|
 |
ca1eb8 |
From e13d53326bc154c684ea1bef9efc5922b5228945 Mon Sep 17 00:00:00 2001
|
|
|
ca1eb8 |
From: Jakub Hrozek <jhrozek@redhat.com>
|
|
|
ca1eb8 |
Date: Fri, 15 Jun 2018 22:29:34 +0200
|
|
|
ca1eb8 |
Subject: [PATCH] SUDO: Create the socket with stricter permissions
|
|
|
ca1eb8 |
MIME-Version: 1.0
|
|
|
ca1eb8 |
Content-Type: text/plain; charset=UTF-8
|
|
|
ca1eb8 |
Content-Transfer-Encoding: 8bit
|
|
|
ca1eb8 |
|
|
|
ca1eb8 |
This patch switches the sudo responder from being created as a public
|
|
|
ca1eb8 |
responder where the permissions are open and not checked by the sssd
|
|
|
ca1eb8 |
deaamon to a private socket. In this case, sssd creates the pipes with
|
|
|
ca1eb8 |
strict permissions (see the umask in the call to create_pipe_fd() in
|
|
|
ca1eb8 |
set_unix_socket()) and additionaly checks the permissions with every read
|
|
|
ca1eb8 |
via the tevent integrations (see accept_fd_handler()).
|
|
|
ca1eb8 |
|
|
|
ca1eb8 |
Resolves:
|
|
|
ca1eb8 |
https://pagure.io/SSSD/sssd/issue/3766 (CVE-2018-10852)
|
|
|
ca1eb8 |
|
|
|
ca1eb8 |
Reviewed-by: Sumit Bose <sbose@redhat.com>
|
|
|
ca1eb8 |
Reviewed-by: Pavel Březina <pbrezina@redhat.com>
|
|
|
ca1eb8 |
(cherry picked from commit ed90a20a0f0e936eb00d268080716c0384ffb01d)
|
|
|
ca1eb8 |
|
|
|
ca1eb8 |
DOWNSTREAM:
|
|
|
ca1eb8 |
Resolves: rhbz#1590603 - EMBARGOED CVE-2018-10852 sssd: information leak from the sssd-sudo responder [rhel-7]
|
|
|
ca1eb8 |
---
|
|
|
ca1eb8 |
src/responder/sudo/sudosrv.c | 3 ++-
|
|
|
ca1eb8 |
src/sysv/systemd/sssd-sudo.socket.in | 1 +
|
|
|
ca1eb8 |
2 files changed, 3 insertions(+), 1 deletion(-)
|
|
|
ca1eb8 |
|
|
|
ca1eb8 |
diff --git a/src/responder/sudo/sudosrv.c b/src/responder/sudo/sudosrv.c
|
|
|
ca1eb8 |
index ac4258710d3a9b48285522abd23bdd59ba42ad4e..e87a24499c2d82fafaa8e1f9b386e44332394266 100644
|
|
|
ca1eb8 |
--- a/src/responder/sudo/sudosrv.c
|
|
|
ca1eb8 |
+++ b/src/responder/sudo/sudosrv.c
|
|
|
ca1eb8 |
@@ -79,7 +79,8 @@ int sudo_process_init(TALLOC_CTX *mem_ctx,
|
|
|
ca1eb8 |
sudo_cmds = get_sudo_cmds();
|
|
|
ca1eb8 |
ret = sss_process_init(mem_ctx, ev, cdb,
|
|
|
ca1eb8 |
sudo_cmds,
|
|
|
ca1eb8 |
- SSS_SUDO_SOCKET_NAME, -1, NULL, -1,
|
|
|
ca1eb8 |
+ NULL, -1, /* No public socket */
|
|
|
ca1eb8 |
+ SSS_SUDO_SOCKET_NAME, -1, /* Private socket only */
|
|
|
ca1eb8 |
CONFDB_SUDO_CONF_ENTRY,
|
|
|
ca1eb8 |
SSS_SUDO_SBUS_SERVICE_NAME,
|
|
|
ca1eb8 |
SSS_SUDO_SBUS_SERVICE_VERSION,
|
|
|
ca1eb8 |
diff --git a/src/sysv/systemd/sssd-sudo.socket.in b/src/sysv/systemd/sssd-sudo.socket.in
|
|
|
ca1eb8 |
index c9abb875f0accbaf58d78846020fef74c7473528..96a8b0327ddb4d331c9b2e97ece3453f8f76872d 100644
|
|
|
ca1eb8 |
--- a/src/sysv/systemd/sssd-sudo.socket.in
|
|
|
ca1eb8 |
+++ b/src/sysv/systemd/sssd-sudo.socket.in
|
|
|
ca1eb8 |
@@ -11,6 +11,7 @@ ExecStartPre=@libexecdir@/sssd/sssd_check_socket_activated_responders -r sudo
|
|
|
ca1eb8 |
ListenStream=@pipepath@/sudo
|
|
|
ca1eb8 |
SocketUser=@SSSD_USER@
|
|
|
ca1eb8 |
SocketGroup=@SSSD_USER@
|
|
|
ca1eb8 |
+SocketMode=0600
|
|
|
ca1eb8 |
|
|
|
ca1eb8 |
[Install]
|
|
|
ca1eb8 |
WantedBy=sssd.service
|
|
|
ca1eb8 |
--
|
|
|
ca1eb8 |
2.17.1
|
|
|
ca1eb8 |
|