Home page logo
/

bugtraq logo Bugtraq mailing list archives

Re: /proc filesystem allows bypassing directory permissions on Linux
From: "Kinzel, David" <dakinzel () suncor com>
Date: Mon, 26 Oct 2009 15:27:15 -0600

-----Original Message-----
From: nomail () nomail com [mailto:nomail () nomail com]
Sent: Monday, October 26, 2009 9:15 AM
To: bugtraq () securityfocus com
Subject: Re: Re: /proc filesystem allows bypassing directory
permissions on Linux

I do not think mounting /proc should change access control
semantics.

It didn't in fact change anything. If the guest created
hardlink to that file in a unrestricted location, what would you say?

Do your homework and test it. You can't create the hardlink -
the link(oldpath, newpath) call will fail with EACCES if
search permission is denied for any directory in oldpath or
newpath. Documented in the manpage, and I just tested and verified it.


It's creating the hardlink (or setting the fd in /proc) before the directory is locked down to user-only permissions. 
You will be allowed access to whatever the file allows, despite what the directory permissions are. This seems expected 
to me, since the files will be the same inode. If I'm following this correctly it comes down to some distributions 
treating /proc/*/fd/* as hardlinks, for whatever reason.


Fact is, directory permissions are relevant in Unix. Despite
it's permissions, under the Unix access permission semantics
the file is unwriteable for anyone but the owner, and this
bug pokes a hole into that.


------------------------------------------------------------------------
This email and its contents are private and confidential, for the sole use of the addressees. If you are not an 
intended recipient, copying, forwarding or other distribution of this email or its contents by any means is prohibited. 
If you believe that you received this email in error please notify the original sender immediately.

Petro-Canada is a Suncor Energy business.

------------------------

Ce courriel et son contenu sont priv?s et confidentiels, et sont destin?s ? l'usage exclusif des destinataires. Si vous 
n'?tes pas le destinataire pr?vu, toute reproduction, transfert ou autre forme de diffusion de ce courriel ou de son 
contenu par quelque moyen que ce soit est interdit. Si vous croyez avoir re?u ce courriel par erreur, veuillez en 
aviser l'exp?diteur original imm?diatement.

Petro-Canada est une entreprise de Suncor ?nergie.


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]
AlienVault