi?id=894626#c0 for further reproducer details Actual results: Supplementary groups are not dropped properly after setuid / setgid calls. Expected results: (All) Supplementary groups should be dropped when dropping root privileges.
This will not be fixed in EPEL6 since haproxy will be TP in RHEL6.4.
Since haproxy will be retired in EPEL when it goes TP in RHEL6.4, I'm moving this to RHEL6.5.
Upstream version 1.4.24 contains the fix for this, so this is resolved in RHEL6.5 as part of the rebase (rhbz#947987).
I have verified that the privileges are properly dropped for haproxy-1.4.24-2.el6.x86_64: BEFORE THE PATCH: ================= # rpm -q haproxy haproxy-1.4.22-3.el6.x86_64 # service haproxy start Starting haproxy: [ OK ] # ps axf -o pid,user,group,command | grep hapr 4661 root root \_ grep hapr 4602 haproxy haproxy /usr/sbin/haproxy -D -f /etc/haproxy/haproxy.cfg -p /var/run/haproxy.pid # grep Group /proc/4602/status Groups: 0 AFTER THE PATCH: ================ # rpm -q haproxy haproxy-1.4.24-2.el6.x86_64 # service haproxy start Starting haproxy: [ OK ] # ps a -o pid,user,group,command | grep haproxy 1196 root root grep hapr 31712 haproxy haproxy haproxy -f /etc/haproxy/haproxy.cfg -d -V # grep Group /proc/31712/status Groups:
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. http://rhn.redhat.com/errata/RHBA-2013-1619.html