<div dir="ltr"><br><div class="gmail_extra"><br><br><div class="gmail_quote">2013/2/26 Simon McVittie <span dir="ltr"><<a href="mailto:simon.mcvittie@collabora.co.uk" target="_blank">simon.mcvittie@collabora.co.uk</a>></span><br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div class="im">On 25/02/13 23:08, Krzysztof Konopko wrote:<br>
> The reason for that is that the system has a<br>
> requirement to assign UIDs and GIDs dynamically without modifying<br>
> /etc/passwd & friends. The other reason is that the libc implementation<br>
> we are constrained to (certain version of uClibc) doesn't support<br>
> alternative methods of user authentication (e. g. NSS [1]) nor D-Bus<br>
> supports PAM authentication.<br>
<br>
</div>To be honest this sounds like it would be better done with a patched<br>
libc, or if you can't do that, linking a "my_getpwent[_r]()" with<br>
libdbus and applying the minimal patch to make it use that instead. That<br>
would also be applicable to every other application that uses<br>
getpwent[_r]().<br></blockquote><div><br></div><div style>I was actually considering interposing original getpw*() functions in the dbus-daemon executable (patching libc in my case would be very hard for non-technical reasons) but I found /proc approach less invasive and less complicated. I still wanted some calls to getpw*() fail if the user/group cannot be found (e. g. parsing policies) and control which calls should lookup for credentials in /proc if PID is available.</div>
<div style><br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<br>
(See also Android's Bionic libc, whose getpwent is hard-coded to map a<br>
certain UID/GID range to synthesized users of the form 'app%d', if I<br>
remember correctly.)<br></blockquote><div><br></div><div style>Actually the system I work with has the idea of "dynamic" users inspired by Android. I just couldn't afford the full-blown "my own libc" implementation approach.</div>
<div style> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<br>
Rummaging in /proc for credentials is an interesting approach: if done<br>
incorrectly it can be a time of check/time of use vulnerability, but I<br>
think you've avoided that.<br></blockquote><div><br></div><div style>I've been considering tidying it up and making generic enough to potentially replace some getpw*() calls altogether as the latter ones are just an "implementation detail". In many cases all that D-Bus daemon cares about is the same what the kernel cares about: numbers (UIDs/GIDs).</div>
<div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<br>
The potential vulnerability is if you delay credentials lookups until<br>
messages are sent/received (which mainstream libdbus carefully doesn't<br>
do, but third-party LSM integration has sometimes done), a process can<br>
avoid the checks by becoming more privileged while keeping the same pid,<br>
by exec()ing a setuid binary. Exploit: send a message that you shouldn't<br>
be allowed to send, then immediately exec() a binary that *would* have<br>
been allowed to send it. You are now racing with the dbus-daemon. If<br>
dbus-daemon wins the race, the exploit doesn't work, but if you win the<br>
race, by the time it asks your credentials you've been replaced by a<br>
more privileged binary, and the message is wrongly accepted<br></blockquote><div><br></div><div style>Agree, possible at least in theory. Thankfully not possible with the mainstream libdbus as I understand the above correctly (credentials are checked when creating a new connection as far as I remember).</div>
<div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div class="HOEnZb"><div class="h5"><br>
S<br></div></div></blockquote><div><br></div><div style>Thanks for sharing your thoughts.</div><div style><br></div><div style>Kris</div><div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div class="HOEnZb"><div class="h5">
_______________________________________________<br>
dbus mailing list<br>
<a href="mailto:dbus@lists.freedesktop.org">dbus@lists.freedesktop.org</a><br>
<a href="http://lists.freedesktop.org/mailman/listinfo/dbus" target="_blank">http://lists.freedesktop.org/mailman/listinfo/dbus</a><br>
</div></div></blockquote></div><br></div></div>