From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mailman by lists.gnu.org with archive (Exim 4.43) id 1MkJUs-0002zj-MQ for mharc-grub-devel@gnu.org; Sun, 06 Sep 2009 11:17:42 -0400 Received: from mailman by lists.gnu.org with tmda-scanned (Exim 4.43) id 1MkJUr-0002zP-Kz for grub-devel@gnu.org; Sun, 06 Sep 2009 11:17:41 -0400 Received: from exim by lists.gnu.org with spam-scanned (Exim 4.43) id 1MkJUm-0002xI-OU for grub-devel@gnu.org; Sun, 06 Sep 2009 11:17:40 -0400 Received: from [199.232.76.173] (port=49073 helo=monty-python.gnu.org) by lists.gnu.org with esmtp (Exim 4.43) id 1MkJUm-0002xD-II for grub-devel@gnu.org; Sun, 06 Sep 2009 11:17:36 -0400 Received: from moutng.kundenserver.de ([212.227.126.186]:59552) by monty-python.gnu.org with esmtp (Exim 4.60) (envelope-from ) id 1MkJUm-0004ia-0k for grub-devel@gnu.org; Sun, 06 Sep 2009 11:17:36 -0400 Received: from [85.180.47.88] (e180047088.adsl.alicedsl.de [85.180.47.88]) by mrelayeu.kundenserver.de (node=mreu1) with ESMTP (Nemesis) id 0MKv1o-1MkJUl0Vzy-000GxN; Sun, 06 Sep 2009 17:17:35 +0200 From: Felix Zielcke To: The development of GRUB 2 In-Reply-To: <20090906150921.GE3548@thorin> References: <1252240143.3895.18.camel@fz.local> <20090906133818.GI13423@riva.ucam.org> <1252244626.3895.52.camel@fz.local> <20090906135742.GJ13423@riva.ucam.org> <1252249120.3895.53.camel@fz.local> <20090906150921.GE3548@thorin> Content-Type: multipart/mixed; boundary="=-eN99l7QLo97p4Hb5pqck" Date: Sun, 06 Sep 2009 17:17:34 +0200 Message-Id: <1252250254.3895.56.camel@fz.local> Mime-Version: 1.0 X-Mailer: Evolution 2.27.91 X-Provags-ID: V01U2FsdGVkX1+3tNPJYjtm5qY0/WsbgbnmZVIP7u4wxdfemLm 1PeR4vD1XcBDe1dtxMx6i/3EwxFRs9MyNxTaWJgIsBXQl3J/mU Ktz/HS3nS2VXs3oPg5Upg== X-detected-operating-system: by monty-python.gnu.org: Genre and OS details not recognized. Subject: Re: chmod of generated grub.cfg X-BeenThere: grub-devel@gnu.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: The development of GRUB 2 List-Id: The development of GRUB 2 List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 06 Sep 2009 15:17:41 -0000 --=-eN99l7QLo97p4Hb5pqck Content-Type: text/plain Content-Transfer-Encoding: 7bit Am Sonntag, den 06.09.2009, 17:09 +0200 schrieb Robert Millan: > On Sun, Sep 06, 2009 at 04:58:40PM +0200, Felix Zielcke wrote: > > > > Ok here's now a patch. > > Robert do you think this can go into 1.97? > > For 1.97 I'd be more comfortable with a simple s/444/400/. An automated check > smells like it could have corner cases. In fact I found one: > > > @@ -260,6 +260,11 @@ for i in ${grub_mkconfig_dir}/* ; do > > esac > > done > > > > +if [ "x${grub_cfg}" != "x" ] && grep -q "^password " ${grub_cfg}.new ; then > > + chmod 400 ${grub_cfg}.new || grub_warn "Could not make ${grub_cfg}.new readable by only root.\ > > + This means your password is readable by everyone" > > +fi > > There's a short time window in which /boot/grub/grub.cfg.new exists, has been > fully generated, and its mode is 444 rather than 400. An attacker could poll > this file and with some luck extract a password from it. > Oh right. So how about this? -- Felix Zielcke Proud Debian Maintainer --=-eN99l7QLo97p4Hb5pqck Content-Disposition: attachment; filename="chmod.diff.2" Content-Type: text/plain; name="chmod.diff.2"; charset="UTF-8" Content-Transfer-Encoding: 7bit 2009-09-06 Felix Zielcke * util/grub-mkconfig.in: Make the temporary created config mode 400 and print a warning if it fails. Change mode to 444 if it does not contain a plaintext password. Index: util/grub-mkconfig.in =================================================================== --- util/grub-mkconfig.in (revision 2574) +++ util/grub-mkconfig.in (working copy) @@ -232,7 +232,8 @@ if test "x${grub_cfg}" != "x"; then # Allow this to fail, since /boot/grub/ might need to be fatfs to support some # firmware implementations (e.g. OFW or EFI). - chmod 444 ${grub_cfg}.new || true + chmod 400 ${grub_cfg}.new || grub_warn "Could not make ${grub_cfg}.new readable by only root.\ + This means that if the generated config contains a password it is readable by everyone" fi echo "Generating grub.cfg ..." >&2 @@ -260,6 +261,10 @@ for i in ${grub_mkconfig_dir}/* ; do esac done +if [ "x${grub_cfg}" != "x" ] && ! grep -q "^password " ${grub_cfg}.new ; then + chmod 444 ${grub_cfg}.new || true +fi + if test "x${grub_cfg}" != "x" ; then # none of the children aborted with error, install the new grub.cfg mv -f ${grub_cfg}.new ${grub_cfg} --=-eN99l7QLo97p4Hb5pqck--