Hi all,
as those of you who have studied X2Go Server code probably have
noticed, X2Go uses the su command quite intensively. The problem about
su is that it invokes a subshell whenever it is called. Those
subshells are quite difficult to handle without providing space for
exploitation.
As su is (in all cases) used to drop privileges from root to a normal
user, my suggestion would be exchanging the su calls by sudo calls.
(sudo -u <user> <command>). The advantage of sudo: it does not invoke
a subshell.
Feedback? Request for comments??? Any other approach thinkable???
Thanks, Mike
DAS-NETZWERKTEAM mike gabriel, herweg 7, 24357 fleckeby fon: +49 (1520) 1976 148
GnuPG Key ID 0x25771B31 mail: mike.gabriel@das-netzwerkteam.de, http://das-netzwerkteam.de
freeBusy: https://mail.das-netzwerkteam.de/freebusy/m.gabriel%40das-netzwerkteam.de.xf...
On Wednesday 2014-01-08 14:11, Mike Gabriel wrote:
Feedback? Request for comments??? Any other approach thinkable???
$ su root -s /home/jengelh/echoargs bing bang bong Password: -> bing -> bang -> bong
As a sysadmin by day, these are my thoughts:
- We should make sure that every distro we provide packages for includes sudo by default.
- sudo can surely be configured in such a way that it would break x2go's usage of it. Of course, the same thing goes for sshd (NoMachine is quite vocal on that.)
On Wed, Jan 8, 2014 at 8:35 AM, Jan Engelhardt <jengelh@inai.de> wrote:
On Wednesday 2014-01-08 14:11, Mike Gabriel wrote:
Feedback? Request for comments??? Any other approach thinkable???
$ su root -s /home/jengelh/echoargs bing bang bong Password: -> bing -> bang -> bong
X2Go-Dev mailing list X2Go-Dev@lists.berlios.de https://lists.berlios.de/mailman/listinfo/x2go-dev
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
On 2014-01-08 14:11, Mike Gabriel wrote:
Hi all,
as those of you who have studied X2Go Server code probably have noticed, X2Go uses the su command quite intensively. The problem about su is that it invokes a subshell whenever it is called. Those subshells are quite difficult to handle without providing space for exploitation.
As su is (in all cases) used to drop privileges from root to a normal user, my suggestion would be exchanging the su calls by sudo calls. (sudo -u <user> <command>). The advantage of sudo: it does not invoke a subshell.
Feedback? Request for comments??? Any other approach thinkable???
IMO we should get rid of su altogether if possible. As far as I can see the cleansession-stuff can run as a daemon for every user (Simple shell-scripts that sleeps in between checks and terminates if there is no active session). Printing is another issue. But IMO even that can be solved by polling rather than pushing the data.
Moty
Dipl.-Ing. Moritz 'Morty' Struebe (Wissenschaftlicher Mitarbeiter) Lehrstuhl für Informatik 4 (Verteilte Systeme und Betriebssysteme) Friedrich-Alexander-Universität Erlangen-Nürnberg Martensstr. 1 91058 Erlangen
Tel : +49 9131 85-25419 Fax : +49 9131 85-28732 eMail : struebe@informatik.uni-erlangen.de WWW : http://www4.informatik.uni-erlangen.de/~morty
-----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
iQEcBAEBAgAGBQJS1SziAAoJEG/nl4s6YOSIm8wH/38hz548y7QAKrt8iaPMPOkO U5R6Es8Da8shRX+QmaOnSXsNzaWHN7QOsF5X9EFSN4RpI8ff8lUchHk2BlWfSEvU dqS7gdPOdQZaSMUdQdVjzFZiYg1mpAoyDYB4gZ7lhltCi0Bo+kN6yTX7EU2bjW1U ivNhEjgfFrdV7SIUdfaEAaH4uTFsQmg1RBX4sU8ysQOzwkXTfRrMjJZxf/hnLobe /uEfiam3ONb/7pqqRk2eEHuf68wVt97awq718mmroQNMJO2bTWrLCWYbAXi8geF/ /+Ji0VQqs8u7yOYCSusNTygEETbF8Fx0aDSqoMoGGwTl/xViH7nWxV4vbEEvi5I= =Ollg -----END PGP SIGNATURE-----
-
Jan Engelhardt -
Michael DePaulo -
Mike Gabriel -
Moritz Struebe