GNU logs - #52011, boring messages

Message sent to bug-guix@HIDDEN:

Subject: bug#52011: pkexec: PATH environment variable
Resent-From: "Hamzeh Nasajpour" <h.nasajpour@HIDDEN>
Original-Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
Resent-CC: bug-guix@HIDDEN
Resent-Date: Sun, 21 Nov 2021 08:04:02 +0000
Resent-Message-ID: <handler.52011.B.163748181410663 <at> debbugs.gnu.org>
Resent-Sender: help-debbugs@HIDDEN
To: 52011 <at> debbugs.gnu.org
User-Agent: Cyrus-JMAP/3.5.0-alpha0-1371-g2296cc3491-fm-20211109.003-g2296cc34
Mime-Version: 1.0
Message-Id: <46b16bf3-e41c-4ccf-9817-879df6eeb8cb@HIDDEN>
Date: Sun, 21 Nov 2021 11:33:05 +0330
From: "Hamzeh Nasajpour" <h.nasajpour@HIDDEN>
Content-Type: text/plain
Received-SPF: pass client-ip=66.111.4.26;
 envelope-from=h.nasajpour@HIDDEN; helo=out2-smtp.messagingengine.com
X-Spam_score_int: -27
X-Spam_score: -2.8
X-Spam_bar: --
X-Spam_report: (-2.8 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1,
 DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1,
 RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01,
 SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no
X-Spam_action: no action
X-Spam-Score: -1.6 (-)
X-BeenThere: debbugs-submit <at> debbugs.gnu.org
X-Mailman-Version: 2.1.18
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit <at> debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
X-Spam-Score: -2.6 (--)

The `PATH` environment variable is hard-code here: 
https://github.com/freedesktop/polkit/blob/master/src/programs/pkexec.c#L882-L886

We don't have any executable in these paths in guix:
```
/usr/sbin:/usr/bin:/sbin:/bin:/root/bin
``` 

Replicate the issue:
1. Run the `pkexec`
2. Enter your password
3. run `echo $PATH` in the opened terminal
4. You will see this path: `/usr/sbin:/usr/bin:/sbin:/bin:/root/bin`
5. You can't run most of the commands. (`ls`, `passwd`, `chpasswd` and so on.)

Expected Behavior:
Running all of the commands without any error.

Isn't it? Should not we patch the `PATH` environment variable in `pkexec` source codes? Either way, some applications like `lxqt-admin-user` and `lxqt-admin-time` has an issue and they can't run the commands via `pkexec`. I get this error when I want to change user password via `lxqt-admin-user`. It's using `pkexec` to change password.

```
/run/current-system/profile/bin/lxqt-admin-user-helper: line 7: exec: passwd: not found
``` 

--

Hamzeh Nasajpour
PantherX Team

Message sent:

Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-Mailer: MIME-tools 5.505 (Entity 5.505)
Content-Type: text/plain; charset=utf-8
X-Loop: help-debbugs@HIDDEN
From: help-debbugs@HIDDEN (GNU bug Tracking System)
To: "Hamzeh Nasajpour" <h.nasajpour@HIDDEN>
Subject: bug#52011: Acknowledgement (pkexec: PATH environment variable)
Message-ID: <handler.52011.B.163748181410663.ack <at> debbugs.gnu.org>
References: <46b16bf3-e41c-4ccf-9817-879df6eeb8cb@HIDDEN>
X-Gnu-PR-Message: ack 52011
X-Gnu-PR-Package: guix
Reply-To: 52011 <at> debbugs.gnu.org
Date: Sun, 21 Nov 2021 08:04:02 +0000

Thank you for filing a new bug report with debbugs.gnu.org.

This is an automatically generated reply to let you know your message
has been received.

Your message is being forwarded to the package maintainers and other
interested parties for their attention; they will reply in due course.

Your message has been sent to the package maintainer(s):
 bug-guix@HIDDEN

If you wish to submit further information on this problem, please
send it to 52011 <at> debbugs.gnu.org.

Please do not send mail to help-debbugs@HIDDEN unless you wish
to report a problem with the Bug-tracking system.

--=20
52011: http://debbugs.gnu.org/cgi/bugreport.cgi?bug=3D52011
GNU Bug Tracking System
Contact help-debbugs@HIDDEN with problems

Message sent to bug-guix@HIDDEN:

