From owner-svn-src-head@FreeBSD.ORG Tue Feb 10 03:14:42 2015 Return-Path: Delivered-To: svn-src-head@FreeBSD.org Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id 38146CD2; Tue, 10 Feb 2015 03:14:42 +0000 (UTC) Received: from st11p02mm-asmtp001.mac.com (st11p02mm-asmtp001.mac.com [17.172.220.236]) (using TLSv1.2 with cipher DHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 0A8D9686; Tue, 10 Feb 2015 03:14:41 +0000 (UTC) Received: from fukuyama.hsd1.ca.comcast.net (unknown [73.162.13.215]) by st11p02mm-asmtp001.mac.com (Oracle Communications Messaging Server 7.0.5.35.0 64bit (built Dec 4 2014)) with ESMTPSA id <0NJJ00CNBCZ9DU00@st11p02mm-asmtp001.mac.com>; Tue, 10 Feb 2015 03:14:02 +0000 (GMT) X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:5.13.68,1.0.33,0.0.0000 definitions=2015-02-10_02:2015-02-09,2015-02-10,1970-01-01 signatures=0 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 spamscore=0 suspectscore=0 phishscore=0 adultscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=7.0.1-1412110000 definitions=main-1502100030 Content-type: text/plain; charset=us-ascii MIME-version: 1.0 (Mac OS X Mail 8.2 \(2070.6\)) Subject: Re: svn commit: r278479 - in head: etc sys/kern From: Rui Paulo In-reply-to: <201502100311.t1A3BkE0016096@gw.catspoiler.org> Date: Mon, 09 Feb 2015 19:13:57 -0800 Content-transfer-encoding: quoted-printable Message-id: References: <201502100311.t1A3BkE0016096@gw.catspoiler.org> To: Don Lewis X-Mailer: Apple Mail (2.2070.6) Cc: svn-src-head@FreeBSD.org, svn-src-all@FreeBSD.org, mjguzik@gmail.com, rpaulo@FreeBSD.org, src-committers@FreeBSD.org X-BeenThere: svn-src-head@freebsd.org X-Mailman-Version: 2.1.18-1 Precedence: list List-Id: SVN commit messages for the src tree for head/-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 10 Feb 2015 03:14:42 -0000 On Feb 9, 2015, at 19:11, Don Lewis wrote: >=20 > On 10 Feb, Mateusz Guzik wrote: >> On Mon, Feb 09, 2015 at 11:13:51PM +0000, Rui Paulo wrote: >>> +notify 10 { >>> + match "system" "kernel"; >>> + match "subsystem" "signal"; >>> + match "type" "coredump"; >>> + action "logger $comm $core"; >>> +}; >>> + >>> */ >>>=20 >> [..] >>> + if (vn_fullpath_global(td, p->p_textvp, &fullpath, &freepath) !=3D= 0) >>> + goto out; >>> + snprintf(data, len, "comm=3D%s", fullpath); >>=20 >> I cannot test it right now, but it looks like immediate privilege >> escalation. >>=20 >> Path is not sanitized in any way and devd passes it to 'sh -c'. >>=20 >> So a file named "a.out; /bin/id; meh" or so should result in = execution >> of aforementioned /bin/id. >=20 > Then there is the issue of a user-generated core file being fed into = the > crash analyzer, possibly exploiting bugs in the latter. That's why there's a warning in devd.conf: devd will run the helper as = root, so a proper written helper has to drop the privileges very early = or be invoked by devd with lower privileges. My helper just drops = privileges to match the UID/GID of the generated core file before doing = anything else. -- Rui Paulo