Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

root with a single command: sudo logrotate

joshua.hu

Post reply on HN
Print view View original

21–30 of 51 posts

Re: root with a single command: sudo logrotate

#21

Post by Jenk »

orev wrote: post #17
Jenk wrote: post #4

Earlier quoted context omitted.

> If you can sudo, you already have root, albeit limited. It's more of an ergonomic feature to discourage users logging in as root and destroying the system, than any kind of reliable security compartmentalization. I figured it was so you can identify the user who ran the command in an audit, instead of everyone just appear as "root"

One of the main benefits of sudo is that nobody needs to know the root password to switch to root (like one would need when using su). The actual root password can be saved in some break glass system, and admins only need to manage their own passwords.

That is a penny drop moment for me. You are absolutely right that that is the primary purpose.

Re: root with a single command: sudo logrotate

#22

Post by chatmasta »

dale_glass wrote: post #11

That seems contrived and kind of stupid? Why would a random user account have access to `sudo logrotate`? logrotate is presumably for rotating logs, and the only need for root is to rotate system logs. So under what circumstances does it make sense for a random, otherwise unprivileged user to have ability to rotate system logs, but not the ability to do other administrative tasks? It's also a tool that operates on ra…

> That seems contrived and kind of stupid?

So do most bugs and seemingly safe assumptions that lead to privilege escalation.

In practice, it's unlikely an untrusted user would have access to calling logrotate directly, but would instead call it through a chain of mechanisms that each individually seem innocuous, but become dangerous when combined together. Maybe they've got a foothold through parameter pollution allowing them to execute shell scripts as the apache user, which has sudo privileges for logrotate. Combine that with the ability to write relatively arbitrary data to logs, and you can see how things might begin to fall apart.

For example, here's a HackTheBox writeup [0] that exploits a race condition in logrotate on the path to getting root. It's not the exact same scenario as in OP, but it's a similar idea.

[0] https://0xdf.gitlab.io/2020/07/11/htb-book.html

Re: root with a single command: sudo logrotate

#23

Post by orange-mentor »

fuzzybear3965 wrote: post #6

I think PolKit can be used to delegate fine-grained control to users. Which other tools are available on Linux to control users' access to fs and network resources? File permissions, systemd-nspawn?

One could write a very small custom binary in C/C++/Rust that runs the command, and then give that binary setuid permissions. That binary can simply run a subprocess, and nothing else.

Re: root with a single command: sudo logrotate

#24

Post by gorkish »

I too can break into my own house when I leave a door wide open for myself. There is nothing wrong with logrotate, ubuntu, ssh, or sudo here.

Once you are passing arbitrary strings to bash as root -- yeah it's gonna be game over. This reminds me of the time a pentester found an XSS vuln and spent the entire rest of the engagement stuffing a keylogger into it. Like, OK, thanks, we already understand the implications of XSS.

The solution provided is suboptimal because all the focus is spent in making a good exploit demo instead of considering the root cause(s): the configuration of ssh, sudo, and the godawful shell script the author dredged up from parts unknown.

As I have seen this style of script being used with forced commands in authorized_keys, my conclusion is that the author loosely followed some online guide for restricting SSH access to certain commands and either inherited the flawed original script or made the error adapting it to the local requirements.

Proper options for restricting the shell abound. From the top of my head: rssh, sshdo, PolicyKit, rbash, rush

Re: root with a single command: sudo logrotate

#25

Post by burnte »

gorkish wrote: post #24

I too can break into my own house when I leave a door wide open for myself. There is nothing wrong with logrotate, ubuntu, ssh, or sudo here. Once you are passing arbitrary strings to bash as root -- yeah it's gonna be game over. This reminds me of the time a pentester found an XSS vuln and spent the entire rest of the engagement stuffing a keylogger into it. Like, OK, thanks, we already understand the implications o…

This is what Raymond Chen describes as "being on the other side of this airtight hatchway". https://devblogs.microsoft.com/oldnewthing/20060508-22/?p=31...

Re: root with a single command: sudo logrotate

#26

Post by jchw »

richbell wrote: post #8
jchw wrote: post #5

Sigh. It's disappointing to hear that this is the default in Ubuntu Server. As long as I'm understanding it, it doesn't appear to be an immediate concern, but it does demonstrate that the security design is quite a bit half-baked at least in this specific area. I don't think every Linux distribution needs to aspire to be as proactive about security as OpenBSD, but it would be nice to see better care put into features…

The post doesn't do a good job explaining whether this is the stock configuration or purely a hypothetical. My initial reaction was the same as yours, but upon further reflection I get the feeling it's just a thought exercise.

I'm a bit miffed that people are getting downvoted for not realizing this is not the default behavior, when I have no idea how you were supposed to gather that from reading the article. I did actually check to see (in Ubuntu 23.04) but honestly, that doesn't clear up much given that I have no idea what different installation modes of Ubuntu may yield.

Yeah, it's fair enough that it completely negates all of the points to be made about distro security, but also, it's not really our fault that the article is unclear.

Re: root with a single command: sudo logrotate

#28

Post by jchw »

chatmasta wrote: post #22
dale_glass wrote: post #11

That seems contrived and kind of stupid? Why would a random user account have access to `sudo logrotate`? logrotate is presumably for rotating logs, and the only need for root is to rotate system logs. So under what circumstances does it make sense for a random, otherwise unprivileged user to have ability to rotate system logs, but not the ability to do other administrative tasks? It's also a tool that operates on ra…

> That seems contrived and kind of stupid? So do most bugs and seemingly safe assumptions that lead to privilege escalation. In practice, it's unlikely an untrusted user would have access to calling logrotate directly, but would instead call it through a chain of mechanisms that each individually seem innocuous, but become dangerous when combined together. Maybe they've got a foothold through parameter pollution allo…

IMO it's not very interesting if you start with a blatantly unsafe assumption like putting a wildcard NOPASSWD line in sudoers. This would be interesting if it was somehow a default configuration, but it's blatantly weird to add it and then break it, given that it is a contrived configuration that I don't think you could easily convince sysadmins to add.

I assume the point of this is as a practice exercise for a potentially less contrived use case. That's cool, but it's still not particularly interesting...

Re: root with a single command: sudo logrotate

#29

Post by fragmede »

dale_glass wrote: post #11

That seems contrived and kind of stupid? Why would a random user account have access to `sudo logrotate`? logrotate is presumably for rotating logs, and the only need for root is to rotate system logs. So under what circumstances does it make sense for a random, otherwise unprivileged user to have ability to rotate system logs, but not the ability to do other administrative tasks? It's also a tool that operates on ra…

sudo less is/was also escalatable, which is much more innocuous for a an untrusted user to read error.log files for their account.

Re: root with a single command: sudo logrotate

#30

Post by c22 »

jchw wrote: post #26
richbell wrote: post #8

Earlier quoted context omitted.

The post doesn't do a good job explaining whether this is the stock configuration or purely a hypothetical. My initial reaction was the same as yours, but upon further reflection I get the feeling it's just a thought exercise.

I'm a bit miffed that people are getting downvoted for not realizing this is not the default behavior, when I have no idea how you were supposed to gather that from reading the article. I did actually check to see (in Ubuntu 23.04) but honestly, that doesn't clear up much given that I have no idea what different installation modes of Ubuntu may yield. Yeah, it's fair enough that it completely negates all of the point…

People don't get downvoted. Posts get downvoted, sometimes for inaccuracy. Tough break.
Post reply on HN