-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 10/29/2013 09:03 PM, Chris Adams wrote:
Once upon a time, Reindl Harald <h.reindl(a)thelounge.net> said:
> [root@srv-rhsoft:~]$ mkdir test i could rm -rf ~/ here
>
> [root@srv-rhsoft:~]$ cat /usr/local/bin/mkdir #!/bin/bash echo "i could
> rm -rf ~/ here"
If I can write to files you own, it doesn't matter if there's a directory
in the PATH or not. I can write this to your .bash_profile:
/bin/mkdir $HOME/.bin 2> /dev/null echo 'echo "i could rm -rf ~/
here"' >
$HOME/.bin/mkdir chmod +x $HOME/.bin/mkdir PATH=$HOME/.bin:$PATH
Sure, it might not take effect immediately, but that's probably not the
point (I can't depend on you running "mkdir" in a shell at any particular
point in time anyway). You wouldn't gain anything security-wise by
excluding a user-writable directory in PATH.
In fact, having a "known" ~/.local/bin could allow for a more restrictive
SELinux policy on that directory that doesn't let arbitrary programs
running as the user write there (don't know if that is the case though).
matchpathcon /home/dwalsh/bin /home/dwalsh/.local/bin
/home/dwalsh/bin staff_u:object_r:home_bin_t:s0
/home/dwalsh/.local/bin staff_u:object_r:home_bin_t:s0
We are doing this in some form, although more towards, the only files in the
users homedir is allowed to execute is in the home_bin_t directory.
We do try to block confined apps from writing to user_home_t which is most
files in ~ and also home_bin_t.
The only reference to home_bin_t on the target right now is the following.
sesearch -A -t home_bin_t -c file | grep home_bin_t
allow postfix_local_t home_bin_t : file { ioctl read getattr execute
execute_no_trans open } ;
allow procmail_t home_bin_t : file { ioctl read getattr execute
execute_no_trans open } ;
Of course lots of user domains and unconfined domains are allowed to write to
home_bin_t.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.15 (GNU/Linux)
Comment: Using GnuPG with Thunderbird -
http://www.enigmail.net/
iEYEARECAAYFAlJxHH0ACgkQrlYvE4MpobOjDwCfaMO1bL17awLmc+F+DbWv44it
IEwAmgKT5WIdNege1rE+IS8ISXGLJlca
=Fc9n
-----END PGP SIGNATURE-----