mounts with "bind,nosuid" won't apply nosuid #91
Comments
|
Well if suid apps can be run in a container it is a security problem (expecially for users having their custom distros). I think your second config misses a line (the one where we remount the dir). Would you like to paste a working configuration ? |
Yes, you are right, sorry! I meant to paste there snippet with remount.
I don't have full uwsgi.it installation so I cannot be 100% sure, but I don't think this is that severe. You still have to smuggle somehow binary with suid bit - you can't smuggle it in custom distro because only root directory is bind-mounted, and root directory is correctly remounted later with nosuid option. In this configuration only 3 directories could hold suid binaries: /run, /tmp and /var/tmp. In my opinion this is more of a documentation issue. Its just the way linux mount syscall works - if there is a bind option it will ignore any other options (not only "nosuid", but things like "ro" too). Maybe uwsgi should throw a warning / error if bind mount has additional options specified. Anyway, I prepared something you could call minimal repro case: https://gist.github.com/hiciu/8739c2f0c94296395aa6e629438bf045 On my uwsgi "bind,nosuid" is not enough to prevent suid executables from being executed. Here is output with only "bind,nosuid": (as you can see /test was executed with root privileges) Here is output with "bind,nosuid" and "remount,nosuid": (nosuid worked, /test was executed as user) diff, ignoring not important lines: @@ -40,12 +40,13 @@
re-fork()ing...
running "mount:proc none /proc" (as root)...
running "umount:/.old_root recursive,detach" (as root)...
+running "mount:none none / remount,nosuid" (as root)...
setgid() to 100
setuid() to 1000
running "exec:/test" (as user)...
-rwsr-sr-x 1 root root 6792 Jun 23 15:35 /test
-0
-/dev/mapper/vgssd-rootfs on / type ext4 (rw,relatime,data=ordered)
+1000
+/dev/mapper/vgssd-rootfs on / type ext4 (rw,nosuid,relatime,data=ordered)
none on /proc type proc (rw,relatime)
your processes number limit is 63993
your memory page size is 4096 bytes |
Hello,
Few times in uwsgi_it_api/uwsgi_it_api/templates/vassal.ini there is used hook similar to this:
According to
man 8 mountthe mount syscall can't handle additional options after "bind" - using bind it is nessecary to call mount second time, with "remount" and other options. (This is handled transparently by /usr/bin/mount).I tested this under Debian Jessie, with kernel 3.16.7-ckt11-1+deb8u6. This configuration:
still allowed me to run executables with suid bit from /var/www.
This one:
did not.
I am not sure if this could be considered as a bug.
The text was updated successfully, but these errors were encountered: