oss-sec mailing list archives
Re: What is the "Grinch" polkit/wheel group issue?
From: Daniel Micay <danielmicay () gmail com>
Date: Wed, 17 Dec 2014 16:50:19 -0500
If the compromised user is an administator, an unsandboxed process running as that user can trivially obtain root access. A small shell script or function wrapping su / sudo is all it takes to escalate privileges. There's no need to exploit a privesc vulnerability by obtaining a package with a vulnerable setuid/setgid/setcap binary or enabled-by-default service. Any process running as that user can obtain an X11 handle and sniff the input events. Wayland will change that, but it's only truly valuable in combination with some form of process isolation. There's only a strong distinction between root and the administrator's regular user account if they aren't a sudoer and never switch to root via su within their session. If root logins are only done from virtual consoles, then the attacker may actually need to resort to hacks like this - but I doubt that user would be in the wheel group... Since the typical usage of wheel is access to sudo, I don't see any problem with this polkit rule. It's acknowledging that the distinction between root and an admin user's account (in wheel) has very little relevance to security, and is more about preventing accidents.
Attachment:
signature.asc
Description: OpenPGP digital signature
Current thread:
- What is the "Grinch" polkit/wheel group issue? Marcus Meissner (Dec 17)
- Re: What is the "Grinch" polkit/wheel group issue? Elad Alfassa (Dec 17)
- Re: What is the "Grinch" polkit/wheel group issue? Todd C. Miller (Dec 17)
- Re: What is the "Grinch" polkit/wheel group issue? Nicolas Vigier (Dec 17)
- Re: What is the "Grinch" polkit/wheel group issue? Daniel Kahn Gillmor (Dec 17)
- Re: What is the "Grinch" polkit/wheel group issue? Kurt Seifried (Dec 17)
- Re: What is the "Grinch" polkit/wheel group issue? Dean Pierce (Dec 17)
- Re: What is the "Grinch" polkit/wheel group issue? Grandma Eubanks (Dec 17)
- Re: What is the "Grinch" polkit/wheel group issue? Daniel Micay (Dec 17)
- Re: What is the "Grinch" polkit/wheel group issue? Dean Pierce (Dec 17)