Skip to content

1.0.1

Latest
Latest

Choose a tag to compare

View all tags
@stuard stuard released this 23 Oct 20:47
v1.0.1
c2d79f2

Security fix: upgrade if you run 1.0.0 as root

php-security-watch 1.0.0 could let a non-root user gain root. When run as root (the default systemd timer), 1.0.0 executed programs it found on the server to read versions and settings: php / php-fpm builds under /opt/*, /usr/local/php* and similar folders, node under ~/.nvm or other folders, python3, nginx -T, apachectl -S, sendmail, and the config tests run before a restart in fix mode. If one of those files, or any folder above it, belonged to another user or could be written by a group or by every user, that user could replace it and their code would run as root.

What 1.0.1 does

  • A found program is run only when its real file (after following symlinks) and every folder above it belong to root (or to the user running the watch) and cannot be written by a group or by every user.
  • Otherwise it is not run. The report shows a warning: Did not run <path>: <reason>, so running it as root could run someone else's code., with the exact fix (chown -R root:root ... && chmod -R go-w ..., or install it from the package manager).
  • Node.js installed with nvm or n is still checked: its version is read from the folder name (.../versions/node/v20.1.0/bin/node) without running it.
  • sendmail that is not safe is not run; the email step fails with a clear message (make it owned by root, or set SMTP_URL).
  • In fix mode, a config test program that is not safe is not run, and the service is left running as it was.
  • Programs the system runs by name from PATH (package managers, systemctl, journalctl, ss, docker) are unchanged.

Upgrade

curl -fsSL https://github.com/Zoaftware/php-security-watch/archive/refs/tags/v1.0.1.tar.gz | tar xz
cd php-security-watch-1.0.1
sudo ./install.sh

Full list of changes: CHANGELOG.md.

Assets 2
Loading