oss-security - Gentoo: order of installed packages may result in vary directories permissions, leading to crontab not requiring cron group membership as example.

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <8bd5339f-080c-310d-9a68-3f91f725b3f7@gmail.com>
Date: Fri, 27 Jan 2017 22:59:47 +0100
From: KARBOWSKI Piotr <piotr.karbowski@...il.com>
To: oss-security@...ts.openwall.com
Cc: security-audit@...too.org
Subject: Gentoo: order of installed packages may result in vary directories
 permissions, leading to crontab not requiring cron group membership as
 example.

Hi,

The packages in Gentoo often utilizes Portage's functions like keepdir 
to create a directories, with specified permissions. One of the examples 
is 'cronbase', which the only purpose is to setup 
/etc/cron.{hourly,daily,weekly,monthly} and /var/spool/cron.

The /var/spool/cron is meant to have root:cron 750, which makes the 
crontab usable only for the users that are members of cron group.

As for the /etc/cron.{hourly,daily,weekly,monthly} they're meant to be 
root:root 750.

If, for instance, a mlocate package will be installed before cronbase, 
due to installing /etc/cron.daily/mlocate, the /etc/cron.daily will end 
up with 755 permissions. After than when crontab package is installed, 
due to usage of portage's keepdir function, the directory in temporary 
directory will be installed as root:cron 750, but during the merge 
process to rootfs no directory permissions will be merged, leaving the 
/etc/cron.daily as 755.

On one system after installing set of packages, the /var/spool/cron 
ended up being cron:root 755, which results in possibility for any local 
user to actually create the crontabs (including system users like nginx, 
mysql, and so on).

The way a (directory) ownership and permissions are handled in Gentoo 
seems to be flawed, it's not clear to me whatever Portage should 
provided a soluton to that, or the ebuilds authors should make sure to 
always depends, in case of touching cronbase directories, on the 
cronbase package, to ensure that it's installed prior to installing 
them. Nonetheless I do believe this issue is worth CVE.

-- Piotr.

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.