public inbox for development@lists.ipfire.org
 help / color / mirror / Atom feed
* [PATCH 00/20] Prevent "nobody" from escalating privileges by using writeable binaries as a vehicle
@ 2021-05-17 19:00 Peter Müller
  2021-05-17 19:00 ` [PATCH 01/20] GnuPG does not need to have a SUID bit set Peter Müller
  0 siblings, 1 reply; 21+ messages in thread
From: Peter Müller @ 2021-05-17 19:00 UTC (permalink / raw)
  To: development

[-- Attachment #1: Type: text/plain, Size: 2668 bytes --]

This patchset restricts dangerous file permissions, either SUID binaries or
executable binaries within /var/ipfire/ owned by "nobody", to their absolute
need-to-work basis. Hereby, we make privilege escalation attempts carried out
by "nobody" against IPFire-specific files harder, as there is no direct vehicle
to write in arbitrary shell code which is then executed later on.

Partially fixes: #12619

Peter Müller (20):
  GnuPG does not need to have a SUID bit set
  Core Update 157: remove SUID bit from /usr/bin/gpg
  /usr/bin/ping does not need a SUID bit if appropriate capabilities are
    set
  Core Update 157: Delete ssh-keysign binary
  DMA: do not ship a binary for creating mail boxes
  Core Update 157: Delete orphaned DMA mail box creation binary as well
  Core Update 157: /var/ipfire/fwhosts/icmp-types does not have to be
    executable
  Core Update 157: Ship changed iputils due to /usr/bin/ping changes
  backup: prevent /var/ipfire/backup/bin/backup.pl from being owned by
    nobody
  SquidGuard: Prevent binaries within /var/ipfire/urlfilter/bin/ from
    being owned by nobody
  Core Update 157: Apply changed permissions to
    /var/ipfire/urlfilter/bin/
  Squid: Prevent binaries within /var/ipfire/updatexlrator/bin/ from
    being owned by nobody
  Core Update 157: Apply changed permissions to
    /var/ipfire/updatexlrator/bin/
  OpenVPN: ovpn-leases.db for sure does not have to be executable
  Core Update 157: Apply changed permissions to
    /var/ipfire/ovpn/ovpn-leases.db
  Core Update 157: Remove executable bit less ugly
  NRPE: Prevent NRPE binary from being owned by "nobody"
  nagios-plugins: Prevent Nagios plugins from being owned by nobody
  Squid: cachemgr.cgi does not have to be owned (hence writeable) by
    nobody
  Core Update 157: Apply changed permissions to
    /srv/web/ipfire/cgi-bin/cachemgr.cgi

 config/rootfiles/common/dma                 |  2 +-
 config/rootfiles/core/157/filelists/iputils |  1 +
 config/rootfiles/core/157/update.sh         | 18 ++++++++++++++++++
 lfs/backup                                  |  7 ++++---
 lfs/gnupg                                   |  4 ++--
 lfs/iputils                                 |  7 +++++--
 lfs/nagios-plugins                          |  8 ++++++--
 lfs/nagios_nrpe                             |  7 +++++--
 lfs/openvpn                                 |  4 ++--
 lfs/squid                                   |  5 +++--
 lfs/squidguard                              |  3 ++-
 11 files changed, 49 insertions(+), 17 deletions(-)
 create mode 120000 config/rootfiles/core/157/filelists/iputils

-- 
2.26.2

^ permalink raw reply	[flat|nested] 21+ messages in thread
end of thread, other threads:[~2021-05-17 19:07 UTC | newest]

Thread overview: 21+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-05-17 19:00 [PATCH 00/20] Prevent "nobody" from escalating privileges by using writeable binaries as a vehicle Peter Müller
2021-05-17 19:00 ` [PATCH 01/20] GnuPG does not need to have a SUID bit set Peter Müller
2021-05-17 19:01   ` [PATCH 02/20] Core Update 157: remove SUID bit from /usr/bin/gpg Peter Müller
2021-05-17 19:01     ` [PATCH 03/20] /usr/bin/ping does not need a SUID bit if appropriate capabilities are set Peter Müller
2021-05-17 19:02       ` [PATCH 04/20] Core Update 157: Delete ssh-keysign binary Peter Müller
2021-05-17 19:02         ` [PATCH 05/20] DMA: do not ship a binary for creating mail boxes Peter Müller
2021-05-17 19:02           ` [PATCH 06/20] Core Update 157: Delete orphaned DMA mail box creation binary as well Peter Müller
2021-05-17 19:03             ` [PATCH 07/20] Core Update 157: /var/ipfire/fwhosts/icmp-types does not have to be executable Peter Müller
2021-05-17 19:03               ` [PATCH 08/20] Core Update 157: Ship changed iputils due to /usr/bin/ping changes Peter Müller
2021-05-17 19:04                 ` [PATCH 09/20] backup: prevent /var/ipfire/backup/bin/backup.pl from being owned by nobody Peter Müller
2021-05-17 19:04                   ` [PATCH 10/20] SquidGuard: Prevent binaries within /var/ipfire/urlfilter/bin/ " Peter Müller
2021-05-17 19:04                     ` [PATCH 11/20] Core Update 157: Apply changed permissions to /var/ipfire/urlfilter/bin/ Peter Müller
2021-05-17 19:05                       ` [PATCH 12/20] Squid: Prevent binaries within /var/ipfire/updatexlrator/bin/ from being owned by nobody Peter Müller
2021-05-17 19:05                         ` [PATCH 13/20] Core Update 157: Apply changed permissions to /var/ipfire/updatexlrator/bin/ Peter Müller
2021-05-17 19:05                           ` [PATCH 14/20] OpenVPN: ovpn-leases.db for sure does not have to be executable Peter Müller
2021-05-17 19:06                             ` [PATCH 15/20] Core Update 157: Apply changed permissions to /var/ipfire/ovpn/ovpn-leases.db Peter Müller
2021-05-17 19:06                               ` [PATCH 16/20] Core Update 157: Remove executable bit less ugly Peter Müller
2021-05-17 19:06                                 ` [PATCH 17/20] NRPE: Prevent NRPE binary from being owned by "nobody" Peter Müller
2021-05-17 19:07                                   ` [PATCH 18/20] nagios-plugins: Prevent Nagios plugins from being owned by nobody Peter Müller
2021-05-17 19:07                                     ` [PATCH 19/20] Squid: cachemgr.cgi does not have to be owned (hence writeable) " Peter Müller
2021-05-17 19:07                                       ` [PATCH 20/20] Core Update 157: Apply changed permissions to /srv/web/ipfire/cgi-bin/cachemgr.cgi Peter Müller

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox