Re: Fixing su + runuser vulnerability CVE-2016-2779

[Stanislav Brabec <sbrabec@suse.cz>]

On Mar 5, 2016 at 00:50 Ángel González wrote:
> I was thinking about this and the problem is actually that runuser
> returns (and control is returned to the privileged parent) while there's
> an unprivileged descendant with a handle to the tty.
> Thus, it seems that it could be solved by having runuser run the child
> into a new cgroup and refusing to return while there's any remaining
> process there.

In general, it is a good idea.

But from compatibility aspect, it is a bad idea to change it to the 
default behavior. Imagine all those poorly written legacy helpers that 
run daemons without proper disconnecting from the terminal. All those 
will be stalled.

I can imagine new --term-wait option, eventually --term-kill. But I am 
not sure, whether it is no over-complicated.

> Although depending on the exact way that people is expecting to use job
> control, that might still interefere despite not changing the session
> leader. Do we know actual usages that should continue working?
>
There is not exact list what will will break.

But imagine that many users use daily things like simple example below. 
(In a real life, you will not want to run sleep, but something more 
sophisticated (e. g. build process inside chroot that needs sudo).)

# sudo -u nobody sleep 10 &
[1] 28327
~ # fg
sudo -u nobody sleep 10
^Z
[1]+  Stopped                 sudo -u nobody sleep 10
~ # bg
[1]+ sudo -u nobody sleep 10 &
~ #
~ #
[1]+  Done                    sudo -u nobody sleep 10
~ #

It will be not possible any more with setsid().

You will get:
# sudo -u nobody sleep 10 &
[1] 28390
~ # fg
sudo -u nobody sleep 10
^Z^Z^Z^Z^Z^Z^Z^Z

You are stuck, ^Z does not work, and you cannot switch the task back to 
background. You can only press ^C.

Exactly the same will affect
runuser --command "sleep 10"

Additionally, both su and runuser already offer two variants. You can 
test the difference yourself:

Without job control:
su nobody --command "sleep 10" &
vs.
With job control:
su nobody --session-command "sleep 10" &

After calling it, type:
fg
and then Control-Z.

-- 
Best Regards / S pozdravem,

Stanislav Brabec
software developer
---------------------------------------------------------------------
SUSE LINUX, s. r. o.                         e-mail: sbrabec@suse.com
Lihovarská 1060/12                            tel: +49 911 7405384547
190 00 Praha 9                                 fax:  +420 284 084 001
Czech Republic                                    http://www.suse.cz/
PGP: 830B 40D5 9E05 35D8 5E27 6FA3 717C 209F A04F CD76