[SSSD] [PATCH] Thighten up become_user()

Simo Sorce simo at redhat.com
Fri Apr 5 12:47:56 UTC 2013


On Fri, 2013-04-05 at 12:26 +0200, Lukas Slebodnik wrote:
> On (04/04/13 12:24), Simo Sorce wrote:
> >Commit should say it all.
> >We do not have any security issue (that I know off) with the current
> >code, but I want to tighten up the privileges more given we do not need
> >the additional capabilities in the krb5_child anyway.
> >
> >Simo.
> >
> >-- 
> >Simo Sorce * Red Hat, Inc * New York
> Nack
> 
> Patch make impossible user authentication.
> 
> sh-4.2$ su - usersssd02
> Password: 
> su: incorrect password
> 
> 
> From krb5_child.log:
> [become_user] (0x0200): Trying to become user [325600012][325600012].
> [create_ccache_in_dir] (0x0200): Creating ccache at [DIR:/run/user/325600012/krb5cc]
> [become_user] (0x0200): Trying to become user [325600012][325600012].
> [become_user] (0x0020): setgroups failed [1][Operation not permitted].
>                                    ^^^^^
> The second call of function become_user fail with EPERM
> 
> [create_ccache_in_dir] (0x0020): become_user failed.
> [get_and_save_tgt] (0x0020): 1140: [1][Operation not permitted]
> [map_krb5_error] (0x0020): 1160: [1][Operation not permitted]
> 
> > errno_t become_user(uid_t uid, gid_t gid)
> > {
> >     int ret;
> > 
> >     DEBUG(SSSDBG_FUNC_DATA, ("Trying to become user [%d][%d].\n", uid, gid));
> >-    ret = setgid(gid);
> >-    if (ret == -1) {
> >-        ret = errno;
> >-        DEBUG(SSSDBG_CRIT_FAILURE,
> >-              ("setgid failed [%d][%s].\n", ret, strerror(ret)));
> >-        return ret;
> >-    }
> > 
> >-    ret = setuid(uid);
> >+    /* drop supplmentary groups first */
> >+    ret = setgroups(0, NULL);
> >     if (ret == -1) {
> >         ret = errno;
> If errno is EPERM, than we should ignore this error and continue.
> 
> >         DEBUG(SSSDBG_CRIT_FAILURE,
> >-              ("setuid failed [%d][%s].\n", ret, strerror(ret)));
> >+              ("setgroups failed [%d][%s].\n", ret, strerror(ret)));
> >         return ret;
> >     }
> > 

It is very odd that we get EPERM .. is this function beeing called
twice ? Once as root before the fork, and then again in the code ?

Simo.

-- 
Simo Sorce * Red Hat, Inc * New York




More information about the sssd-devel mailing list