[X2Go-Dev] setuid/setgid in libXcomp

[Orion Poplawski]

On 07/25/2013 02:54 PM, Mike Gabriel wrote:
> Hi Orion,
>
> On Do 25 Jul 2013 22:30:52 CEST Orion Poplawski wrote:
>
>> On 07/14/2013 03:33 AM, Moritz Strübe wrote:
>>> Hey,
>>>
>>> this is a bit of guesswork, but,
>>> * getgit get the _real_ real gid
>>> * setgit sets the _effective_ gid
>>> Thus you reset the effective s/gid.
>>>
>>> Morty
>
>> But why does it need to call this?  Isn't everything running as the user
>> already?
>>
>
> Everything in NX runs under the user who launches the X2Go session. IMHO
> resetting the effective GID prevents us from setgid file permission
> manipulations, so that the effective group ID always is the primary/real group
> ID of the current user that is executing the NX binary.
>
> Greets,
> Mike

Some more info:

This executable is calling setuid and setgid without setgroups or initgroups.
There is a high probability this mean it didn't relinquish all groups, and this
would be a potential security issue to be fixed. Seek POS36-C on the web for
details about the problem.

Ref POS36-C:

https://www.securecoding.cert.org/confluence/display/seccode/POS36-C.+Observe+correct+revocation+order+while+relinquishing+privileges


-- 
Orion Poplawski
Technical Manager                     303-415-9701 x222
NWRA, Boulder/CoRA Office             FAX: 303-415-9702
3380 Mitchell Lane                       orion at nwra.com
Boulder, CO 80301                   http://www.nwra.com