Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Linux LD_PRELOAD/LD_AUDIT library: Permission denied with path in Detection mode #32

Open
noproto opened this issue Oct 14, 2021 · 1 comment
Labels
bug Something isn't working good first issue Good for newcomers

Comments

@noproto
Copy link
Collaborator

noproto commented Oct 14, 2021

Files that do not exist are improperly returning "Permission denied" instead of "No such file or directory".

Erroneous output:

root@host:~# /example
WhiteBeam: /example: Permission denied
root@host:~# ./example
WhiteBeam: ./example: Permission denied

In syslog:

| Detection: /usr/bin/bash executed ./example (VerifyCanExecute)                                                                       | 1     |
| Detection: /usr/bin/bash executed /example (VerifyCanExecute)                                                                        | 1     |

Expected output:

root@host:~# /example
-bash: /example: No such file or directory
root@host:~# ./example
-bash: ./example: No such file or directory

(No syslog lines)

This is an issue in one of the Actions used by the Execution hooks provided by the Essential whitelist.

@noproto noproto added bug Something isn't working good first issue Good for newcomers labels Oct 14, 2021
@noproto
Copy link
Collaborator Author

noproto commented Oct 14, 2021

Causes service --status-all to return WhiteBeam: /usr/local/sbin/grep: Permission denied on each line.
Also: zcat with gzip's path.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working good first issue Good for newcomers
Projects
None yet
Development

No branches or pull requests

1 participant