🚀 go-pugleaf

In article <1992Nov5.071354.24042@kth.se> paf@cyklop.nada.kth.se (Patrik Fltstrm) writes:

   chiner@nova.gmi.edu writes:
   >(Rick Tait) writes:
   >: I recently installed these shell scripts on my machine (on which I am root),
   >: and I'd like to know if I'm compromising it's security. Basically, they
   >: just allow the users to mount/umount/eject the floppy disk (pcfs).
   >
   >:     /usr/etc/mount -t pcfs /dev/fd0 /pcfs
   >                            ^-o nosuid
   >:
   >and some other problems...  I'll point out, that all the mount commands
   >need a -o nosuid...  otherwise, anyone who can get a root shell on a disk,
   >can get root on your system...

I didn't see the entire thread from the beginning, but it seems to me you are
all missing the main problem with suid shell scripts, which is the bug in the
shell itself and the flexibility it offers with environment variables.

I can become root on your system using your /bin/sh script without even having
to know what it does or what programmes it calls.

suid shell script is a no-no. period.

If you want an suid programme write it in C (even if it does dumb things) and
don't use the system(3) and popen(3) functions because they call /bin/sh and
hance it's almost like writing a shell script.  I bet people can find some more
rules-of-thumb but these are the very basic ones you should follow.

A general suggestion for a programme which will do what you want would be:

main (ac, av)
	int ac;
	char **av;
{
	exec ("/usr/etc/mount", av);
}

and have the object of this C programme suid root.

Hope this helps,
--
--Amos Shapira (Jumper Extraordinaire)
C.S. System Group, Hebrew University, Jerusalem, Israel
amoss@cs.huji.ac.il

In article <AMOSS.92Nov6102549@shuldig.cs.huji.ac.il> amoss@shuldig.cs.huji.ac.il (Amos Shapira) writes:
>If you want an suid programme write it in C (even if it does dumb things) and
>don't use the system(3) and popen(3) functions because they call /bin/sh and
>hance it's almost like writing a shell script.  I bet people can find some more
>rules-of-thumb but these are the very basic ones you should follow.

Or better yet, use Perl, which won't allow you to perform "unsafe" operations
when running setuid.

--
Jurgen Botz                  |   Internet: JBotz@mtholyoke.edu
Academic Systems Consultant  |     Bitnet: JBotz@mhc.bitnet
Mount Holyoke College        |      Voice: (US) 413-538-2375 (daytime)
South Hadley, MA, USA        | Snail Mail: J. Botz, 01075-0629

Amos Shapira writes:
>A general suggestion for a programme which will do what you want would be:
>
>main (ac, av)
>	int ac;
>	char **av;
>{
>	exec ("/usr/etc/mount", av);
>}
>
>and have the object of this C programme suid root.

IMHO this is an extremely poor counterexample, since it lets the user
mount anything, with any options.  That presents its own security
risk.

Usually these special purpose mount wrappers are written with constant
arguments for exec.  For example, someone (I don't recall who) posted a
while ago:

char *env[]={"PATH=/usr/etc",(char*)0};
char *argv[]={"/usr/etc/mount","/pcfs",(char*)0};

main()
{
        setruid(getuid());
        execve("/usr/etc/mount",argv,env);
}

and a similar program for a cdrom, and two more programs for unmounting.

Brian

jbotz@mtholyoke.edu (Jurgen Botz) writes:

>In article <AMOSS.92Nov6102549@shuldig.cs.huji.ac.il> amoss@shuldig.cs.huji.ac.il (Amos Shapira) writes:
>>If you want an suid programme write it in C (even if it does dumb things) and
>>don't use the system(3) and popen(3) functions because they call /bin/sh and
>>hance it's almost like writing a shell script.  I bet people can find some more
>>rules-of-thumb but these are the very basic ones you should follow.

>Or better yet, use Perl, which won't allow you to perform "unsafe" operations
>when running setuid.

