71–80 of 86 posts
Earlier quoted context omitted.
Off the top of my head? Ask a system service that has the privilege to change it for you after authenticating you.
Isn’t that exactly what passwd is? A system service that has permission to change the passwords file?
Earlier quoted context omitted.
That's somewhat different from the Veracrypt case, afaict. And it doesn't seem like this is what bonzini meant by mentioning sudo.
You still need to gain the privilege to mount filesystems in order to exploit the flaw. So it is a privilege escalation in that you can go from "sudo mount" to a root shell, but it is: 1) not exploitable unless you have sudo 2) pointless if you are authorized to "sudo" any command.
%veracryptusers ALL=(root) NOPASSWD:/usr/bin/veracrypt
Such a config would normally give you sudo, but not a root shell; allowing certain users to use ping floods to test the network by giving them access to the ping command as root, for example, would not expose much security risks other than flooding the network.
It is sad to see the state still making freedom of information requests so difficult and using copyright as a flimsy excuse to hinder citizens to share the information when they finally manage to get it out of them. I find it especially sad to see something like this held back by an entity that claims to want to protect security in information technology and doubly so since this information would be relevant to the d…
It would be nice if it were easier to achieve transparency; but the flipside is that overzealous transparency laws can be abused too; at least here in the Netherlands there have been several cases where... creative... citizens decided to cash in on the fines imposed for non-compliance with such requests by spamming (iirc) municipalities with requests which had been phrased to be hard to deal with quickly, and hundreds of which submitted simultaneously. I believe the law has changed, but even so - requests like this aren't free. Somebody else is paying; and that's fine - but to expect them to furthermore go above and beyond and push for excellent service and quick turnaround is perhaps a little unreasonable.
Earlier quoted context omitted.
Isn’t that exactly what passwd is? A system service that has permission to change the passwords file?
No, the point is that passwd should obtain its privilege by virtue of being started by a privileged process, not by virtue of being marked as a privileged program when it's run by an unprivileged user.
Earlier quoted context omitted.
No, the point is that passwd should obtain its privilege by virtue of being started by a privileged process, not by virtue of being marked as a privileged program when it's run by an unprivileged user.
How do you start the privileged process as a normal user?
Earlier quoted context omitted.
That's somewhat different from the Veracrypt case, afaict. And it doesn't seem like this is what bonzini meant by mentioning sudo.
You still need to gain the privilege to mount filesystems in order to exploit the flaw. So it is a privilege escalation in that you can go from "sudo mount" to a root shell, but it is: 1) not exploitable unless you have sudo 2) pointless if you are authorized to "sudo" any command.
a) it seems the point in the report is that Truecrypt allowed to grant this ability without using sudo (I guess either via a daemon or just a setuid executable)
b) iirc in case of other filesystems you can allow users to mount them without being root—which is how removable devices work in unixes. So this goes around the whole sudo/setuid system and probably might be another option for this feature in Truecrypt too.
Lastly, as jeroenhd noted, even with sudo the root privilege can be granted for a script that mounts a volume, or for one particular command. Sudo, by default, doesn't allow the user to add options to the command specified in `sudoers`.
Earlier quoted context omitted.
How do you start the privileged process as a normal user?
You don't. It's already started as part of the system. Or you ask some part of the system that is willing to authenticate you to do it for you.
Stop giving systemd more ideas.
(/s)
(But seriously, imagine a world where you can't get root because D-Bus crashed.)
Earlier quoted context omitted.
You don't. It's already started as part of the system. Or you ask some part of the system that is willing to authenticate you to do it for you.
Shhhhhhhhhh. Stop giving systemd more ideas. (/s) (But seriously, imagine a world where you can't get root because D-Bus crashed.)
Earlier quoted context omitted.
Not if you use user namespaces (which you really should).
Which is not the default that Docker uses :( One more reason to switch to podman, which has sane defaults.