[5430] in RedHat Linux List
RE: RedHat4.0 security
daemon@ATHENA.MIT.EDU (Chris Evans)
Thu Nov 21 15:57:33 1996
Date: Thu, 21 Nov 1996 21:41:59 +0000 (GMT)
From: Chris Evans <chris@ferret.lmh.ox.ac.uk>
To: redhat-list@redhat.com
In-Reply-To: <Pine.LNX.3.93.961121105746.30935A-100000@redhat.com>
Resent-From: redhat-list@redhat.com
Reply-To: redhat-list@redhat.com
On Thu, 21 Nov 1996, Erik Troan wrote:
> On Thu, 21 Nov 1996, Dwight Hubbard wrote:
>
> > Could you summarize why each one is set uid??
>
> <sigh> I don't know why I'm doing this.
Well, from your answers, looks like it was worth it! :-)
> -rwsr-xr-x- root daemon 17732 Aug 09 11:32 /usr/bin/at
>
> Writes to /var/spool/at when you submit jobs.
Well, whats wrong with sgid + suitable group? True, a buffer overflow
could then be used to write root executing jobs in the config files,
gaining you little...
> -rwsr-sr-x- root tty 51296 Aug 29 16:30 /sbin/dump
> -rwsr-sr-x- root tty 55376 Aug 29 16:30 /sbin/restore
>
> Uses rsh internally for remote dump/restore.
Hmm. So this is catering for the fact that non-root users on the local
system might be system administrators of remote machines, and wanting to
initialise backups??! How many people would suffer loss of functionality
if these weren't suid root? Isn't rsh suid root anyway? I'm probably
missing something, but disapprove most strongly.
[snip..etc]
> -rws--x--x- root root 15448 Sep 02 11:28 /usr/games/vga_mines
> -rws--x--x- root root 18028 Sep 02 11:28 /usr/games/vga_othello
> -r-s--x--x- root root 61240 Sep 02 11:30 /usr/games/tetris
> -rws--x--x- root root 159472 Nov 20 17:27 /usr/X11R6/bin/kterm
> -r-s--x--x- root root 88272 Sep 02 11:48 /usr/bin/zgv
>
> SVGAlib
Have these been verified for command line arg buffer overflows + dropping
of permissions the moment they have ioperm()'ed video I/O? Likewise for
programs only needing privilege briefly to, for example, open raw network
sockets.
> -r-sr-sr-x- root lp 13404 Oct 25 13:10 /usr/bin/lpq
> -r-sr-sr-x- root lp 14508 Oct 25 13:10 /usr/bin/lpr
> -r-sr-sr-x- root lp 14164 Oct 25 13:10 /usr/bin/lprm
>
> Secure port and access to /var/spool/lpd
Is the LRPng solution still being worked on?
> -rwsr-xr-x- root root 74628 Oct 27 09:01 /usr/lib/mc/bin/cons.saver
>
> Good question. I'm asking about this one.
I thought this highly dubious too.
> -rwsr-sr-x- root mail 72628 Oct 17 17:57 /usr/bin/mh/inc
> -rwsr-xr-x- root root 52536 Oct 17 17:57 /usr/bin/mh/msgchk
>
> Access /var/spool/mail
If that's all, sgid + group mail would seem more appropriate.
> -rwsr-xr-x- root root 29712 Aug 30 15:01 /bin/mount
> -rwsr-xr-x- root root 16360 Aug 30 15:01 /bin/umount
>
> For "user" mount attribute.
I would guess only a small amount of people use this; most users of
machines wanting to be secure, won't have console access etc. The install
proceedure should have a "paranoid security" option which among other
things won't install these suid root. Reference: recent appalling mount hole.
> -rwsr-xr-x- root root 8356 Oct 22 14:49 /sbin/cardctl
>
> Allows any user to look at pcmcia configuration (only root is allowed to
> modify it -- I'm not sure this is a good idea but it is what the author
> recommends).
I really wish more people would look at UNIX security like this: "Does a
user have a specific NEED to be able to do XXX?". PCMCIA config sounds
somewhat like a system administrators task to me...
> -rwsr-sr-x- root mail 54384 Aug 11 23:14 /usr/bin/procmail
>
> Accesses /var/spool/mail
See above.
> -r-sr-xr-x- root root 10412 Aug 14 11:35 /usr/X11R6/bin/XConsole
>
> Reads /dev/console
Again, sgid + special group?
> -rwsr-xr-x- root root 52244 Nov 20 17:05 /usr/X11R6/bin/rxvt
> -rwsr-xr-x- root root 264036 Oct 24 14:57 /usr/bin/screen
> -rws--x--x- root root 136504 Nov 20 15:04 /usr/X11R6/bin/nxterm
> (add xterm to this list [we don't have the XFree packages in devel right now)
>
> Updates utmp/wtmp.
If that was all, a "utmp/wtmp" group would be appropriate. However,
changing tty ownership is also an issue. Ideally programs like these will
open the utmp/wtmp file, change ownership of the tty, then immediately
drop privs.
Comments welcome.
Chris. (roll on POSIX.6)
--
PLEASE read the Red Hat FAQ, Tips, Errata and the MAILING LIST ARCHIVES!
________________________________________________________________________
http://www.redhat.com/RedHat-FAQ http://www.redhat.com/RedHat-Errata
http://www.redhat.com/RedHat-Tips http://www.redhat.com/mailing-lists
------------------------------------------------------------------------
To unsubscribe: mail -s unsubscribe redhat-list-request@redhat.com < /dev/null
