Bug 903306 - haproxy: Fails to properly drop supplementary groups after setuid / setgid calls
Summary: haproxy: Fails to properly drop supplementary groups after setuid / setgid calls
Keywords:
Status: CLOSED UPSTREAM
Alias: None
Product: OKD
Classification: Red Hat
Component: Containers
Version: 1.x
Hardware: Unspecified
OS: Unspecified
low
low
Target Milestone: ---
: ---
Assignee: Rob Millner
QA Contact: libra bugs
URL: http://www.openwall.com/lists/oss-sec...
Whiteboard:
Depends On: 903293 903307
Blocks: 903295 903301 903303
TreeView+ depends on / blocked
 
Reported: 2013-01-23 16:58 UTC by Jan Lieskovsky
Modified: 2013-11-18 00:46 UTC (History)
6 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of: 903293
Environment:
Last Closed: 2013-04-16 22:33:36 UTC
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)

Description Jan Lieskovsky 2013-01-23 16:58:39 UTC
+++ This bug was initially created as a clone of Bug #903293 +++

Description of problem:
As noted in bug #894626 and in:
  [1] http://www.openwall.com/lists/oss-security/2013/01/23/7

haproxy previously failed to drop supplementary groups properly when trying to drop root privileges.

By itself this problem is not a security flaw, but still serious enough the upstream fix:
  [2] git.1wt.eu/web?p=haproxy.git;a=commitdiff;h=ab012dd3

to be backported into all of the affected versions.

Version-Release number of selected component (if applicable):
haproxy-1.4.19-1.el6_3

How reproducible:
Always

Steps to Reproduce:
1. See https://bugzilla.redhat.com/show_bug.cgi?id=894626#c0 for further reproducer details
  
Actual results:
Supplementary groups are not dropped properly after setuid / setgid calls.

Expected results:
(All) Supplementary groups should be dropped when dropping root privileges.

Comment 1 Jhon Honce 2013-01-23 19:07:38 UTC
Schedule haproxy update when this patch is available upstream.

Comment 2 Rob Millner 2013-02-27 19:22:24 UTC
OpenShift is not exposed to this issue, reducing severity.

With a both the system haproxy and a scalable app:

[root@ip-10-77-75-81 ~]# ps auxwwwww |grep haproxy
haproxy   9205  0.0  0.0  23412  3836 ?        Ss   14:18   0:00 /usr/sbin/haproxy -D -f /etc/openshift/port-proxy.cfg -p /var/run/openshift-port-proxy.pid -sf 1839
501       9502  0.0  0.0  16440  1312 ?        Ss   14:18   0:00 /usr/sbin/haproxy -f /var/lib/openshift/512e5bf6ef805c16c4000006//haproxy-1.4/conf/haproxy.cfg -sf 9373
501       9552  0.0  0.2 111032 22420 ?        Sl   14:18   0:00 haproxy_ctld.rb                                                                                  
root     10159  0.0  0.0 103236   876 pts/0    S+   14:19   0:00 grep haproxy

[root@ip-10-77-75-81 ~]# grep Group /proc/9205/status
Groups:	

[root@ip-10-77-75-81 ~]# grep Group /proc/9502/status
Groups:	501

Comment 3 Rob Millner 2013-04-16 22:33:36 UTC
Closing this bug since there's nothing for OpenShift to do but wait for upstream.


Note You need to log in before you can comment on or make changes to this bug.