Re: CVE Request (syslog-ng)

[Andreas Ericsson <ae () op5 se>]

Steven M. Christey wrote:
> On Mon, 17 Nov 2008, Josh Bressers wrote:
>
> > syslog-ng doesn't call chdir() before calling chroot().
>
> This falls under the notion of "protection mechanism works less securely
> than advertised" so is a clear case for inclusion in CVE.  Use
> CVE-2008-5110.
>
> Also - is the chdir supposed to come BEFORE or AFTER?  The CERT secure
> coding rules here:
>
> https://www.securecoding.cert.org/confluence/display/cplusplus/FIO16-CPP.+Limit+access+to+files+by+creating+a+jail
>
> suggest it might be safer AFTER, not before, due to some race condition
> possibilities.

The correct sequence is:
chdir(jail_path);
chroot(".");

The chroot() call will fail if the directory no longer exists, but is
otherwise safe from "racy jail" attacks.

Paranoid programs only accept absolute non-symlink paths to the jail
and issue getcwd() after having entered it to make sure they ended up
in the proper directory.

--
Andreas Ericsson                   andreas.ericsson () op5 se
OP5 AB                             www.op5.se
Tel: +46 8-230225                  Fax: +46 8-230231