From owner-freebsd-bugs@FreeBSD.ORG Tue Oct 25 17:10:15 2011 Return-Path: Delivered-To: freebsd-bugs@hub.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 0B9D4106568B for ; Tue, 25 Oct 2011 17:10:15 +0000 (UTC) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (freefall.freebsd.org [IPv6:2001:4f8:fff6::28]) by mx1.freebsd.org (Postfix) with ESMTP id AEFAB8FC18 for ; Tue, 25 Oct 2011 17:10:14 +0000 (UTC) Received: from freefall.freebsd.org (localhost [127.0.0.1]) by freefall.freebsd.org (8.14.4/8.14.4) with ESMTP id p9PHAE26043451 for ; Tue, 25 Oct 2011 17:10:14 GMT (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.14.4/8.14.4/Submit) id p9PHAEn3043450; Tue, 25 Oct 2011 17:10:14 GMT (envelope-from gnats) Resent-Date: Tue, 25 Oct 2011 17:10:14 GMT Resent-Message-Id: <201110251710.p9PHAEn3043450@freefall.freebsd.org> Resent-From: FreeBSD-gnats-submit@FreeBSD.org (GNATS Filer) Resent-To: freebsd-bugs@FreeBSD.org Resent-Reply-To: FreeBSD-gnats-submit@FreeBSD.org, Harry Coin Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 146081065677 for ; Tue, 25 Oct 2011 17:02:44 +0000 (UTC) (envelope-from nobody@FreeBSD.org) Received: from red.freebsd.org (red.freebsd.org [IPv6:2001:4f8:fff6::22]) by mx1.freebsd.org (Postfix) with ESMTP id DF1988FC12 for ; Tue, 25 Oct 2011 17:02:43 +0000 (UTC) Received: from red.freebsd.org (localhost [127.0.0.1]) by red.freebsd.org (8.14.4/8.14.4) with ESMTP id p9PH2hq4086735 for ; Tue, 25 Oct 2011 17:02:43 GMT (envelope-from nobody@red.freebsd.org) Received: (from nobody@localhost) by red.freebsd.org (8.14.4/8.14.4/Submit) id p9PH2h3B086734; Tue, 25 Oct 2011 17:02:43 GMT (envelope-from nobody) Message-Id: <201110251702.p9PH2h3B086734@red.freebsd.org> Date: Tue, 25 Oct 2011 17:02:43 GMT From: Harry Coin To: freebsd-gnats-submit@FreeBSD.org X-Send-Pr-Version: www-3.1 Cc: Subject: kern/162009: getpwnam_r buf too small nfs assigns root:user to krb5 clients X-BeenThere: freebsd-bugs@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Bug reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 25 Oct 2011 17:10:15 -0000 >Number: 162009 >Category: kern >Synopsis: getpwnam_r buf too small nfs assigns root:user to krb5 clients >Confidential: no >Severity: critical >Priority: high >Responsible: freebsd-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Tue Oct 25 17:10:09 UTC 2011 >Closed-Date: >Last-Modified: >Originator: Harry Coin >Release: 8 stable >Organization: Quiet Fountain LLC >Environment: amd64 >Description: On nfs shares serving kerberos protected accounts, freebsd will assign to files of normal users the ownership root:user. About as major a security hole as you can expect. >How-To-Repeat: nfs share a directory requiring the use of kerberos. Make sure the principal name maps to a user with a long name and plenty of gecos and other info in the structures relevant to getpw*_r. Mount the directory on a client. Log into the client as a normal user. Create a file on mount. Note the ownership of the file is root:user. >Fix: grep -r 'getpw*_r' /usr/src. Start hunting. I found some previously mentioned in bug reports. Here's another 2. Basically the problem is 128 byte buffer too small to hold what getpwnam_r returns, plus inadequate error processing (i.e. no log, no user notification...) patch -p diff -u /usr/src/lib/librpcsec_gss/svc_rpcsec_gss.c new/svc_rpcsec_gss.c --- /usr/src/lib/librpcsec_gss/svc_rpcsec_gss.c 2010-01-30 06:11:21.000000000 -0600 +++ new/svc_rpcsec_gss.c 2011-10-25 11:31:13.549499272 -0500 @@ -562,7 +562,7 @@ const gss_name_t name) { OM_uint32 maj_stat, min_stat; - char buf[128]; + char buf[2048]; uid_t uid; struct passwd pwd, *pw; rpc_gss_ucred_t *uc = &client->cl_ucred; diff -u /usr/src/lib/libarchive/archive_write_disk_set_standard_lookup.c new/archive_write_disk_set_standard_lookup.c --- /usr/src/lib/libarchive/archive_write_disk_set_standard_lookup.c 2011-08-16 12:29:24.293631530 -0500 +++ new/archive_write_disk_set_standard_lookup.c 2011-10-25 11:49:03.507144601 -0500 @@ -189,8 +189,8 @@ #if HAVE_PWD_H # if HAVE_GETPWNAM_R { - char _buffer[128]; - size_t bufsize = 128; + char _buffer[2048]; + size_t bufsize = 2048; char *buffer = _buffer; struct passwd pwent, *result; int r; diff -u /usr/src/usr.sbin/gssd/gssd.c new/gssd.c --- /usr/src/usr.sbin/gssd/gssd.c 2009-08-03 03:13:06.000000000 -0500 +++ new/gssd.c 2011-10-25 11:59:38.290239235 -0500 @@ -452,7 +452,7 @@ { gss_name_t name = gssd_find_resource(argp->pname); uid_t uid; - char buf[128]; + char buf[2048]; struct passwd pwd, *pw; memset(result, 0, sizeof(*result)); >Release-Note: >Audit-Trail: >Unformatted: