From owner-cvs-src@FreeBSD.ORG  Sun Feb 22 18:57:08 2004
Return-Path: <owner-cvs-src@FreeBSD.ORG>
Delivered-To: cvs-src@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP
	id B14EA16A4CE; Sun, 22 Feb 2004 18:57:08 -0800 (PST)
Received: from VARK.homeunix.com (adsl-68-122-0-124.dsl.pltn13.pacbell.net
	[68.122.0.124])	by mx1.FreeBSD.org (Postfix) with ESMTP
	id 6CFDD43D2D; Sun, 22 Feb 2004 18:57:08 -0800 (PST)
	(envelope-from das@FreeBSD.ORG)
Received: from VARK.homeunix.com (localhost [127.0.0.1])
	by VARK.homeunix.com (8.12.11/8.12.10) with ESMTP id i1N2ul8g057516;
	Sun, 22 Feb 2004 18:56:48 -0800 (PST)
	(envelope-from das@FreeBSD.ORG)
Received: (from das@localhost)
	by VARK.homeunix.com (8.12.11/8.12.10/Submit) id i1N2ullm057515;
	Sun, 22 Feb 2004 18:56:47 -0800 (PST)
	(envelope-from das@FreeBSD.ORG)
Date: Sun, 22 Feb 2004 18:56:47 -0800
From: David Schultz <das@FreeBSD.ORG>
To: kientzle@acm.org
Message-ID: <20040223025647.GA43467@VARK.homeunix.com>
Mail-Followup-To: kientzle@acm.org,
	Colin Percival <cperciva@FreeBSD.ORG>, src-committers@FreeBSD.ORG,
	cvs-src@FreeBSD.ORG, cvs-all@FreeBSD.ORG
References: <200402221003.i1MA3PW0024791@repoman.freebsd.org>
	<403944D8.6050107@kientzle.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <403944D8.6050107@kientzle.com>
cc: cvs-src@FreeBSD.ORG
cc: src-committers@FreeBSD.ORG
cc: cvs-all@FreeBSD.ORG
cc: Colin Percival <cperciva@FreeBSD.ORG>
Subject: Re: cvs commit: src/sbin/nologin Makefile nologin.c
X-BeenThere: cvs-src@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: CVS commit messages for the src tree <cvs-src.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/cvs-src>,
	<mailto:cvs-src-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/cvs-src>
List-Post: <mailto:cvs-src@freebsd.org>
List-Help: <mailto:cvs-src-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/cvs-src>,
	<mailto:cvs-src-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Mon, 23 Feb 2004 02:57:08 -0000

On Sun, Feb 22, 2004, Tim Kientzle wrote:
> Colin Percival wrote:
> >
> >  Modified files:
> >    sbin/nologin         Makefile nologin.c 
> >  Log:
> >  Report login attempts to syslog.  Due to the statically-linked nature of
> >  nologin(8) ...
> 
> Why is nologin statically linked?
> 
> Nothing else in /sbin is statically linked now.

Because of environment-poisoning attacks such as the following:

	das@VARK:~> \login -p test
	Password:
	Last login: Sun Feb 22 16:25:26 on ttypf
	
	
	
	<VARK>
	
	This account is currently not available.
	das@VARK:~> setenv LD_LIBRARY_PATH /home/das/exploit
	das@VARK:~> \login -p test
	Password:
	Last login: Sun Feb 22 18:55:40 on ttypf
	
	
	
	<VARK>
	
	This account is currently not available.
	Exploit worked.  Executing a shell.
	$ unset LD_LIBRARY_PATH
	$ whoami
	test
	$ 

This attack was executed with a dynamically-linked /sbin/nologin
and a special libc.so.5 in the /home/das/exploit directory that
replaces the _exit() stub with a routine that spawns a shell.
Note that this attack also works with OpenSSH provided that the
locked out user has a ~/.ssh/environment file.[1]

Admittedly, making /sbin/nologin static is a kludgy solution.[2]
It would be far better if we had a link option or something that
altered the behavior of rtld in the same way as setting the setuid
bit, but at link time.


[1] I think Theo might have changed his mind about this
    questionable feature and disabled it by default in
    recent versions of OpenSSH.  See the PermitUserEnvironment
    option in sshd_config(5).

[2] One could also argue that /sbin/nologin itself is a kludgy
    solution because it only mediates shell access, and that a
    PAM module is a much more appropriate way to address the
    problem.