Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

newsubgid: add deny_setgroups option to /etc/subgid #99

Open
wants to merge 5 commits into
base: master
Choose a base branch
from
Open

newsubgid: add deny_setgroups option to /etc/subgid #99

wants to merge 5 commits into from
+316 −48

Commits on Feb 19, 2018

  1. libmisc: list: update helpers 

    Add a free_list helper so that we can duplicate list to callers and
require them to do the freeing for us, as well as a comma_from_list
helper for the /etc/sub{uid,gid} writing functions. In addition, fix up
the duplication code to just ignore NULL lists rather than aborting (for
no good reason).

As an aside, we really should switch to sharing the list code from
somewhere else rather than maintaining a separate version within
shadow-utils...

Signed-off-by: Aleksa Sarai <[email protected]>
    @cyphar
    cyphar committed Feb 19, 2018
    Configuration menu
    Copy the full SHA
    fdfb3b9 View commit details
    Browse the repository at this point in the history

  2. lib: subordinateio: add options field to /etc/sub{uid,gid} 

    Add support for an optional options field in /etc/sub{uid,gid}. We treat
this like other optional fields in /etc/passwd -- by ignoring its
non-existence and providing some functions to access the options.

We need these in order to be able to have the "allow_setgroups" and
"deny_setgroups" options in /etc/sub{uid,gid}.

This also required making libmisc a dependency of libshadow, which in
turn required converting libmisc to a libtool library so that AutoMake
didn't complain. It appears this mostly doesn't change any aspect of the
build other than allowing us to use libmisc symbols in libshadow.

Signed-off-by: Aleksa Sarai <[email protected]>
    @cyphar
    cyphar committed Feb 19, 2018
    Configuration menu
    Copy the full SHA
    4a43149 View commit details
    Browse the repository at this point in the history

  3. src: new{uid,gid}map: add basic (noop) support for options 

    Add the most basic support for the new /etc/sub{uid,gid} options
possible (parse them and if any options are present then output an
error). We ignore empty-string options to avoid cases where an empty
field breaks things.

Signed-off-by: Aleksa Sarai <[email protected]>
    @cyphar
    cyphar committed Feb 19, 2018
    Configuration menu
    Copy the full SHA
    0d368da View commit details
    Browse the repository at this point in the history

  4. newgidmap: add deny_setgroups option to /etc/subgid 

    Add a new deny_setgroups (and corresponding allow_setgroups) option to
/etc/subgid. The purpose of this option is to extend the security
protections against CVE-2018-7169, so that even group mapping configured
in /etc/subgid by an administrator can still disable setgroups.

However, rather than the fairly lenient semantics for self-mapping, the
semantics of /etc/subgid are stronger. If a mapping is encountered where
"deny_setgroups" is set, then no other mapping can "undo" this
restriction. The reason for this is that "deny_setgroups" indicates that
(according to the administrator) the mapping is unsafe to allow
setgroups in, and adding more mappings will not change this fact.
"allow_setgroups" is the default, and setting it is a noop. The logic
used when applying setgroups policies is unchanged (only denies are
written, and we don't write anything if it's already denied).

Signed-off-by: Aleksa Sarai <[email protected]>
    @cyphar
    cyphar committed Feb 19, 2018
    Configuration menu
    Copy the full SHA
    b1a1af3 View commit details
    Browse the repository at this point in the history

  5. man: add documentation for new setgroups(2) semantics 

    Add documentation for allow_setgroups, deny_setgroups, the new option
format of /etc/sub{uid,gid}, and fix some errors in the groupmod(8) man
page that stopped it from building properly on my machine.

Signed-off-by: Aleksa Sarai <[email protected]>
    @cyphar
    cyphar committed Feb 19, 2018
    Configuration menu
    Copy the full SHA
    626af91 View commit details
    Browse the repository at this point in the history