🚀 go-pugleaf

rickt@bnr.co.uk (Rick Tait) writes:
: I recently installed these shell scripts on my machine (on which I am root),
: and I'd like to know if I'm compromising it's security. Basically, they
: just allow the users to mount/umount/eject the floppy disk (pcfs).

:     /usr/etc/mount -t pcfs /dev/fd0 /pcfs
                            ^-o nosuid
:          /usr/etc/mount -t pcfs -o ro /dev/fd0 /pcfs
                                       ^nosuid
:            /usr/etc/mount -t pcfs /dev/fd0 /pcfs
                                   ^-o nosuid

: So do these make my system insecure? How? How the hell would a user
: turn these simple scripts over into something to compromise my IPX?
: 
Other people on here will point out many problems with suid scripts,
and some other problems...  I'll point out, that all the mount commands
need a -o nosuid...  otherwise, anyone who can get a root shell on a disk,
can get root on your system...  Is there any particular reason that people
need to store things on floppies?  could mtools be used instead? 
storing things on a MS-DOS disk makes it easier...
just make sure that eject is world executable... so that people don't
have to use the l1-a,n,eject method...

--
Chris Hiner   chiner@nova.gmi.edu
Signature file temporarily unavailable
Abort, Retry, Fail?

Rick Tait writes:
>I recently installed these shell scripts on my machine (on which I am root),
>and I'd like to know if I'm compromising it's security. Basically, they
>just allow the users to mount/umount/eject the floppy disk (pcfs).
>
>#!/bin/sh --
..
>-rwSr-xr-x  1 root     staff         368 Oct 11 11:20 in*
>-rwSr-xr-x  1 root     staff          42 Oct 23 15:05 out*

Even though execute permission is denied for root, the link-race attack
succeeds, so yes, you are potentially giving away root.

There's a faq around that explains, or rtfm execve(2) about #!

Brian

In article <1d6fdiINNf5q@bnsgd245.bnr.co.uk> rickt@bnr.co.uk (Rick Tait) writes:
>I recently installed these shell scripts on my machine (on which I am root),
>and I'd like to know if I'm compromising it's security. Basically, they
>just allow the users to mount/umount/eject the floppy disk (pcfs).

>-rwSr-xr-x  1 root     staff         368 Oct 11 11:20 in*
>-rwSr-xr-x  1 root     staff          42 Oct 23 15:05 out*

Why not use sudo to allow mounting of floppy disks?  It avoids the
race condition, and is easily configured to do what you want.

You can get it from csn.org:/pub/sudo

Adam



Adam Shostack 					adam@das.harvard.edu

What a terrible thing to have lost one's .sig.  Or not to have a .sig
at all because of elections.  How true that is.

In article <1d6fdiINNf5q@bnsgd245.bnr.co.uk> rickt@bnr.co.uk (Rick Tait) writes:
>I recently installed these shell scripts on my machine (on which I am root),
>and I'd like to know if I'm compromising it's security. Basically, they
>just allow the users to mount/umount/eject the floppy disk (pcfs).

Did anyone tried to solve this old problem with automounter ?
Something like (with amd)

pcfs            host==sunblast;type:=program;\
                mount:="/usr/etc/mount_pcfs mount_pcfs /dev/fd0 /amd.direct/pcfs nosuid";\
                unmount:="/etc/umount umount /dev/fd0"

I get the following message:

Nov  5 21:09:22 sunblast amd[126]/error: /amd.direct/pcfs: mount
(afs_cont): Not owner

--
Israel Yedidya,         Phone:  972-3-5318682 or 972-3-5318407/8
System Administrator,   Fax:    972-3-5353325
Math & CS Department,   Email:  yedidya@bimacs.cs.biu.ac.il
Bar-Ilan University,    Bitnet: yedidya@bimacs
Ramat-Gan, ISRAEL.      Uucp:   ...!uunet!pucc.princeton.edu!bimacs!yedidya
If someone proves there is no God, I'll stop being religious!

In article <1d6fdiINNf5q@bnsgd245.bnr.co.uk>, rickt@bnr.co.uk (Rick Tait) writes:
> I recently installed these shell scripts on my machine (on which I am root),
> and I'd like to know if I'm compromising it's security. Basically, they
> just allow the users to mount/umount/eject the floppy disk (pcfs).
> 
> In: (mount script)
> 
> #!/bin/sh --
> if ( test ${#} -eq 0 ) then
>     /usr/etc/mount -t pcfs /dev/fd0 /pcfs
>     else
>        if ( test ${1} = "ro" ) then
>          /usr/etc/mount -t pcfs -o ro /dev/fd0 /pcfs
>        else
>          if ( test ${1} = "rw" ) then
>            /usr/etc/mount -t pcfs /dev/fd0 /pcfs
>          else
>            echo Invalid argument -- not mounted
>          fi
>        fi
> fi
> 
> Out: (unmount/eject script)
> #!/bin/sh -- 
> /usr/etc/umount /pcfs
> eject
> 
> So do these make my system insecure? How? How the hell would a user
> turn these simple scripts over into something to compromise my IPX?

I don't think there will ever be a secure setuid shellscript:

Despite the fact  #!/bin/sh -- is much more better than #!/bin/sh
there are at least to holes in the script: 
First eject has no PATH so a user could write a malicious shellscript
with name /tmp/eject, cd to /tmp and set PATH to . :his shellscript will
then run under root.
Second you can fool /bin/sh to take every / as an blank and do the trick
above even if all cmds are preceeded by their full path.

