Date: Fri, 15 Sep 2000 14:12:48 +0200 From: Poul-Henning Kamp <phk@critter.freebsd.dk> To: Alain Thivillon <Alain.Thivillon@hsc.fr> Cc: freebsd-current@FreeBSD.ORG Subject: Re: DevFs status and security ? Message-ID: <62837.969019968@critter> In-Reply-To: Your message of "Fri, 15 Sep 2000 13:55:48 %2B0200." <20000915135548.A436@yoko.hsc.fr>
next in thread | previous in thread | raw e-mail | index | archive | help
Looks like I forgot an access check in DEVFS. I'll look at it tonight. Poul-Henning In message <20000915135548.A436@yoko.hsc.fr>, Alain Thivillon writes: >There is a huge security hole in -CURRENT devfs, i don't known if this >is a temporary issue or a 'real' bug: > >$ id >uid=2089(yann) gid=2089(yann) groups=2089(yann) >$ uname -a >FreeBSD yoko.hsc.fr 5.0-CURRENT FreeBSD 5.0-CURRENT #57: Fri Sep 15 >13:36:26 CEST 2000 titi@yoko.hsc.fr:/usr/src/sys/compile/YOKO50 >i386 >$ df >Filesystem 1K-blocks Used Avail Capacity Mounted on >/dev/ad0s3a 6252604 5027631 724765 87% / >devfs 1 1 0 100% /dev >procfs 4 4 0 100% /proc >$ ls -l /dev/null >crw-rw-rw- 1 root wheel 2, 2 Sep 15 13:47 /dev/null >$ chown yann /dev/null >$ chown yann /dev/mem >$ ls -l /dev/null >crw-rw-rw- 1 yann wheel 2, 2 Sep 15 13:47 /dev/null >$ chmod 600 /dev/null >$ ls -l /dev/null >crw------- 1 yann wheel 2, 2 Sep 15 13:47 /dev/null >$ strings /dev/mem | head -10 >Read >Boot > error >(TKT >( CT >(@;T >((0S >(,/S >(l-S >(d/S > > Every user can change all owners and perms on devfs files. I >have verified that /dev/null permissions are REALLY changed (other users >can not use him) and that Mem can REALLY be read by anyone. > > Did i miss something ? Strange that nobody reported it (my >problems appeeared when procmail changed perms of /dev/null :)) > > > >To Unsubscribe: send mail to majordomo@FreeBSD.org >with "unsubscribe freebsd-current" in the body of the message > -- Poul-Henning Kamp | UNIX since Zilog Zeus 3.20 phk@FreeBSD.ORG | TCP/IP since RFC 956 FreeBSD coreteam member | BSD since 4.3-tahoe Never attribute to malice what can adequately be explained by incompetence. To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-current" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?62837.969019968>