Home page logo
/

bugtraq logo Bugtraq mailing list archives

Re: /proc filesystem allows bypassing directory permissions on Linux
From: Isara Beaumont <isara.beaumont () googlemail com>
Date: Mon, 26 Oct 2009 21:05:39 +0100

Dan Yefimov said:

I do not think mounting /proc should change access control semantics.

It didn't in fact change anything. If the guest created hardlink to that file in
a unrestricted location, what would you say? Procfs is in that respect just
another sort of hardlinks, whether you like that or not. If you didn't in fact
restrict an access to the file, you're on your own.

(1) This is WRONG, and I find it interesting that nobody bothered to check
or test this. The POSIX standard mandates that link() shall fail if
the user has no search
permission for any of the directories in the path prefix of oldpath or newpath.

Therefore, setting the directory permission to 0700 protects from hardlink
creation (read that again!) and this bug in the /proc filesystem
indeed lead to a
change in access control semantics. Under POSIX, the file IS unwriteable,
because it is protected by the permissions on the parent directory.

(2) While it's irrelevant for his argument, the script by Pavel Machek has a
race condition. The 'chmod 700 /tmp/my_priv' should be done before the
file is created, not
afterwards. Otherwise there is a window where the file exists, but hardlink
creation is not prevented by the directory permissions.

Isara


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]