mbox

[00/20] Prevent "nobody" from escalating privileges by using writeable binaries as a vehicle

Message ID d4dd10c2-c0d1-42e3-3eda-ba61067717a5@ipfire.org
Headers

Message

Peter Müller 17 May 2021, 7 p.m. UTC 
This patchset restricts dangerous file permissions, either SUID binaries or
executable binaries within /var/ipfire/ owned by "nobody", to their absolute
need-to-work basis. Hereby, we make privilege escalation attempts carried out
by "nobody" against IPFire-specific files harder, as there is no direct vehicle
to write in arbitrary shell code which is then executed later on.

Partially fixes: #12619

Peter Müller (20):
  GnuPG does not need to have a SUID bit set
  Core Update 157: remove SUID bit from /usr/bin/gpg
  /usr/bin/ping does not need a SUID bit if appropriate capabilities are
    set
  Core Update 157: Delete ssh-keysign binary
  DMA: do not ship a binary for creating mail boxes
  Core Update 157: Delete orphaned DMA mail box creation binary as well
  Core Update 157: /var/ipfire/fwhosts/icmp-types does not have to be
    executable
  Core Update 157: Ship changed iputils due to /usr/bin/ping changes
  backup: prevent /var/ipfire/backup/bin/backup.pl from being owned by
    nobody
  SquidGuard: Prevent binaries within /var/ipfire/urlfilter/bin/ from
    being owned by nobody
  Core Update 157: Apply changed permissions to
    /var/ipfire/urlfilter/bin/
  Squid: Prevent binaries within /var/ipfire/updatexlrator/bin/ from
    being owned by nobody
  Core Update 157: Apply changed permissions to
    /var/ipfire/updatexlrator/bin/
  OpenVPN: ovpn-leases.db for sure does not have to be executable
  Core Update 157: Apply changed permissions to
    /var/ipfire/ovpn/ovpn-leases.db
  Core Update 157: Remove executable bit less ugly
  NRPE: Prevent NRPE binary from being owned by "nobody"
  nagios-plugins: Prevent Nagios plugins from being owned by nobody
  Squid: cachemgr.cgi does not have to be owned (hence writeable) by
    nobody
  Core Update 157: Apply changed permissions to
    /srv/web/ipfire/cgi-bin/cachemgr.cgi

 config/rootfiles/common/dma                 |  2 +-
 config/rootfiles/core/157/filelists/iputils |  1 +
 config/rootfiles/core/157/update.sh         | 18 ++++++++++++++++++
 lfs/backup                                  |  7 ++++---
 lfs/gnupg                                   |  4 ++--
 lfs/iputils                                 |  7 +++++--
 lfs/nagios-plugins                          |  8 ++++++--
 lfs/nagios_nrpe                             |  7 +++++--
 lfs/openvpn                                 |  4 ++--
 lfs/squid                                   |  5 +++--
 lfs/squidguard                              |  3 ++-
 11 files changed, 49 insertions(+), 17 deletions(-)
 create mode 120000 config/rootfiles/core/157/filelists/iputils