2 points!
--
These are my personal views and do not reflect those of Melbourne University.
Anything I may say that may be deemed offensive and/or damaging should NOT
be redirected to administration, as they have had nothing to do with it. 
Please direct any/all complaints/enquiries to thecure@ee.mu.oz.au

In article <AMOSS.92Nov6102549@shuldig.cs.huji.ac.il> amoss@shuldig.cs.huji.ac.il (Amos Shapira) writes:
>A general suggestion for a programme which will do what you want would be:
>
>main (ac, av)
>	int ac;
>	char **av;
>{
>	exec ("/usr/etc/mount", av);
>}
>
>and have the object of this C programme suid root.

Equivalent would be that you let anybody execute mount (i.e., set
mount suid), which is not reasonable. Also you have to deny suid
programs on the floppy, and ensure that there does not exist special
devices on the floppy.

I've written a set of programs (fdmkfs, fdmount, and fdumount) to give
users access to the floppy. They are available by anonymous ftp on
site cs.tut.fi (130.230.4.2), file pub/src/tut/floppy.shar. Use on
your own risk.

-- 
-----
Hannu-Matti Jarvinen, hmj@cs.tut.fi
Opinions of tut != opinions of mine, and vice versa.
TTKK on samaa mielt{ kanssani siit{, ett{ en edusta sen mielipidett{.

hmj@cs.tut.fi (J{rvinen Hannu-Matti) writes:

>In article <AMOSS.92Nov6102549@shuldig.cs.huji.ac.il> amoss@shuldig.cs.huji.ac.il (Amos Shapira) writes:
>>A general suggestion for a programme which will do what you want would be:
>>
>>main (ac, av)
>>	int ac;
>>	char **av;
>>{
>>	exec ("/usr/etc/mount", av);
>>}
>>
>>and have the object of this C programme suid root.

>Equivalent would be that you let anybody execute mount (i.e., set
>mount suid), which is not reasonable. Also you have to deny suid
>programs on the floppy, and ensure that there does not exist special
>devices on the floppy.

>I've written a set of programs (fdmkfs, fdmount, and fdumount) to give
>users access to the floppy. They are available by anonymous ftp on
>site cs.tut.fi (130.230.4.2), file pub/src/tut/floppy.shar. Use on
>your own risk.

Everybode executing mount isn't indeed a good idea:
How about mount /dev/fd /etc


Jan.
-- 
Jan Wortelboer,  University of Amsterdam
                 Computer Science Department  Email: janw@fwi.uva.nl
Unix             Kruislaan 403 Kamer F003     Phone: +31 20 525 7501
systems manager  1098 SJ AMSTERDAM            Fax  : +31 20 525 7490

In article <1eg5tmINN9eh@cs.tut.fi> hmj@cs.tut.fi (J{rvinen Hannu-Matti) writes:
>Equivalent would be that you let anybody execute mount (i.e., set
>mount suid), which is not reasonable. Also you have to deny suid
>programs on the floppy, and ensure that there does not exist special
>devices on the floppy.
>
>I've written a set of programs (fdmkfs, fdmount, and fdumount) to give
>users access to the floppy. They are available by anonymous ftp on
>site cs.tut.fi (130.230.4.2), file pub/src/tut/floppy.shar. Use on
>your own risk.
>
>-- 
>-----
>Hannu-Matti Jarvinen, hmj@cs.tut.fi
>Opinions of tut != opinions of mine, and vice versa.
>TTKK on samaa mielt{ kanssani siit{, ett{ en edusta sen mielipidett{.

Another set of programs which I have used is mntdisk. This was posted in
comp.sources.unix volume 22, and is available from many ftp sites. It includes
support for diskettes UNIX and PC formats (at least on Suns), CD's and
Erasable Optical Disks. It attempts to make sure that you do not mount
diskettes with device files and mounts with the nosuid option to prevent
misuse of diskettes.

As shipped it lets you mount the diskette wherever you like. However, it
is easy to modify to only allow mounts on specific directories if this is
necessary.


-- 
Steven Leikeim                        |
University of Calgary                 |   There are lies, damned lies,
Department of Electrical Engineering  |        and statistics.
Internet: steven@enel.ucalgary.ca     |