From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.4 (2020-01-24) on inbox.vuxu.org X-Spam-Level: X-Spam-Status: No, score=-3.1 required=5.0 tests=HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,RCVD_IN_DNSWL_MED,RCVD_IN_MSPIKE_H4, RCVD_IN_MSPIKE_WL,T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.4 Received: from second.openwall.net (second.openwall.net [193.110.157.125]) by inbox.vuxu.org (Postfix) with SMTP id ED2252121C for ; Mon, 11 Mar 2024 20:47:50 +0100 (CET) Received: (qmail 3190 invoked by uid 550); 11 Mar 2024 19:43:40 -0000 Mailing-List: contact musl-help@lists.openwall.com; run by ezmlm Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-ID: Reply-To: musl@lists.openwall.com Received: (qmail 3164 invoked from network); 11 Mar 2024 19:43:40 -0000 Date: Mon, 11 Mar 2024 15:47:56 -0400 From: Rich Felker To: "Skyler Ferrante (RIT Student)" Cc: Andreas Schwab , Alejandro Colomar , Thorsten Glaser , musl@lists.openwall.com, NRK , Guillem Jover , libc-alpha@sourceware.org, libbsd@lists.freedesktop.org, "Serge E. Hallyn" , Iker Pedrosa , Christian Brauner Message-ID: <20240311194756.GY4163@brightrain.aerifal.cx> References: <20240310193956.GU4163@brightrain.aerifal.cx> <20240310234410.GW4163@brightrain.aerifal.cx> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.21 (2010-09-15) Subject: Re: [musl] Re: Tweaking the program name for functions On Mon, Mar 11, 2024 at 11:30:04AM -0400, Skyler Ferrante (RIT Student) wrote: > Hmm, maybe I'm missing something, but it seems you can close(fd) for > the standard fds and then call execve, and the new process image will > have no fd 0,1,2. I've tried this on a default Ubuntu 22.04 system. > This seems to affect shadow-utils and other setuid/setgid binaries. > > Here is a repo I built for testing, > https://github.com/skyler-ferrante/fd_omission/. What is the correct > glibc behavior? Am I misunderstanding something? As Florian noted, you're missing that strace cannot invoke it suid. POSIX explicitly permits the implementation to open these fds if they started closed in suid execs, and IIRC indicates as a future direction that it might be permitted for all execs. We do the same in musl in the suid case. So really the only way that "writing attacker controlled prefix strings to fd 2" becomes an issue is if the application erroneously closes fd 2 and lets something else get opened on it. (Aside: making _FORTIFY_SOURCE>1 trap close(n) with n<3 would be an interesting idea... :) Rich