Bugzilla – Bug 1197463
AUDIT-FIND: CVE-2022-27814: swhkd: The `-c` Daemon Command Line Parameter Allows for Arbitrary File Existence Tests
Last modified: 2022-04-14 08:53:35 UTC
+++ This bug was initially created as a clone of Bug #1196890 This is to track parent bug issues 2.b): ## 2.b) The `-c` Daemon Command Line Parameter Allows for Arbitrary File Existence Tests Example: $ pkexec /usr/bin/swhkd -d -c /root/.somefile [2022-03-22T12:32:25Z ERROR swhkd] "/root/.somefile" doesn't exist $ pkexec /usr/bin/swhkd -d -c /root/.bash_history [...] (daemon starts "normal" operation) Suggested Fix: ## 3.b) The Privileged Daemon needs to Drop Privileges to the User
Hi, the following CVE has been fixed by Angelo from my team in the following patch: https://github.com/waycrate/swhkd/pull/102/files Your insights on the patch will be very helpful.
Updated patch link: https://github.com/waycrate/swhkd/pull/105/files.
(In reply to aakashsensharma@gmail.com from comment #2) > Updated patch link: https://github.com/waycrate/swhkd/pull/105/files. Hmm, I don't see the reason why you are changing this to "cat" now. As I suggested, dropping privileges to the invoking user will fix this, not changing the way the file content is obtained. You basically need to go the same route as in bug 1197468.
https://github.com/waycrate/swhkd/pull/102 The following conversation might shed some light. For some reason which I cannot diagnose yet, the effective uid is not taken into consideration by File::open() I tried it both in config.rs file and in the main file and it just did not work for now we're using cat as a hacky workaround but we'll make sure we get to the bottom of the uid issue.
(In reply to aakashsensharma@gmail.com from comment #4) > https://github.com/waycrate/swhkd/pull/102 The following conversation might shed some light. > > For some reason which I cannot diagnose yet, the effective uid is not taken into consideration by File::open() > > I tried it both in config.rs file and in the main file and it just did not work > > for now we're using cat as a hacky workaround but we'll make sure we get to the bottom of the uid issue. You shouldn't "fix" security issues if you don't exactly know what is going on. You have to get to the bottom of this. I commented in the PR# about a likely cause of this behaviour. Probably you are not completely dropping root privileges.
I read the pr comment. Going through the documentation of unistd to find the optimal way to get the gid of a user from uid.