From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-wr1-f46.google.com (mail-wr1-f46.google.com [209.85.221.46]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C3DCB308F19 for ; Thu, 4 Dec 2025 09:32:15 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.221.46 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1764840737; cv=none; b=InktB9Kvso1xSgg7TX23Bj5Kc+vlKNrDCn6kiqI0aIlHzSti9TgXLof12/OPL8mMxgoyISCRpt1CuBdEgbc3J+Y9Kr2b6yaLPOewJQZO2aZIK/n7Gn6OP3ujPVsXC3eqQmA5tjxPclS6brLWlXc/6yoH8AXthEdyQbXnt+CqOQA= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1764840737; c=relaxed/simple; bh=7KDSP+eJnIgbODlTxSo2m0C89a6pRbVbkfcbCzde8G8=; h=Date:From:To:Cc:Subject:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=cFESXaIMrbYBZgLSsC/jnbI/tOThlugUJQW2nAEQwsm6krYx3BCFhuo81YU3x9/pZzWnnd9hGeQdbwdNT4SXKrpOeJ5LEpWO8gPLjkx9NE8jPScvLypzhqX7gCddWpp443Ysivxpc4omhokrtPi6LhIRmYcP2PyEKKjqO4bCbnQ= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=KiErZhOh; arc=none smtp.client-ip=209.85.221.46 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="KiErZhOh" Received: by mail-wr1-f46.google.com with SMTP id ffacd0b85a97d-42e2e628f8aso302099f8f.1 for ; Thu, 04 Dec 2025 01:32:15 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1764840734; x=1765445534; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:subject:cc:to:from:date:from:to:cc:subject:date :message-id:reply-to; bh=P9pe+wJENeZc5IcOvHk937NmwKikq+O3BvHjwpbysZ0=; b=KiErZhOhZY8yDuUXrrd4zP5DgXNsChXXR8AEJ5y0LV2jtZM2sJ+GgXZxIHDSLJ8kqv t44/5lQBDSqO1nzX1gXjajizaf9DBRiBc4XkHgIgKH+Xja0RyniP3P61D8gVRTSiLt+6 8Z7/WeZqNU2wuaBxW/cUiUScO/UwTSuwzGMNpQLEUMcdAXzEv35UUekmSeJHLB9V+jKt fowJSb/fb0YCwM8/cTvus4tpzgzrIs3NCZix7EnxiyB75sW/tZGp5Dbg3c/WKf2g6LMs RLWLTfrZMikaP1W1EOHIRYkvwupCRhiBZrQhZ4toQBCEr2kiXWIwNNcI8e0F0dSNEuqr RQkw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1764840734; x=1765445534; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:subject:cc:to:from:date:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=P9pe+wJENeZc5IcOvHk937NmwKikq+O3BvHjwpbysZ0=; b=c1YYwzaNVbKgeIsio552OZ+vdfkGjfzJnm/56d3yLkxfJ5F49qedfNwwAtTSqYHFep 76j8QKdlkdoRr2RgIhcut/x9TsMFLj8L5LGZkZKYB0d0i1p23nwO4Dskk++R5rKk5LYJ pGJq1UJDiJzGQHF2Q3jHqzNUMP/qtkIyQx6bofErW48of/FdqlbxkU3Y3zyWvk3f7EAC Kc9dSbCrMkJ4jdtVaBek7zoe/3ZuLorpdQQT1FcwJ0EhMQsOFZTifTdzHB/ARWTfiIqU t0zpGQLjTLIUagHa2yLrTKJ5PwBAs0NIfuwPejypXHuEUxo+JO41zDwXOH0/dF5Xw2wc QIFg== X-Forwarded-Encrypted: i=1; AJvYcCWwOXhqix1Y3pqrYvAfxN45UaQ+CjrwGOcRYKMmtwj/sBbFuQBWiwf62p4iAFyvc8r5+ETKV3n+tth+sVlZ@vger.kernel.org X-Gm-Message-State: AOJu0YyvGklFCkrmUTrlxEAfK+zM3h3mEC2wlhp3iLhayXAtK8NpdV35 VgCy6G/C4c84PYiJJO4/Wmn/oHBSaoRtWmNtE6pM8BAonGLJhBtslvvG X-Gm-Gg: ASbGncuYd7GPDCMhDVkxu6OvckTR8O9PiSLfbtuWdzO20eT3OcVcuy1lY6M0+epQRRe tAr4hP4Rj6FjdPmnmAmtkyvUH7MGIXcvOnEVAF8Cns6ISiWhELcwVSTWCjVnxGQTZLPqF16ZyF6 Ds2ebdCFkgL8LmppJTWLicKPr16aO5DTQJaDtUHg0YnsMRXwbFpmPBfHOGownNlkhC9/2esIPrR Jo/zSq0Divi+pEtJVokcUJjTnk88RmZLH/lhX/yjNSrBEnMJjF+Oj+R96YDLMAw0eWkmWHxkFun BcN9FG+CElJs8A1GUVVwyNL8NvuInekC5aNYvN4DXTE1LOjU5eESrwfL+rtz39rwe/QAqyak8mr 4DaFrPmjvK11IuozoITwZiL2IBSQHf5M0I582m3+I20C0D+B6OflzrCJJ5v8nwglOh9UeDAuIaA PUvri6lPY5Simz/I//D/yRKP8tNARJD6wk/OniBzueb8M0zt9Vdncs X-Google-Smtp-Source: AGHT+IEpeLb5DzDFyyRRjLJBycEA8/oon798RLVjm4cwDE2uj2+226ExQ98mf5m0TZ5rx0eulXU/Nw== X-Received: by 2002:a05:6000:2dc4:b0:429:d725:4125 with SMTP id ffacd0b85a97d-42f7987519fmr2415263f8f.54.1764840733805; Thu, 04 Dec 2025 01:32:13 -0800 (PST) Received: from pumpkin (82-69-66-36.dsl.in-addr.zen.co.uk. [82.69.66.36]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-42f7d2226e7sm2182928f8f.27.2025.12.04.01.32.10 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 04 Dec 2025 01:32:12 -0800 (PST) Date: Thu, 4 Dec 2025 09:32:09 +0000 From: David Laight To: Al Viro Cc: Bernd Edlinger , "Eric W. Biederman" , Roberto Sassu , Alexey Dobriyan , Oleg Nesterov , Kees Cook , Andy Lutomirski , Will Drewry , Christian Brauner , Andrew Morton , Michal Hocko , Serge Hallyn , James Morris , Randy Dunlap , Suren Baghdasaryan , Yafang Shao , Helge Deller , Adrian Reber , Thomas Gleixner , Jens Axboe , Alexei Starovoitov , "linux-fsdevel@vger.kernel.org" , "linux-kernel@vger.kernel.org" , linux-kselftest@vger.kernel.org, linux-mm@kvack.org, linux-security-module@vger.kernel.org, tiozhang , Luis Chamberlain , "Paulo Alcantara (SUSE)" , Sergey Senozhatsky , Frederic Weisbecker , YueHaibing , Paul Moore , Aleksa Sarai , Stefan Roesch , Chao Yu , xu xin , Jeff Layton , Jan Kara , David Hildenbrand , Dave Chinner , Shuah Khan , Elena Reshetova , David Windsor , Mateusz Guzik , Ard Biesheuvel , "Joel Fernandes (Google)" , "Matthew Wilcox (Oracle)" , Hans Liljestrand , Penglei Jiang , Lorenzo Stoakes , Adrian Ratiu , Ingo Molnar , "Peter Zijlstra (Intel)" , Cyrill Gorcunov , Eric Dumazet , zohar@linux.ibm.com, linux-integrity@vger.kernel.org, Ryan Lee , apparmor Subject: Re: Are setuid shell scripts safe? (Implied by security_bprm_creds_for_exec) Message-ID: <20251204093209.706f30a6@pumpkin> In-Reply-To: <20251204054915.GI1712166@ZenIV> References: <87tsyozqdu.fsf@email.froward.int.ebiederm.org> <87wm3ky5n9.fsf@email.froward.int.ebiederm.org> <87h5uoxw06.fsf_-_@email.froward.int.ebiederm.org> <6dc556a0a93c18fffec71322bf97441c74b3134e.camel@huaweicloud.com> <87v7iqtcev.fsf_-_@email.froward.int.ebiederm.org> <87ms42rq3t.fsf@email.froward.int.ebiederm.org> <20251204054915.GI1712166@ZenIV> X-Mailer: Claws Mail 4.1.1 (GTK 3.24.38; arm-unknown-linux-gnueabihf) Precedence: bulk X-Mailing-List: linux-fsdevel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit On Thu, 4 Dec 2025 05:49:15 +0000 Al Viro wrote: > On Wed, Dec 03, 2025 at 02:16:29PM +0100, Bernd Edlinger wrote: > > > Hmm, yes, that looks like an issue. > > > > I would have expected the security engine to look at bprm->filenanme > > especially in the case, when bprm->interp != bprm->filename, > > and check that it is not a sym-link with write-access for the > > current user and of course also that the bprm->file is not a regular file > > which is writable by the current user, if that is the case I would have expected > > the secuity engine to enforce non-new-privs on a SUID executable somehow. > > Check that _what_ is not a symlink? And while we are at it, what do write > permissions to any symlinks have to do with anything whatsoever? > You'd need to check for write permissions to all the directories in the full path of the symlink and in all the directories traversed by the symlink. (and that may not be enough....) Passing the shell (or whatever) /dev/fd/n doesn't seem (to me) any different from what happens when the elf interpreter runs a suid program. You might want to check for non-owner write permissions to the /dev/fd/n entry, but that is true for any suid executable, not just scripts. FWIW the SYSV shells normally set the effective uid back the real uid. So making a script suid didn't work unless the script started "#!/bin/sh -p". Whether that improved security (rather than being annoying) is another matter. David