Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Abusing Ubuntu 24.04 features for root privilege escalation

snyk.io

Post reply on HN
Print view View original

31–40 of 83 posts

Re: Abusing Ubuntu 24.04 features for root privilege escalation

#31

Post by nneonneo »

sheerun wrote: post #26

The only feedback I get when installing d-spy is "Uses System Services", and "Uses Session Services", which means nothing to me as a user, and yet it allows program to enumerate all programs I use and as it turns out even hack my computer. Other platforms solved this with something like "developer mode", iOS, Android, Meta, etc. I shouldn't be able to install this app without confirming developer-mode-only permission…

You’re running desktop Linux - your whole system is permanently in “developer mode”. That’s kind of the point? Windows and macOS don’t have “developer mode” either, at least not to the extent seen in the mobile OSes.

They’re very different models of computing.

Re: Abusing Ubuntu 24.04 features for root privilege escalation

#33

Post by JadeNB »

ale42 wrote: post #16
pzmarzly wrote: post #12

Earlier quoted context omitted.

> new solution will have only 70% of cups' features 15 years Which sounds fine? Most people don't want LPT printers support, they want AirPrint and WSD to just work.

How many percent is "most" people? What about enterprise users with complex setups/requirements, will they be supported or out-of-luck? Typically you'll have print servers with centralized authentication, possibly logging/auditing/billing, any this might depend on "the" component they'll leave out in the new product because, well, most people don't care about it...

> How many percent is "most" people? What about enterprise users with complex setups/requirements, will they be supported or out-of-luck? Typically you'll have print servers with centralized authentication, possibly logging/auditing/billing, any this might depend on "the" component they'll leave out in the new product because, well, most people don't care about it...

But the old, complex cups doesn't go away if a new, sandboxed version is developed, so the people who want the complexities can evaluate whether the security trade-off is worth it, and use it anyway if so.

Re: Abusing Ubuntu 24.04 features for root privilege escalation

#34

Post by cozzyd »

justmarc wrote: post #10
nneonneo wrote: post #8

Earlier quoted context omitted.

To be precise: you don't need to be in the sudo group, but in the lpadmin group. I'm not familiar with how Ubuntu groups are set up, but I guess it's likely that lpadmin is only granted to administrators by default. That said, I'm guessing people aren't expecting lpadmin to mean a full privilege escalation to root. There are two bugs here: one in cups, which allows it to chmod anything 777 (doesn't properly check for…

It became crystal clear that cups is a can of worms, and it would be prudent to completely replace it with with a new solution built from the ground up, ideally using modern tools and standards.

systemd-printd incoming

Re: Abusing Ubuntu 24.04 features for root privilege escalation

#35

Post by jabl »

justmarc wrote: post #10
nneonneo wrote: post #8

Earlier quoted context omitted.

To be precise: you don't need to be in the sudo group, but in the lpadmin group. I'm not familiar with how Ubuntu groups are set up, but I guess it's likely that lpadmin is only granted to administrators by default. That said, I'm guessing people aren't expecting lpadmin to mean a full privilege escalation to root. There are two bugs here: one in cups, which allows it to chmod anything 777 (doesn't properly check for…

It became crystal clear that cups is a can of worms, and it would be prudent to completely replace it with with a new solution built from the ground up, ideally using modern tools and standards.

Well it's your lucky day, they're working on rearchitecting cups to be, among other things, more secure. See https://ftp.pwg.org/pub/pwg/liaison/openprinting/presentatio...

Re: Abusing Ubuntu 24.04 features for root privilege escalation

#36

Post by jabl »

compsciphd wrote: post #14
justmarc wrote: post #10

Earlier quoted context omitted.

It became crystal clear that cups is a can of worms, and it would be prudent to completely replace it with with a new solution built from the ground up, ideally using modern tools and standards.

or just sandbox cups. There's no reason cups needs to write anything beyond its "configuration" and its "print spool". And hence, shouldn't have access to anything beyond what it needs to configure itself and print. thing like cups should be easy to sandbox, especially if we allow dbus like APIs as a means to cross sandbox boundaries (i.e. RPC mechanism). and by sandbox, I dont mean simply use apparmor type rules (th…

That's sort-of the direction they're going with CUPS 3. The 'local server', which is what most people will need, runs as a normal user, not root, doesn't listen on the internet, and talks only the IPP everywhere protocol. For supporting legacy printers, there will be separate sandboxed 'printer applications' which read in IPP Everywhere, run the driver code, and communicate with the backend printer using an appropriate protocol.

For enterprise users there will be a separate 'sharing server'.

https://ftp.pwg.org/pub/pwg/liaison/openprinting/presentatio...

Re: Abusing Ubuntu 24.04 features for root privilege escalation

#37

Post by homebrewer »

samlinnfer wrote: post #15

24.04 also ships with a footgun that keeps PasswordAuthentication enabled even if you edit /etc/ssh/sshd_config. It adds a /etc/ssh/sshd_config.d/50-cloud-init.conf that force overrides any PasswordAuthentication settings you have configured in /etc/ssh/sshd_config. See here: https://news.ycombinator.com/item?id=42133181

The proposed solution is bad, the file will be restored by the package manager at some point. Always prefix your override files with '99-' or 'zz-', this would have prevented the problem.

Re: Abusing Ubuntu 24.04 features for root privilege escalation

#38

Post by panarky »

jabl wrote: post #35
justmarc wrote: post #10

Earlier quoted context omitted.

It became crystal clear that cups is a can of worms, and it would be prudent to completely replace it with with a new solution built from the ground up, ideally using modern tools and standards.

Well it's your lucky day, they're working on rearchitecting cups to be, among other things, more secure. See https://ftp.pwg.org/pub/pwg/liaison/openprinting/presentatio...

What if you don't need cups because you don't print anything?

Just sudo apt remove cups right?

No, because cups is a dependency of the entire graphical subsystem, just removing cups also removes everything from the Nautilus file manager to Firefox to ubuntu-desktop itself.

Re: Abusing Ubuntu 24.04 features for root privilege escalation

#39

Post by nox101 »

justmarc wrote: post #10
nneonneo wrote: post #8

Earlier quoted context omitted.

To be precise: you don't need to be in the sudo group, but in the lpadmin group. I'm not familiar with how Ubuntu groups are set up, but I guess it's likely that lpadmin is only granted to administrators by default. That said, I'm guessing people aren't expecting lpadmin to mean a full privilege escalation to root. There are two bugs here: one in cups, which allows it to chmod anything 777 (doesn't properly check for…

It became crystal clear that cups is a can of worms, and it would be prudent to completely replace it with with a new solution built from the ground up, ideally using modern tools and standards.

I'd prefer they make it the default to not install it. I don't need to print from Linux. I don't print from Windows nor MacOS much either. Less than once a year. But I particularly don't print from Linux. I suspect that true for most people. cups shouldn't be a default install IMO

Re: Abusing Ubuntu 24.04 features for root privilege escalation

#40

Post by HumanOstrich »

poizan42 wrote: post #23
gazunklenut wrote: post #22

Earlier quoted context omitted.

Pretty sure this exists on Debian too

Nope, not on my system: https://i.imgur.com/1qCLXXZ.png

Great, now you can start putting your customizations in that directory instead of the OS-managed /etc/ssh/sshd_config blob. That's why the `.d/` convention exists.
Post reply on HN