linux-kernel - Re: Are setuid shell scripts safe? (Implied by security_bprm_creds_for

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20251204093209.706f30a6@pumpkin>
Date: Thu, 4 Dec 2025 09:32:09 +0000
From: David Laight <david.laight.linux@...il.com>
To: Al Viro <viro@...iv.linux.org.uk>
Cc: Bernd Edlinger <bernd.edlinger@...mail.de>, "Eric W. Biederman"
 <ebiederm@...ssion.com>, Roberto Sassu <roberto.sassu@...weicloud.com>,
 Alexey Dobriyan <adobriyan@...il.com>, Oleg Nesterov <oleg@...hat.com>,
 Kees Cook <kees@...nel.org>, Andy Lutomirski <luto@...capital.net>, Will
 Drewry <wad@...omium.org>, Christian Brauner <brauner@...nel.org>, Andrew
 Morton <akpm@...ux-foundation.org>, Michal Hocko <mhocko@...e.com>, Serge
 Hallyn <serge@...lyn.com>, James Morris <jamorris@...ux.microsoft.com>,
 Randy Dunlap <rdunlap@...radead.org>, Suren Baghdasaryan
 <surenb@...gle.com>, Yafang Shao <laoar.shao@...il.com>, Helge Deller
 <deller@....de>, Adrian Reber <areber@...hat.com>, Thomas Gleixner
 <tglx@...utronix.de>, Jens Axboe <axboe@...nel.dk>, Alexei Starovoitov
 <ast@...nel.org>, "linux-fsdevel@...r.kernel.org"
 <linux-fsdevel@...r.kernel.org>, "linux-kernel@...r.kernel.org"
 <linux-kernel@...r.kernel.org>, linux-kselftest@...r.kernel.org,
 linux-mm@...ck.org, linux-security-module@...r.kernel.org, tiozhang
 <tiozhang@...iglobal.com>, Luis Chamberlain <mcgrof@...nel.org>, "Paulo
 Alcantara (SUSE)" <pc@...guebit.com>, Sergey Senozhatsky
 <senozhatsky@...omium.org>, Frederic Weisbecker <frederic@...nel.org>,
 YueHaibing <yuehaibing@...wei.com>, Paul Moore <paul@...l-moore.com>,
 Aleksa Sarai <cyphar@...har.com>, Stefan Roesch <shr@...kernel.io>, Chao Yu
 <chao@...nel.org>, xu xin <xu.xin16@....com.cn>, Jeff Layton
 <jlayton@...nel.org>, Jan Kara <jack@...e.cz>, David Hildenbrand
 <david@...hat.com>, Dave Chinner <dchinner@...hat.com>, Shuah Khan
 <shuah@...nel.org>, Elena Reshetova <elena.reshetova@...el.com>, David
 Windsor <dwindsor@...il.com>, Mateusz Guzik <mjguzik@...il.com>, Ard
 Biesheuvel <ardb@...nel.org>, "Joel Fernandes (Google)"
 <joel@...lfernandes.org>, "Matthew Wilcox (Oracle)" <willy@...radead.org>,
 Hans Liljestrand <ishkamiel@...il.com>, Penglei Jiang
 <superman.xpt@...il.com>, Lorenzo Stoakes <lorenzo.stoakes@...cle.com>,
 Adrian Ratiu <adrian.ratiu@...labora.com>, Ingo Molnar <mingo@...nel.org>,
 "Peter Zijlstra (Intel)" <peterz@...radead.org>, Cyrill Gorcunov
 <gorcunov@...il.com>, Eric Dumazet <edumazet@...gle.com>,
 zohar@...ux.ibm.com, linux-integrity@...r.kernel.org, Ryan Lee
 <ryan.lee@...onical.com>, apparmor <apparmor@...ts.ubuntu.com>
Subject: Re: Are setuid shell scripts safe? (Implied by
 security_bprm_creds_for_exec)

On Thu, 4 Dec 2025 05:49:15 +0000
Al Viro <viro@...iv.linux.org.uk> wrote:

> On Wed, Dec 03, 2025 at 02:16:29PM +0100, Bernd Edlinger wrote:
> 
> > Hmm, yes, that looks like an issue.
> > 
> > I would have expected the security engine to look at bprm->filenanme
> > especially in the case, when bprm->interp != bprm->filename,
> > and check that it is not a sym-link with write-access for the
> > current user and of course also that the bprm->file is not a regular file
> > which is writable by the current user, if that is the case I would have expected
> > the secuity engine to enforce non-new-privs on a SUID executable somehow.  
> 
> Check that _what_ is not a symlink?  And while we are at it, what do write
> permissions to any symlinks have to do with anything whatsoever?
> 

You'd need to check for write permissions to all the directories in the
full path of the symlink and in all the directories traversed by the symlink.
(and that may not be enough....)

Passing the shell (or whatever) /dev/fd/n doesn't seem (to me) any different
from what happens when the elf interpreter runs a suid program.
You might want to check for non-owner write permissions to the /dev/fd/n entry,
but that is true for any suid executable, not just scripts.

FWIW the SYSV shells normally set the effective uid back the real uid.
So making a script suid didn't work unless the script started "#!/bin/sh -p".
Whether that improved security (rather than being annoying) is another matter.

	David