🚀 go-pugleaf

In <BUZZ.92Aug19092622@toxicavenger.bear.com> buzz@fsrg.bear.com writes:
>We wish to make mount and umount available to two or three non-root accounts.
>The plan is create a C code fork/exec wrapper that does the following:
>
>	1.  Verifies that the euid is root.
>	2.  Verifies that the uid is one of the "privileged" users.
>	3.  Forces argv[0] to be /usr/etc/(u)mount.
>	4.  Does an execv(3) -- NOT execvp(3) -- to run the argv.
>
>The program itself is setuid root, mode 4711, so that the binary image
>cannot be copied and compromised:
>	-rws--x--x  1 root        24576 Aug 17 11:51 mmount
>
>I believe this to be secure.  Can someone claim otherwise?

What happens when your user come happily trotting along with media
containing a setuid-root program of their own devising?  There are a
number of ways they could set up such a disk, and a whole lot of things
they could do after mounting it :-(.

Are you controlling the allowable mount-points, such that they can't
overmount /etc with a disk containing a passwd file with no root password?
Or overmount /usr/etc with a umount of their own devising which your
setuid program will now run for them with euid=0?

Are you verifying that umount requests are not for something that's
supposed to stay mounted?

Note also that one of the basic principles of paranoia is that no list of
possible attacks can ever be exhaustive.  There are quite a number of
general precautions and potential loopholes with any setuid-root program,
in addition to the above few points unique to (u)mount in particular.
-- 
Anthony DeBoer       adb@geac.com | uunet!geac!adb | GEM: ANTHONY.DEBOER