Date: Tue, 5 Jun 2012 16:06:28 +0200 From: Ed Schouten <ed@80386.nl> To: Bryan Drewery <bryan@shatow.net> Cc: freebsd-hackers@freebsd.org Subject: Re: [RFC] last(1) with security.bsd.see_other_uids support Message-ID: <CAJOYFBDip7142X_pviYFp527u-DXTY-eYObd_oHasRSV9FRwxw@mail.gmail.com> In-Reply-To: <4FCC126C.1020600@shatow.net> References: <4FCC126C.1020600@shatow.net>
next in thread | previous in thread | raw e-mail | index | archive | help
Hi Bryan,
2012/6/4 Bryan Drewery <bryan@shatow.net>:
> * Added utmp group
Why call it utmp? FreeBSD 9+ does not do utmp. It does utmpx. Also,
too many pieces of software already abuse the group `utmp'. Instead of
doing utmp handling with it, it is used to cover all sorts of "this
uses TTYs" scenarios. It wouldn't amaze me if even irssi has setuid
utmp on some systems, simply because it runs on a TTY. Also, there's
no need for consistency. This group name would only be used by the C
library to apply ownership, the log rotator and some of our tools.
Still, I wonder whether it's worth the effort. In its current form,
you can simply chmod 0600 the utx.* files to hide the information
inside to non-administrative users. I guess you can essentially decide
to make any tool setuid, simply because it can print things referring
to a user. For example, why not have a tool that allows regular users
to view their own auth.log entries?
> @@ -212,7 +255,30 @@ struct idtab {
> =C2=A0 =C2=A0 =C2=A0 =C2=A0/* Load the last entries from the file. */
> =C2=A0 =C2=A0 =C2=A0 =C2=A0if (setutxdb(UTXDB_LOG, file) !=3D 0)
> =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0err(1, "%s", file)=
;
> +
> + =C2=A0 =C2=A0 =C2=A0 /* drop setgid now that the db is open */
> + =C2=A0 =C2=A0 =C2=A0 setgid(getgid());
> +
> + =C2=A0 =C2=A0 =C2=A0 /* Lookup current user information */
> + =C2=A0 =C2=A0 =C2=A0 pw =3D getpwuid(getuid());
> +
> + =C2=A0 =C2=A0 =C2=A0 len =3D sizeof(see_other_uids);
> + =C2=A0 =C2=A0 =C2=A0 if (sysctlbyname("security.bsd.see_other_uids", &s=
ee_other_uids, &len,
> NULL, 0))
> + =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 see_other_uids =3D 0;
> + =C2=A0 =C2=A0 =C2=A0 restricted =3D is_user_restricted(pw, see_other_ui=
ds);
> +
> =C2=A0 =C2=A0 =C2=A0 =C2=A0while ((ut =3D getutxent()) !=3D NULL) {
> + =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 /* Skip this entry if =
the invoking user is not permitted
> + =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0* to see it */
> + =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 if (restricted &&
> + =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =
=C2=A0 !(ut->ut_type =3D=3D BOOT_TIME ||
> + =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 ut->ut_type =3D=3D SHUTDOWN_TIME ||
> + =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 ut->ut_type =3D=3D OLD_TIME ||
> + =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 ut->ut_type =3D=3D NEW_TIME ||
> + =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 ut->ut_type =3D=3D INIT_PROCESS) &&
> + =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =
=C2=A0 strncmp(ut->ut_user, pw->pw_name, sizeof(ut->ut_user)))
> + =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =
=C2=A0 continue;
> +
> =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0if (amount % 128 =
=3D=3D 0) {
> =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=
=A0 =C2=A0buf =3D realloc(buf, (amount + 128) * sizeof *ut);
> =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=
=A0 =C2=A0if (buf =3D=3D NULL)
>
Though not a common case, this code will not work properly when
multiple users share the same uid. Consider comparing against the
username of the logged in user (see getlogin(2)), or resolving the uid
for each entry and comparing the uids.
Best regards,
--=20
Ed Schouten <ed@80386.nl>
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?CAJOYFBDip7142X_pviYFp527u-DXTY-eYObd_oHasRSV9FRwxw>