From mboxrd@z Thu Jan 1 00:00:00 1970 X-Msuck: nntp://news.gmane.org/gmane.linux.lib.musl.general/14817 Path: news.gmane.org!.POSTED.blaine.gmane.org!not-for-mail From: Florian Weimer Newsgroups: gmane.linux.lib.musl.general Subject: Re: Re: posix_spawn Date: Wed, 16 Oct 2019 14:40:14 +0200 Message-ID: <87zhi050ep.fsf@oldenburg2.str.redhat.com> References: <20190930223632.GW9017@brightrain.aerifal.cx> <20191001022102.GA16318@brightrain.aerifal.cx> <20191001025543.GB16318@brightrain.aerifal.cx> <87pnjhvtch.fsf@oldenburg2.str.redhat.com> <20191001114246.GC16318@brightrain.aerifal.cx> Reply-To: musl@lists.openwall.com Mime-Version: 1.0 Content-Type: text/plain Injection-Info: blaine.gmane.org; posting-host="blaine.gmane.org:195.159.176.226"; logging-data="164462"; mail-complaints-to="usenet@blaine.gmane.org" User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/26.2 (gnu/linux) Cc: Joshua Hudson , musl@lists.openwall.com To: Rich Felker Original-X-From: musl-return-14833-gllmg-musl=m.gmane.org@lists.openwall.com Wed Oct 16 14:40:34 2019 Return-path: Envelope-to: gllmg-musl@m.gmane.org Original-Received: from mother.openwall.net ([195.42.179.200]) by blaine.gmane.org with smtp (Exim 4.89) (envelope-from ) id 1iKibQ-000gh7-RR for gllmg-musl@m.gmane.org; Wed, 16 Oct 2019 14:40:32 +0200 Original-Received: (qmail 27900 invoked by uid 550); 16 Oct 2019 12:40:30 -0000 Mailing-List: contact musl-help@lists.openwall.com; run by ezmlm Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-ID: Original-Received: (qmail 27882 invoked from network); 16 Oct 2019 12:40:29 -0000 In-Reply-To: <20191001114246.GC16318@brightrain.aerifal.cx> (Rich Felker's message of "Tue, 1 Oct 2019 07:42:46 -0400") X-Scanned-By: MIMEDefang 2.79 on 10.5.11.11 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.44]); Wed, 16 Oct 2019 12:40:17 +0000 (UTC) Xref: news.gmane.org gmane.linux.lib.musl.general:14817 Archived-At: * Rich Felker: > On Tue, Oct 01, 2019 at 09:05:18AM +0200, Florian Weimer wrote: >> * Rich Felker: >> >> > This is not safe and creates a false sense that something broken might >> > work. Moreover it's a vulnerability to use it this way. You have a >> > window where different tasks sharing VM space are executing with >> > different privilege levels, and thereby one is able to seize execution >> > of the other and achieve its privilege level. >> >> That's a non-sequitur. A shared address space does not necessarily mean >> that execution under one set of credentials will have unrestricted >> effects on executions under different credentials within the same >> address space. > > It does, but not necessarily in all circumstances. The case in which > is it dangerous is when one of the tasks is "dropping privileges" > before executing code that either intentionally (e.g. a login session, > script interpreter, etc. acting behalf of the new user) or > unintentionally (because the code after dropping privileges is not as > heavily scrutinized and has a vulnerability) lets the attacker execute > code they control. In that case, the now-attacker-controlled task can > perform operations on the VM space of the privileged task, e.g. using > mmap to replace the code it's executing with whatever it wants. I'm still not convinced, sorry. setuid to a lower-privileged user does not give that user access to the process. Linux has an independent flag for that, and if you want to grant that level of access to an existing process, you have to set it explicitly. Sharing address space is just a tiny aspect here. If the process contains secrets (and some people would consider just the load address such a secret, especially with forking server processes), exposing it to other users could be problematic, even if there is no address space sharing involved. I don't understand the focus on setuid, to be honest. In practice, there are things that are much more dangerous for privileged processes (such as chroot or even chdir, or just plain old open). I'm not arguing for the sake of it, your skepticism (or should I say objection) probably blocks acceptance of my glibc patches in this area. (I think you mentioned that on libc-alpha at one point at least.) Just to reiterate, my motivation comes from analyzing actual system call usage in existing file servers (Samba and nfs-ganesha). They use per-thread credentials (via direct system calls to change the effective IDs) and a per-thread current directory (via unshare (CLONE_FS)). So in a sense, all we can do at this point is harm reduction by providing documented interfaces which spell out their limitations. Thanks, Florian