|
Bugzilla – Full Text Bug Listing |
| Summary: | AUDIT-WHITELIST: policycoreutils-dbus: Polkit actions and DBUS service | ||
|---|---|---|---|
| Product: | [Novell Products] SUSE Security Incidents | Reporter: | Filippo Bonazzi <filippo.bonazzi> |
| Component: | Audits | Assignee: | Filippo Bonazzi <filippo.bonazzi> |
| Status: | RESOLVED FIXED | QA Contact: | Security Team bot <security-team> |
| Severity: | Normal | ||
| Priority: | P5 - None | CC: | stoyan.manolov |
| Version: | unspecified | ||
| Target Milestone: | --- | ||
| Hardware: | Other | ||
| OS: | Other | ||
| See Also: | https://bugzilla.suse.com/show_bug.cgi?id=1215977 | ||
| Whiteboard: | |||
| Found By: | --- | Services Priority: | |
| Business Priority: | Blocker: | --- | |
| Marketing QA Status: | --- | IT Deployment: | --- |
|
Description
Filippo Bonazzi
2023-07-18 15:30:54 UTC
I also looked a bit into this package. The D-Bus service is small and looks
sane enough. Only `auth_admin_keep` settings.
An interesting side path was looking into libselinux's `restorecon()` function
which recursively walks the file system for relabelling. I didn't dig much
deeper due to the complexity of the algorithm. But there's a lot of naive
opening and stat'ing in the logic. I wouldn't be surprised if during
relabelling typical file system attack can be used to gain privileges. This
could be something for a separate AUDIT-1 or so, if somebody is interested.
The GUI tool `system-config-selinux` is supposed to be run as root (polkit
policy shipped for this). The Python code for this tool uses a lot of
`subprocess.statusoutput` which runs an single command string through the
shell. It turns out that placing special characters in various GUI fields can
lead to code execution as root. Examples:
fcontextPage.py: add(). In "File Labelling" click "+" for adding an entry, put
something like
'; touch /tmp/evil_file; ls '
into the "File Specification" field, /tmp/evil_file will be created.
similarly in loginsPage.py add/delete: goto UserMapping, click "+" for adding
a user, place something like
; touch /tmp/my_user; true
into the "Login Name" field, /tmp/my_user will come into existence.
While this is not an outright security issue, since the GUI can only be
started with root priviliges anyway, it is really bad style and, basically a
bug. There are a lot more uses of "statusoutput" which should all be replaced
by safe calls by subprocess calls that don't go through the shell.
I have split the audit of the -gui subpackage into a separate AUDIT-1 (bug 1215977), so that we can go ahead with the whitelisting of the -dbus package and unblock security:SELinux -> Factory submissions. |