From owner-svn-src-head@freebsd.org Sat Jul 13 16:07:39 2019 Return-Path: Delivered-To: svn-src-head@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 6D04B15EBF02; Sat, 13 Jul 2019 16:07:39 +0000 (UTC) (envelope-from ian@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) server-signature RSA-PSS (4096 bits) client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "Let's Encrypt Authority X3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 119C48B63B; Sat, 13 Jul 2019 16:07:39 +0000 (UTC) (envelope-from ian@FreeBSD.org) Received: from repo.freebsd.org (repo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id E0269281C1; Sat, 13 Jul 2019 16:07:38 +0000 (UTC) (envelope-from ian@FreeBSD.org) Received: from repo.freebsd.org ([127.0.1.37]) by repo.freebsd.org (8.15.2/8.15.2) with ESMTP id x6DG7cg3067203; Sat, 13 Jul 2019 16:07:38 GMT (envelope-from ian@FreeBSD.org) Received: (from ian@localhost) by repo.freebsd.org (8.15.2/8.15.2/Submit) id x6DG7cTR067202; Sat, 13 Jul 2019 16:07:38 GMT (envelope-from ian@FreeBSD.org) Message-Id: <201907131607.x6DG7cTR067202@repo.freebsd.org> X-Authentication-Warning: repo.freebsd.org: ian set sender to ian@FreeBSD.org using -f From: Ian Lepore Date: Sat, 13 Jul 2019 16:07:38 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r349974 - head/libexec/rc/rc.d X-SVN-Group: head X-SVN-Commit-Author: ian X-SVN-Commit-Paths: head/libexec/rc/rc.d X-SVN-Commit-Revision: 349974 X-SVN-Commit-Repository: base MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-Rspamd-Queue-Id: 119C48B63B X-Spamd-Bar: -- Authentication-Results: mx1.freebsd.org X-Spamd-Result: default: False [-2.95 / 15.00]; local_wl_from(0.00)[FreeBSD.org]; NEURAL_HAM_MEDIUM(-1.00)[-1.000,0]; NEURAL_HAM_SHORT(-0.95)[-0.948,0]; ASN(0.00)[asn:11403, ipnet:2610:1c1:1::/48, country:US]; NEURAL_HAM_LONG(-1.00)[-1.000,0] X-BeenThere: svn-src-head@freebsd.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: SVN commit messages for the src tree for head/-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 13 Jul 2019 16:07:39 -0000 Author: ian Date: Sat Jul 13 16:07:38 2019 New Revision: 349974 URL: https://svnweb.freebsd.org/changeset/base/349974 Log: Limit access to system accounting files. In 2013 the security chapter of the Handbook was updated in r42501 to suggest limiting access to the system accounting file [*1] by creating the initial file with a mode of 0600. This was in part based on a discussion in the forums [*2]. Unfortunately, this advice is overridden by the fact that a new file is created as part of periodic daily processing, and the file mode is set by the rc.d/accounting script. These changes update the accounting script to create the directory with mode 0750 if it doesn't already exist, and to create the daily file with mode 0640. This limits write access to root only, read access to root and members of wheel, and eliminates world access completely. For admins who want to prevent even members of wheel from accessing the files, the mode of the /var/account directory can be manually changed to 0700, because the script never creates or changes that directory if it already exists. The accounting_rotate_log() function now also handles the error cases of no existing log file to rotate, and attempting to rotate the file multiple times (.0 file already exists). Another small change here eliminates the complexity of the mktemp/chmod/mv sequence for creating a new acct file by using install(1) with the flags needed to directly create the file with the desired ownership and modes. That allows coalescing two separate if checkyesno accounting_enable blocks into one. These changes were inspired by my investigation of PR 202203. [1] https://www.freebsd.org/doc/handbook/security-accounting.html [2] http://forums.freebsd.org/showthread.php?t=41059 PR: 202203 Differential Revision: https://reviews.freebsd.org/D20876 Modified: head/libexec/rc/rc.d/accounting Modified: head/libexec/rc/rc.d/accounting ============================================================================== --- head/libexec/rc/rc.d/accounting Sat Jul 13 15:53:28 2019 (r349973) +++ head/libexec/rc/rc.d/accounting Sat Jul 13 16:07:38 2019 (r349974) @@ -21,23 +21,27 @@ start_cmd="accounting_start" stop_cmd="accounting_stop" rotate_log_cmd="accounting_rotate_log" +create_accounting_file() +{ + install -o root -g wheel -m 0640 /dev/null "${accounting_file}" +} + accounting_start() { local _dir _dir="${accounting_file%/*}" if [ ! -d "$_dir" ]; then - if ! mkdir -p "$_dir"; then + if ! mkdir -p -m 0750 "$_dir"; then err 1 "Could not create $_dir." fi fi if [ ! -e "$accounting_file" ]; then echo -n "Creating accounting file ${accounting_file}" - touch "$accounting_file" + create_accounting_file echo '.' fi - chmod 644 "$accounting_file" echo "Turning on accounting." ${accounting_command} ${accounting_file} @@ -51,21 +55,24 @@ accounting_stop() accounting_rotate_log() { - local _dir _file + # Note that this function must handle being called as "onerotate_log" + # (by the periodic scripts) when accounting is disabled, and handle + # being called multiple times (by an admin making mistakes) without + # anything having actually rotated the old .0 file out of the way. - _dir="${accounting_file%/*}" - cd $_dir + if [ -e "${accounting_file}.0" ]; then + err 1 "Cannot rotate accounting log, ${accounting_file}.0 already exists." + fi - if checkyesno accounting_enable; then - _file=`mktemp newacct-XXXXX` - chmod 644 $_file - ${accounting_command} ${_dir}/${_file} + if [ ! -e "${accounting_file}" ]; then + err 1 "Cannot rotate accounting log, ${accounting_file} does not exist." fi mv ${accounting_file} ${accounting_file}.0 if checkyesno accounting_enable; then - mv $_file ${accounting_file} + create_accounting_file + ${accounting_command} "${accounting_file}" fi }