Subject: bug#52011: pkexec: PATH environment variable
Resent-From: Liliana Marie Prikler <liliana.prikler@HIDDEN>
Original-Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
Resent-CC: bug-guix@HIDDEN
Resent-Date: Sun, 21 Nov 2021 14:53:02 +0000
Resent-Message-ID: <handler.52011.B52011.163750635721783 <at> debbugs.gnu.org>
Resent-Sender: help-debbugs@HIDDEN
To: Hamzeh Nasajpour <h.nasajpour@HIDDEN>, 52011 <at> debbugs.gnu.org
Message-ID: <57fde5d78af3ecc18b57191238cd81b0de65378e.camel@HIDDEN>
From: Liliana Marie Prikler <liliana.prikler@HIDDEN>
Date: Sun, 21 Nov 2021 15:52:24 +0100
In-Reply-To: <46b16bf3-e41c-4ccf-9817-879df6eeb8cb@HIDDEN>
References: <46b16bf3-e41c-4ccf-9817-879df6eeb8cb@HIDDEN>
Content-Type: text/plain; charset="UTF-8"
User-Agent: Evolution 3.34.2 
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Precedence: list
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>

Hi,

Am Sonntag, den 21.11.2021, 11:33 +0330 schrieb Hamzeh Nasajpour:
> The `PATH` environment variable is hard-code here: 
> 
> https://github.com/freedesktop/polkit/blob/master/src/programs/pkexec.c#L882-L886
> 
> We don't have any executable in these paths in guix:
> ```
> /usr/sbin:/usr/bin:/sbin:/bin:/root/bin
> ``` 
> 
> Replicate the issue:
> 1. Run the `pkexec`
> 2. Enter your password
> 3. run `echo $PATH` in the opened terminal
> 4. You will see this path: `/usr/sbin:/usr/bin:/sbin:/bin:/root/bin`
> 5. You can't run most of the commands. (`ls`, `passwd`, `chpasswd`
> and so on.)
> 
> Expected Behavior:
> Running all of the commands without any error.
> 
> Isn't it? Should not we patch the `PATH` environment variable in
> `pkexec` source codes? Either way, some applications like `lxqt-
> admin-user` and `lxqt-admin-time` has an issue and they can't run the
> commands via `pkexec`. I get this error when I want to change user
> password via `lxqt-admin-user`. It's using `pkexec` to change
> password.
I'm getting some flashbacks from my ITSec courses here.  pkexec is
protecting itself against a malicious PATH attack.  The paths are
chosen somewhat arbitrarily, but on traditional distros this ought to
ensure, that no privilege escalation occurs.  We could inject
/run/current-system, given that /run likewise ought to be root-writable 
only, but I'm not sure how much that helps.  The obvious solution is to
use canonical (store) paths with pkexec.

Cheers

Message sent to bug-guix@HIDDEN:

Subject: bug#52011: pkexec: PATH environment variable
Resent-From: "Hamzeh Nasajpour" <h.nasajpour@HIDDEN>
Original-Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
Resent-CC: bug-guix@HIDDEN
Resent-Date: Sun, 28 Nov 2021 07:41:02 +0000
Resent-Message-ID: <handler.52011.B52011.163808522932028 <at> debbugs.gnu.org>
Resent-Sender: help-debbugs@HIDDEN
To: "Liliana Marie Prikler" <liliana.prikler@HIDDEN>, 52011 <at> debbugs.gnu.org
User-Agent: Cyrus-JMAP/3.5.0-alpha0-1371-g2296cc3491-fm-20211109.003-g2296cc34
Mime-Version: 1.0
Message-Id: <538d2dd4-7777-49ad-b0e5-8ceb12d03c60@HIDDEN>
In-Reply-To: <57fde5d78af3ecc18b57191238cd81b0de65378e.camel@HIDDEN>
References: <46b16bf3-e41c-4ccf-9817-879df6eeb8cb@HIDDEN>
 <57fde5d78af3ecc18b57191238cd81b0de65378e.camel@HIDDEN>
Date: Sun, 28 Nov 2021 11:09:42 +0330
From: "Hamzeh Nasajpour" <h.nasajpour@HIDDEN>
Content-Type: text/plain
Precedence: list
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>

Hi Lillana,

Thanks for your response and sorry for delay.

> We could inject /run/current-system, given that /run likewise ought to be root-writable 
> only, but I'm not sure how much that helps.  The obvious solution is to
> use canonical (store) paths with pkexec.

Honestly, I couldn't find out your solution. Can you clarify it?

Regards,

-- 

Hamzeh Nasajpour
PantherX Team

Message sent to bug-guix@HIDDEN:

