From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-wr1-f53.google.com (mail-wr1-f53.google.com [209.85.221.53]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C8F703346BE for ; Thu, 4 Dec 2025 09:32:15 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.221.53 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1764840737; cv=none; b=dkL25IS1StAqUV56CA0K3/aSex1HfJ68vfqVdSR4/f4MxWCkb00jnaNTHUrhpGixyXjYBEC3j0JbGniic+Mc8NNZdo/90tlR+LHs0W4iZ8qJo9m9Yqx8HM708YFXJFjRtiMqCbvuUcNFy3pEasCI5T3pA/TeP1ihFBjQlw2OExo= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1764840737; c=relaxed/simple; bh=7KDSP+eJnIgbODlTxSo2m0C89a6pRbVbkfcbCzde8G8=; h=Date:From:To:Cc:Subject:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=cFESXaIMrbYBZgLSsC/jnbI/tOThlugUJQW2nAEQwsm6krYx3BCFhuo81YU3x9/pZzWnnd9hGeQdbwdNT4SXKrpOeJ5LEpWO8gPLjkx9NE8jPScvLypzhqX7gCddWpp443Ysivxpc4omhokrtPi6LhIRmYcP2PyEKKjqO4bCbnQ= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=KiErZhOh; arc=none smtp.client-ip=209.85.221.53 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="KiErZhOh" Received: by mail-wr1-f53.google.com with SMTP id ffacd0b85a97d-42e2e6aa22fso326576f8f.2 for ; Thu, 04 Dec 2025 01:32:15 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1764840734; x=1765445534; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:subject:cc:to:from:date:from:to:cc:subject:date :message-id:reply-to; bh=P9pe+wJENeZc5IcOvHk937NmwKikq+O3BvHjwpbysZ0=; b=KiErZhOhZY8yDuUXrrd4zP5DgXNsChXXR8AEJ5y0LV2jtZM2sJ+GgXZxIHDSLJ8kqv t44/5lQBDSqO1nzX1gXjajizaf9DBRiBc4XkHgIgKH+Xja0RyniP3P61D8gVRTSiLt+6 8Z7/WeZqNU2wuaBxW/cUiUScO/UwTSuwzGMNpQLEUMcdAXzEv35UUekmSeJHLB9V+jKt fowJSb/fb0YCwM8/cTvus4tpzgzrIs3NCZix7EnxiyB75sW/tZGp5Dbg3c/WKf2g6LMs RLWLTfrZMikaP1W1EOHIRYkvwupCRhiBZrQhZ4toQBCEr2kiXWIwNNcI8e0F0dSNEuqr RQkw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1764840734; x=1765445534; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:subject:cc:to:from:date:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=P9pe+wJENeZc5IcOvHk937NmwKikq+O3BvHjwpbysZ0=; b=HIQJtagbC7o5l0fTXebDgYFTaXDaFh3n1hB74KfbVcGv+gbHD8JtqdRyE2vQXo9L3O aG2YRFsmtDZTIsmFi9iLwz/Z9HhyD+mGegOAADQ2KvsPRm7NeCdJKctdKwBz7yR7vRro Mw0b4gxZvmx/2xaTJj6ZHRFfWp2Xu8Rbot43Qnny2GGogaFOilMkVfvZ/T7cw5uyKR/r +Df1R28wjRNiijg671piYaL3UWjlO4w3pGcmvgswuXtvT4Iqp+XzUpu4WK2/xHtSOMqm ixW1QCsqicaPaj8iGNeb1Nj0Ah0l6r5cBxO5TtHC7eWp343hxqfd6yAUi6nXJMBr7EmE fB1g== X-Forwarded-Encrypted: i=1; AJvYcCUSVSLPVwziSRBPKUDBmbJjoY0MYkCrcgAtbvWx+of/OGAxQf3H4VpH0BgdPQh/wXaoN18ZDQoi4TQuwrIajlyg/mX7DbA=@vger.kernel.org X-Gm-Message-State: AOJu0YybGg4La2n+tCZCzUkftFBbe3se9N2WGKsGHbq5fwMrv9PwB9k4 MNSWOBl6P3sG3BxmCKBPJEPN1H42fR7PVGbACjWm+PrXunYtnRbsiahk X-Gm-Gg: ASbGnctjP5y65jUbdYM5DPHejawqhiEOXF1q6B3LlH3QB71Ub8B/JZJNeNavJl5cozN Yaxvjbff4GomgFYtsvByip1o/1nOY/24xDaXNzzUG9nbZPE8TPPsYVzlDcgV4kL9GQwfnO1ywAA 9w7+GjH2GJARFd/1++xFcP+KnHX/8LR/qqmpW6YbF6SOnDGKjpS8axgaIDXYpUC4cGlqm7glwkD lmTVTrXpn53344h/ZR2dtNVvFkop1tNG4L7wLitCAfJ+M/ddP5MEPLixI3RJfxK7ekVyczW1aL4 OH2iUPdgyvbHc57bXY2k0Du4w/QthdFcUrzizr7ZMqJvym8EtRYIK7QP2uXZthME5ekKtAJKS94 22D2YYrgOrfiP8poZWPnue3zveaPVQq2WpasFPVc6adn7C5aUWPg7zpi7F9B710B7Gu5/79yLXF 2eFe4V2wTKBrl0yiiN9Bm3yRe8TO7PaLYDomivtqsXdogyc8RgvK+d X-Google-Smtp-Source: AGHT+IEpeLb5DzDFyyRRjLJBycEA8/oon798RLVjm4cwDE2uj2+226ExQ98mf5m0TZ5rx0eulXU/Nw== X-Received: by 2002:a05:6000:2dc4:b0:429:d725:4125 with SMTP id ffacd0b85a97d-42f7987519fmr2415263f8f.54.1764840733805; Thu, 04 Dec 2025 01:32:13 -0800 (PST) Received: from pumpkin (82-69-66-36.dsl.in-addr.zen.co.uk. [82.69.66.36]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-42f7d2226e7sm2182928f8f.27.2025.12.04.01.32.10 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 04 Dec 2025 01:32:12 -0800 (PST) Date: Thu, 4 Dec 2025 09:32:09 +0000 From: David Laight To: Al Viro Cc: Bernd Edlinger , "Eric W. Biederman" , Roberto Sassu , Alexey Dobriyan , Oleg Nesterov , Kees Cook , Andy Lutomirski , Will Drewry , Christian Brauner , Andrew Morton , Michal Hocko , Serge Hallyn , James Morris , Randy Dunlap , Suren Baghdasaryan , Yafang Shao , Helge Deller , Adrian Reber , Thomas Gleixner , Jens Axboe , Alexei Starovoitov , "linux-fsdevel@vger.kernel.org" , "linux-kernel@vger.kernel.org" , linux-kselftest@vger.kernel.org, linux-mm@kvack.org, linux-security-module@vger.kernel.org, tiozhang , Luis Chamberlain , "Paulo Alcantara (SUSE)" , Sergey Senozhatsky , Frederic Weisbecker , YueHaibing , Paul Moore , Aleksa Sarai , Stefan Roesch , Chao Yu , xu xin , Jeff Layton , Jan Kara , David Hildenbrand , Dave Chinner , Shuah Khan , Elena Reshetova , David Windsor , Mateusz Guzik , Ard Biesheuvel , "Joel Fernandes (Google)" , "Matthew Wilcox (Oracle)" , Hans Liljestrand , Penglei Jiang , Lorenzo Stoakes , Adrian Ratiu , Ingo Molnar , "Peter Zijlstra (Intel)" , Cyrill Gorcunov , Eric Dumazet , zohar@linux.ibm.com, linux-integrity@vger.kernel.org, Ryan Lee , apparmor Subject: Re: Are setuid shell scripts safe? (Implied by security_bprm_creds_for_exec) Message-ID: <20251204093209.706f30a6@pumpkin> In-Reply-To: <20251204054915.GI1712166@ZenIV> References: <87tsyozqdu.fsf@email.froward.int.ebiederm.org> <87wm3ky5n9.fsf@email.froward.int.ebiederm.org> <87h5uoxw06.fsf_-_@email.froward.int.ebiederm.org> <6dc556a0a93c18fffec71322bf97441c74b3134e.camel@huaweicloud.com> <87v7iqtcev.fsf_-_@email.froward.int.ebiederm.org> <87ms42rq3t.fsf@email.froward.int.ebiederm.org> <20251204054915.GI1712166@ZenIV> X-Mailer: Claws Mail 4.1.1 (GTK 3.24.38; arm-unknown-linux-gnueabihf) Precedence: bulk X-Mailing-List: linux-security-module@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit On Thu, 4 Dec 2025 05:49:15 +0000 Al Viro wrote: > On Wed, Dec 03, 2025 at 02:16:29PM +0100, Bernd Edlinger wrote: > > > Hmm, yes, that looks like an issue. > > > > I would have expected the security engine to look at bprm->filenanme > > especially in the case, when bprm->interp != bprm->filename, > > and check that it is not a sym-link with write-access for the > > current user and of course also that the bprm->file is not a regular file > > which is writable by the current user, if that is the case I would have expected > > the secuity engine to enforce non-new-privs on a SUID executable somehow. > > Check that _what_ is not a symlink? And while we are at it, what do write > permissions to any symlinks have to do with anything whatsoever? > You'd need to check for write permissions to all the directories in the full path of the symlink and in all the directories traversed by the symlink. (and that may not be enough....) Passing the shell (or whatever) /dev/fd/n doesn't seem (to me) any different from what happens when the elf interpreter runs a suid program. You might want to check for non-owner write permissions to the /dev/fd/n entry, but that is true for any suid executable, not just scripts. FWIW the SYSV shells normally set the effective uid back the real uid. So making a script suid didn't work unless the script started "#!/bin/sh -p". Whether that improved security (rather than being annoying) is another matter. David