init scripts and su
Russell Coker
russell at coker.com.au
Mon Jul 26 04:06:02 UTC 2004
For Postgresql there is a minor security issue.
The start scripts do "su - postgres" to launch the daemon, this is to run the
~/.bash_profile file to get settings for the database.
The problem with this is that such scripts are writable by the postgres user
and thus the postgres user can cause their own program to run which can stuff
key-presses into the input buffer of the controlling terminal, this
controlling terminal is in many instances (*) the terminal of an
administrative shell, and commands such as "chmod 666 /etc/shadow" could be
executed.
To solve this I have written a program named init_su to provide the necessary
functionality from su(1) without the terminal issue.
init_su closes all file handles other than 1 and 2 (stdout and stderr). File
handles 1 and 2 are fstat()'d, if they are regular files or pipes then they
are left open (no attack is possible through a file or pipe), otherwise they
are closed and /dev/null is opened instead. /dev/null is opened for file
handle 0 regardless of what it might have pointed to previously. Then
setsid() is called to create a new session for the process (make it a group
leader), this invalidates /dev/tty. Then the uid is changed and the daemon
is started.
I have attached the source code to init_su, please check it out and tell me
what you think.
Also this solves a minor problem with the SE Linux patched su and sudo not
doing quite what we want for daemon startup.
(*) On system boot and shutdown there is no problem. It's when the
administrator uses /etc/init.d/postgresql to start or stop the database that
there is potential for attack.
--
http://www.coker.com.au/selinux/ My NSA Security Enhanced Linux packages
http://www.coker.com.au/bonnie++/ Bonnie++ hard drive benchmark
http://www.coker.com.au/postal/ Postal SMTP/POP benchmark
http://www.coker.com.au/~russell/ My home page
-------------- next part --------------
A non-text attachment was scrubbed...
Name: init_su.c
Type: text/x-csrc
Size: 2296 bytes
Desc: not available
Url : http://lists.fedoraproject.org/pipermail/devel/attachments/20040726/bfdbb0dc/attachment-0002.bin
More information about the devel
mailing list