From mboxrd@z Thu Jan 1 00:00:00 1970 X-Msuck: nntp://news.gmane.org/gmane.linux.lib.musl.general/425 Path: news.gmane.org!not-for-mail From: Rich Felker Newsgroups: gmane.linux.lib.musl.general Subject: Re: LD_PRELOAD and RTLD_NEXT support Date: Tue, 16 Aug 2011 08:59:17 -0400 Message-ID: <20110816125917.GP132@brightrain.aerifal.cx> References: <20110816051715.GN132@brightrain.aerifal.cx> <20110816063410.GA4254@albatros> <20110816114730.GO132@brightrain.aerifal.cx> <20110816124600.GA15681@albatros> Reply-To: musl@lists.openwall.com NNTP-Posting-Host: lo.gmane.org Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii X-Trace: dough.gmane.org 1313499620 19100 80.91.229.12 (16 Aug 2011 13:00:20 GMT) X-Complaints-To: usenet@dough.gmane.org NNTP-Posting-Date: Tue, 16 Aug 2011 13:00:20 +0000 (UTC) To: musl@lists.openwall.com Original-X-From: musl-return-426-gllmg-musl=m.gmane.org@lists.openwall.com Tue Aug 16 15:00:16 2011 Return-path: Envelope-to: gllmg-musl@lo.gmane.org Original-Received: from mother.openwall.net ([195.42.179.200]) by lo.gmane.org with smtp (Exim 4.69) (envelope-from ) id 1QtJFe-00075p-W0 for gllmg-musl@lo.gmane.org; Tue, 16 Aug 2011 15:00:15 +0200 Original-Received: (qmail 26568 invoked by uid 550); 16 Aug 2011 13:00:14 -0000 Mailing-List: contact musl-help@lists.openwall.com; run by ezmlm Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: Original-Received: (qmail 26556 invoked from network); 16 Aug 2011 13:00:14 -0000 Content-Disposition: inline In-Reply-To: <20110816124600.GA15681@albatros> User-Agent: Mutt/1.5.21 (2010-09-15) Xref: news.gmane.org gmane.linux.lib.musl.general:425 Archived-At: On Tue, Aug 16, 2011 at 04:46:00PM +0400, Vasiliy Kulikov wrote: > On Tue, Aug 16, 2011 at 07:47 -0400, Rich Felker wrote: > > > 1) This check should be extended to support AT_SECURE (dumpable flag, > > > any LSM security domains, capabilities). > > > > Indeed, I'll add this. Do I just check for aux[AT_SECURE] != 0? > > Looks like so. > > glibc has some crazy dance with these flags and get*id() values, which > we patch in Owl ;-) Well glibc tries to be clever and let you use LD_PRELOAD with suid as long as the library is in a "trusted" path and has the sgid bit set. To me this seems really misguided; the valid use cases are very few, and it seems impossible to predict all the future kernel "enhancements" that might create gaping holes in whatever method you use to validate... In my opinion, the only safe thing to do when running with elevated privileges is to completely ignore anything the user controls in the initial environment. > ....btw, I feel it would be cleaner if you check for untrusted environment > at the time of initializing env_* variables. Currently there is not > much code between env_X assignment and zeroing, but it might be in the > future (with addition of ld features, etc.). > > for (p = argv+i; ... ) { > if (is_secure_env) > env_path = ... Notice the problem is that this code is in the loop that's responsible for *finding* auxv. For now I've just moved the code closer together, but if you think it would help, I might first load the env vars into temp variables and switch the conditionals for secure mode, so that env_* would never get loaded in the suid/sgid/caps case. Rich