oss-sec mailing list archives
Re: Suid mount helpers fail to anticipate RLIMIT_FSIZE
From: Dan Rosenberg <dan.j.rosenberg () gmail com>
Date: Thu, 31 Mar 2011 09:43:29 -0400
Do you plan to open bug in glibc bugzilla for this issue?Sure, I'll open one today.
"Today" ended up meaning "next week", but there's now a glibc bugzilla entry for this: http://sourceware.org/bugzilla/show_bug.cgi?id=12625 As indicated in my previous email, some of the helpers will need fixes to completely resolve this issue. In particular: * util-linux mount should modify its custom addmntent function to behave as suggested in the glibc bug report, and should improve its error handling on addmntent failure to remove lockfiles and temporary files. * If mount.cifs is still shipped by anyone as setuid (I know there was discussion of removing its suid bit), then it will need to be altered to edit a temp file instead of /etc/mtab directly and clean up on addmntent failure. * If ncpfs is still supported by anyone (it's orphaned in a number of distributions), it should be fixed to have ncpmount edit a temp file instead of /etc/mtab directly and have both ncpmount and ncpumount clean up properly on addmntent failure. Alternatively, I'd be happy to see mount.cifs and the ncpfs utils no longer ship with a suid bit, since they've had security issues in the past and I don't think there's many situations where unprivileged users need the ability to mount filesystems other than FUSE. I'd also like to see distributions migrating away from /etc/mtab in general, since /proc/mounts seems like a much better replacement. The above issues will probably need CVE identifiers of their own, but I'd hold off on assigning them until it's clear that glibc is amicable to the proposed solution. Otherwise, there may need to be other fixes involving raising resource limits (I hope not). -Dan
Current thread:
- Re: Suid mount helpers fail to anticipate RLIMIT_FSIZE, (continued)
- Re: Suid mount helpers fail to anticipate RLIMIT_FSIZE Ludwig Nussel (Mar 03)
- Re: Suid mount helpers fail to anticipate RLIMIT_FSIZE Dan Rosenberg (Mar 05)
- Re: Suid mount helpers fail to anticipate RLIMIT_FSIZE Kees Cook (Mar 05)
- Re: Suid mount helpers fail to anticipate RLIMIT_FSIZE Josh Bressers (Mar 07)
- Re: Suid mount helpers fail to anticipate RLIMIT_FSIZE Dan Rosenberg (Mar 14)
- Re: Suid mount helpers fail to anticipate RLIMIT_FSIZE Dan Rosenberg (Mar 14)
- Re: Suid mount helpers fail to anticipate RLIMIT_FSIZE Dan Rosenberg (Mar 15)
- Re: Suid mount helpers fail to anticipate RLIMIT_FSIZE Tomas Hoger (Mar 22)
- Re: Suid mount helpers fail to anticipate RLIMIT_FSIZE Dan Rosenberg (Mar 22)
- Re: Suid mount helpers fail to anticipate RLIMIT_FSIZE Dan Rosenberg (Mar 31)
- Re: Suid mount helpers fail to anticipate RLIMIT_FSIZE Patrick J. Volkerding (Mar 31)