[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <53CE4169.5060900@debian.org>
Date: Tue, 22 Jul 2014 11:48:09 +0100
From: Simon McVittie <smcv@...ian.org>
To: oss-security@...ts.openwall.com
Subject: Re: Linux peer_cred Mischmasch
On 22/07/14 11:15, Sebastian Krahmer wrote:
> While maybe_add_creds() (via SOCK_PASSCRED) and scm_send()
> (via unix_{stream,dgram}_sendmsg()) use the real UID,
One possible justification for this disparity is that the privileged
processes for which there is any difference (ruid != euid, CAP_SETUID or
CAP_SYS_ADMIN) can manipulate their apparent identity in outgoing
SCM_CREDENTIALS messages, so they can choose which of their (potentially
many) possible identities to present to the peer...
> cred_to_ucred() (via SO_PEERCRED) passes the EUID (this time
> also kuid_munged()).
... whereas SO_PEERCRED just asks the kernel "who is at the other end?"
without any cooperation from the target process, so there is opportunity
for the target process to influence the result per-request, and the
kernel has to return "the" uid (even if there is in fact no such thing
as the process's single uid). The euid seems like as good a version of
"who the process is currently trying to be" as any other.
(I'm considering ruid != euid to be a form of privilege even if it has
no CAP_* capabilities, because it has the privilege "can arrange to do
anything that either ruid or euid can do", which in general is a
superset of the abilities of either ruid or euid individually.)
Silly analogy: SOCK_PASSCRED is the process presenting its passport at a
border. It knows the border is there, is in control of the passport it
presents, and if it is a spy with a pile of forged passports (privileged
process), or someone with dual citizenship and multiple equally valid
passports (ruid != euid), it can choose which one it hands over.
SO_PEERCRED is more like identifying the process from CCTV pictures: it
can pretend to be someone else by wearing a Mission-Impossible-style
mask, but it can only have one version of its face visible at a time :-)
S
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