Moral: don't use setuis shellscripts - write it in C or pearl instead.

Walter
   

In article <1d6fdiINNf5q@bnsgd245.bnr.co.uk> rickt@bnr.co.uk (Rick Tait) writes:
>I recently installed these shell scripts on my machine (on which I am root),
>and I'd like to know if I'm compromising it's security. Basically, they
>just allow the users to mount/umount/eject the floppy disk (pcfs).
>
>In: (mount script)

	[irrelevant script contents deleted]

>So do these make my system insecure? How? How the hell would a user
>turn these simple scripts over into something to compromise my IPX?

this is the oldest crack trick in the book, and is in the FAQ

Suggest you read it, the bit on creating a symbolic link 
to the script from a file called "-i" ...
you may find that informative

>
>By the way, these are the directory entries:
>
>-rwSr-xr-x  1 root     staff         368 Oct 11 11:20 in*
>-rwSr-xr-x  1 root     staff          42 Oct 23 15:05 out*
    ^
get those alarm bells ringing



-- 
 Annal  Natrach, Usthvah Spethed,         carl@ecr.mu.oz.au (IRC: Bleve)
 Dochoel Dienve                           carl@munagin.ee.mu.oz.au
					  carl@montebello.ecom.unimelb.EDU.AU
 Merlin, where are you?  Call your dragon, to weave a mist...

rickt@bnr.co.uk (Rick Tait) writes:

>I recently installed these shell scripts on my machine (on which I am root),
>and I'd like to know if I'm compromising it's security. Basically, they
>just allow the users to mount/umount/eject the floppy disk (pcfs).

I suggest that you read the FAQ which is posted at regular intervals,
and which can be ftp-ed from many sites (ask archie). 

A trivial hole:  the scripts do not set PATH, and /usr/etc/mount relies
on PATH to execute other commands. The non-trivial hole:  switching
files after the kernel has started a root shell, but before that shell
has opened the the shell script file. This, and more, is discussed in
the FAQ document.

The alternative: the MTOOLS package that does not require the mounting
of MS-DOS disks.

	Wietse

In article <1d6fdiINNf5q@bnsgd245.bnr.co.uk> rickt@bnr.co.uk (Rick Tait) writes:
>I recently installed these shell scripts on my machine (on which I am root),
>and I'd like to know if I'm compromising it's security. Basically, they
>just allow the users to mount/umount/eject the floppy disk (pcfs).

instead of a shell script try this C program:

Note the the real way it to run "check -s" on the unix file system first
also an attack is still possible if you edit (adb) the raw device
after the floppy is mounted and create a specal device (eg: mem of kmem)



#include <stdio.h>

/*

Note: /etc/fstab should contain the following:

/dev/fd0   /pcfs       pcfs rw,noauto 0 0
/dev/fd0   /floppy  4.2 rw,noauto,nosuid 0 0
*/



static char by[] = "@(#) pcfs.c Pete Shipley [1991]\n";

static char *mount = "/usr/etc/mount";
static char *umount = "/usr/etc/umount";

static char *where = "/pcfs";
static char *what = "/dev/fd0";

static char *use ="Usage: %s [ -u | -d | -m ]\n\
\t-d\tmount MS-DOS diskette\n\
\t-m\tmount unix diskette\n\
\t-u\tunmount diskette\n";

extern int strncmp(), setuid(), perror(), fprintf(), getuid();
extern void execl();

int
main(ac, av)
char *av[];
int ac;
{
char *cp;
char  **cpp;
extern char **environ;

    if(ac != 2) goto error;


    for (cpp = environ; cp = *cpp; /* void */) {
        char  **xpp;

        if(strncmp(cp, "LD_", 3) == 0) {
            for (xpp = cpp; xpp[0] = xpp[1]; xpp++);
        } else {
            cpp++;
        }
    }


    /* not nessary
    if( setuid(getuid()) == -1) {
	(void) perror("setuid");
	exit(1);
    } */

    switch(av[1][1]) {
	case 'u':
	    execl(umount, umount, where, (char *)0);
	case 'd':
	    execl(mount, mount, "-t", "pcfs", what, where, (char *)0);
	case 'm':
	    execl(mount, mount, "-t", "4.2", "-o", "nosuid", what, where, (char *)0);
error:
	default:
	    (void) fprintf(stderr, use, av[0]);
	    exit(1);
    }
    exit(0);
}

-- 
---------------
Pete Shipley:
email: shipley@berkeley.edu             Flames:  cimarron@postgres.berkeley.edu
Spelling corections: /dev/null          Quote: "Anger is an energy"

>>>>> On 5 Nov 92 23:15:51 GMT, carl@montebello.ecom.unimelb.EDU.AU
>>>>> (Carl Brewer) said:

>In: (mount script)

Carl> 	[irrelevant script contents deleted]

Carl> this is the oldest crack trick in the book, and is in the FAQ
Carl> Suggest you read it, the bit on creating a symbolic link 
Carl> to the script from a file called "-i" ...
Carl> you may find that informative

Well, it is NOT irrelevant that his scripts start with

         #!/bin/sh --

Please note the '--'. The '-i' trick won't work.
There are however other ways to break his scripts.

   Michal