Re: [PATCH/RFC 1/2] rpcproxyd

[Olaf Kirch <okir@suse.de>]

Hi Mike,

On Mon, Mar 14, 2005 at 12:34:58PM -0500, mike@waychison.com wrote:
> > 	For instance, I can connect to your service, and fork off
> > 	some setuid root application, with stderr connected to that
> > 	socket. Any error message the application prints will be arrive
> > 	with uid 0. If I manage to make that message appear valid to you,
> > 	your daemon will accept any future input unquestioned.
> >
> 
> Interesting attack, although I doubt the setuid program would be attaching
> an SCM_CREDENTIALS to it's stderr writes.  I'll fix it up to check
> credentials on all packets nevertheless.

The application doesn't have to pass them explicitly. They'll be
attached automatically by the kernel.

> > 	If you make it less generic, and allow only mount calls, you'll
> > 	be much safer, because in the case of a bug, an attacker will
> > 	be able to send fake MOUNT packets, but nothing else.
> >
> 
> Hmm.  I like the idea of keeping it generic as it may very well solve
> someone else's problem as well.   As for locking it down to MOUNT (and
> possibly PMAP/RPCB), how about some sort of config file that limits
> PROG/VERS tuples?

That works as well.

Olaf
-- 
Olaf Kirch   |  --- o --- Nous sommes du soleil we love when we play
okir@suse.de |    / | \   sol.dhoop.naytheet.ah kin.ir.samse.qurax


-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
http://ads.osdn.com/?ad_id=6595&alloc_id=14396&op=click
_______________________________________________
NFS maillist  -  NFS@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/nfs