mbox

[PING,v2,0/4] tunables and setxid programs

Message ID ede75bd6-41ff-77c8-6cc5-c740ca36151e@sourceware.org
Headers

Message

Siddhesh Poyarekar March 22, 2021, 4:32 a.m. UTC 
  On 3/16/21 12:37 PM, Siddhesh Poyarekar via Libc-alpha wrote:
> When parse_tunables tries to erase a tunable marked as SXID_ERASE for
> setuid programs, it ends up setting the envvar string iterator
> incorrectly, because of which it may parse the next tunable
> incorrectly.  Given that currently the implementation allows malformed
> and unrecognized tunables pass through, it may even allow SXID_ERASE
> tunables to go through.
> 
> This change revamps the SXID_ERASE implementation so that:
> 
> - Only valid tunables are written back to the tunestr string, because
>    of which children of SXID programs will only inherit a clean list of
>    identified tunables that are not SXID_ERASE.
> 
> - Unrecognized tunables get scrubbed off from the environment and
>    subsequently from the child environment.
> 
> - This has the side-effect that a tunable that is not identified by
>    the setxid binary, will not be passed on to a non-setxid child even
>    if the child could have identified that tunable.  This may break
>    applications that expect this behaviour but expecting such tunables
>    to cross the SXID boundary is wrong.
> 
> The setuid test for tunables has been bolstered to test different
> combinations of tunable values to ensure that the behaviour is now
> consistent.
> 
> Siddhesh Poyarekar (4):
>    support: Add capability to fork an sgid child
>    tst-env-setuid: Use support_capture_subprogram_self_sgid
>    Enhance setuid-tunables test
>    Fix SXID_ERASE behavior in setuid programs (BZ #27471)
> 
>   elf/Makefile                         |   2 -
>   elf/dl-tunables.c                    |  56 ++++----
>   elf/tst-env-setuid-tunables.c        | 118 +++++++++++++---
>   elf/tst-env-setuid.c                 | 197 ++------------------------
>   stdlib/tst-secure-getenv.c           | 199 +++------------------------
>   support/capture_subprocess.h         |   6 +
>   support/check.h                      |  12 ++
>   support/subprocess.h                 |   5 +
>   support/support_capture_subprocess.c | 114 +++++++++++++++
>   support/support_subprocess.c         |  13 ++
>   10 files changed, 304 insertions(+), 418 deletions(-)
>