Re: Re: Busybox on musl is affected by CVE-2015-1817

[u-wsnj@aetey.se]

Hi Harald,

On Wed, Apr 01, 2015 at 10:11:51AM +0200, Harald Becker wrote:
> There is a big difference if you talk about suid
> *root* programs or other suid usage.
> 
> The former is definitely very dangerous and should be used with extreme care
> (I think this is the case we are talking about), the later use may even be
> used to drop privileges (not to raise), or to temporarily hop to the

You are right about a remarkable difference between suid root and suid
somethingelse, just because root has the very special role in Unix.
Besides root vs non-root I doubt there is any clear line between "raising"
and "dropping" privileges, you replace one set of allowed operations by
a different one, that's it. Note that root does not need suid to drop
its privileges.

> privileges of a different user (may be allowing access to some files only by
> using specific commands).

As soon as a program is setuid it has to be written for the purpose
of very reliably checking and limiting what it does on behalf of who,
independently of how it can potentially be invoked "out of context".
This is known to be hard, I believe it is harder to do reliably than
e.g. issue a request to a daemon - talking about the complexity level.

Thus the setuid program is to be designed to be as small as possible,
presumably leaving all non-checking functions to (a) different
executable(s). Then the result becomes about as intricate as talking to
a daemon, which can be run without any setuid.

> When used with care and as intended, suid and sgid is a nice feature, but

Unfortunately I can not really appreciate its beauty which appears to hide
the complexity and/or move it to other parties (like the dynamic linker
or the software maintenance infrastructure). Yes it "looks simple and
efficient" but is it, really?

> nowadays there are too many Unix novices, who misunderstand or misuse this,
> punching big holes in every security concern.

Unfortunately even seasoned gurus easily create / fail to notice holes!
:(

Rune