bugtraq - Re: /proc filesystem allows bypassing directory permissions on Linux

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Mon, 26 Oct 2009 15:27:15 -0600
From: "Kinzel, David" <dakinzel@...cor.com>
To: "'nomail@...ail.com'" <nomail@...ail.com>,
	"bugtraq@...urityfocus.com" <bugtraq@...urityfocus.com>
Subject: Re: /proc filesystem allows bypassing directory permissions on Linux

> -----Original Message-----
> From: nomail@...ail.com [mailto:nomail@...ail.com]
> Sent: Monday, October 26, 2009 9:15 AM
> To: bugtraq@...urityfocus.com
> Subject: Re: Re: /proc filesystem allows bypassing directory
> permissions on Linux
>
> >> I do not think mounting /proc should change access control
> semantics.
> >>
> >It didn't in fact change anything. If the guest created
> hardlink to that file in a unrestricted location, what would you say?
>
> Do your homework and test it. You can't create the hardlink -
> the link(oldpath, newpath) call will fail with EACCES if
> search permission is denied for any directory in oldpath or
> newpath. Documented in the manpage, and I just tested and verified it.
>

It's creating the hardlink (or setting the fd in /proc) before the directory is locked down to user-only permissions. You will be allowed access to whatever the file allows, despite what the directory permissions are. This seems expected to me, since the files will be the same inode. If I'm following this correctly it comes down to some distributions treating /proc/*/fd/* as hardlinks, for whatever reason.

>
> Fact is, directory permissions are relevant in Unix. Despite
> it's permissions, under the Unix access permission semantics
> the file is unwriteable for anyone but the owner, and this
> bug pokes a hole into that.
>

------------------------------------------------------------------------
This email and its contents are private and confidential, for the sole use of the addressees. If you are not an intended recipient, copying, forwarding or other distribution of this email or its contents by any means is prohibited. If you believe that you received this email in error please notify the original sender immediately.

Petro-Canada is a Suncor Energy business.

------------------------

Ce courriel et son contenu sont priv?s et confidentiels, et sont destin?s ? l'usage exclusif des destinataires. Si vous n'?tes pas le destinataire pr?vu, toute reproduction, transfert ou autre forme de diffusion de ce courriel ou de son contenu par quelque moyen que ce soit est interdit. Si vous croyez avoir re?u ce courriel par erreur, veuillez en aviser l'exp?diteur original imm?diatement.

Petro-Canada est une entreprise de Suncor ?nergie.