Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Cleanup privilege dropping/raising in pam_fscrypt #103

Merged
merged 3 commits into from Aug 23, 2018
Merged

Cleanup privilege dropping/raising in pam_fscrypt #103

merged 3 commits into from Aug 23, 2018

Commits on Aug 23, 2018

  1. Ensure setting user privileges is reversible 

    This change makes sure after dropping then elevating privileges for a
process, the euid, guid, and groups are all the same as they were
originally. This significantly simplifies the privilege logic.

This fixes CVE-2018-6558, which allowed an unprivleged user to gain
membership in the root group (gid 0) due to the groups not being
properly reset in the process.
    @josephlr
    josephlr committed Aug 23, 2018
    Configuration menu
    Copy the full SHA
    3022c16 View commit details
    Browse the repository at this point in the history

  2. Ensure keyring privilege changes are reversible 

    This change makes sure that, when we set the ruid and euid in order to
get the user keyring linked into the current process keyring, we will
always be able to reverse these changes (using a suid of 0).

This fixes an issue where "su <user>" would result in a system error
when called by an unprivileged user. It also explains exactly how and
why we are making these privilege changes.
    @josephlr
    josephlr committed Aug 23, 2018
    Configuration menu
    Copy the full SHA
    315f9b0 View commit details
    Browse the repository at this point in the history

  3. Improve debug and error output for pam_fscrypt

    @josephlr
    josephlr committed Aug 23, 2018
    Configuration menu
    Copy the full SHA
    11b0973 View commit details
    Browse the repository at this point in the history