X-Loop: help-debbugs@HIDDEN
Subject: bug#52011: pkexec: PATH environment variable
Resent-From: Liliana Marie Prikler <liliana.prikler@HIDDEN>
Original-Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
Resent-CC: bug-guix@HIDDEN
Resent-Date: Fri, 09 Sep 2022 16:11:02 +0000
Resent-Message-ID: <handler.52011.B52011.166273981526780 <at> debbugs.gnu.org>
Resent-Sender: help-debbugs@HIDDEN
X-GNU-PR-Message: followup 52011
X-GNU-PR-Package: guix
X-GNU-PR-Keywords: 
To: Hamzeh Nasajpour <h.nasajpour@HIDDEN>, 52011 <at> debbugs.gnu.org
Received: via spool by 52011-submit <at> debbugs.gnu.org id=B52011.166273981526780
          (code B ref 52011); Fri, 09 Sep 2022 16:11:02 +0000
Received: (at 52011) by debbugs.gnu.org; 9 Sep 2022 16:10:15 +0000
Received: from localhost ([127.0.0.1]:35169 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.84_2)
	(envelope-from <debbugs-submit-bounces <at> debbugs.gnu.org>)
	id 1oWga7-0006xr-1i
	for submit <at> debbugs.gnu.org; Fri, 09 Sep 2022 12:10:15 -0400
Received: from mail-ej1-f65.google.com ([209.85.218.65]:44025)
 by debbugs.gnu.org with esmtp (Exim 4.84_2)
 (envelope-from <liliana.prikler@HIDDEN>) id 1oWga5-0006xT-TD
 for 52011 <at> debbugs.gnu.org; Fri, 09 Sep 2022 12:10:14 -0400
Received: by mail-ej1-f65.google.com with SMTP id v16so5064240ejr.10
 for <52011 <at> debbugs.gnu.org>; Fri, 09 Sep 2022 09:10:13 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112;
 h=content-transfer-encoding:mime-version:user-agent:references
 :in-reply-to:date:to:from:subject:message-id:from:to:cc:subject:date;
 bh=V2YsCNt5t9pj/Uf6o9g+Of5RsLcFd+DZcVRNqo2PkNc=;
 b=aiTL+qcntS+gezaRDSyyeuhl3K4CIpmP85v/YYVFbxwma6Vsd0UcRX/Z2udyulsCxh
 PgAxVXeLwqi5ZBMY4bqtrApT9uL+h5KiRwioJFCMDvBXkU7sjtgZaEHllxNPKXLKDjz+
 j0nQqwXD04md5HYvCZt4GGCa47kzC0E7XzCmAN4+IBXPQDzV6WrW433RQQohZN/dVIjV
 xi/ECJzgGgl5kmnoFsgFFxsVlfL96rZKABj4GM/KaY1/h/RTbJ/ccyaaVaUZ0ibDYZ/u
 o3uZ0vCXK//+k9OfVYzXXXL8NnNwcLPEvE30zsdBaNl1QVJfcCbJyIQ9nb0uFd5d7uMm
 P5sQ==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
 d=1e100.net; s=20210112;
 h=content-transfer-encoding:mime-version:user-agent:references
 :in-reply-to:date:to:from:subject:message-id:x-gm-message-state:from
 :to:cc:subject:date;
 bh=V2YsCNt5t9pj/Uf6o9g+Of5RsLcFd+DZcVRNqo2PkNc=;
 b=oMUGPGovg25lFyJW7lRoHZoynjPlj/N4VWPMKrTaAm9Lw6Tx4kcwUlJTSSEHoX4YjL
 Fz5I9re1EOEPexx2CFqkPVN/OiWR/R2nhknR5/wfuSr/k2viInAVtjy1uKrUL15WHODu
 186W3Q94okjpmzPMGpAJKLQbHQEHwdmzoSWYlPtrf/JGWBxfEO5flXjZsSzoO8SjkLjX
 ALzXT1GHP7Hd036H6S8GEJzg27xNCmoTXkHYnY+8XkkiybSm2LNN2U3NC51O2FERO/6v
 puMp1EjKyi4u12F+sZ8YHlT7OZVNa8QBhsz2ggyJzVQrbpBWSxyJTTSmjjcC6UqRA9La
 61wg==
X-Gm-Message-State: ACgBeo3XbZ3PY579EpnLxXdwYlINjh/WsNa8CAbf9TA+3wIPGc1MYthN
 5r9BdUgrf5lYk0d1cfgMhBs=
X-Google-Smtp-Source: AA6agR4oXhC4QyiUrbH//jPdhReRoAs/dzz3ZCO1VwMsnqL02yi4l/LOokbAVH+p3ub0aMu2QBZp1w==
X-Received: by 2002:a17:906:7304:b0:6ff:a76:5b09 with SMTP id
 di4-20020a170906730400b006ff0a765b09mr10190791ejc.193.1662739807837; 
 Fri, 09 Sep 2022 09:10:07 -0700 (PDT)
Received: from nijino.fritz.box (85-127-52-93.dsl.dynamic.surfer.at.
 [85.127.52.93]) by smtp.gmail.com with ESMTPSA id
 z20-20020a170906715400b0073d65a95161sm421365ejj.222.2022.09.09.09.10.07
 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);
 Fri, 09 Sep 2022 09:10:07 -0700 (PDT)
Message-ID: <0b97c774c903f45cb9ca3efbb12d55459d7d45c8.camel@HIDDEN>
From: Liliana Marie Prikler <liliana.prikler@HIDDEN>
Date: Fri, 09 Sep 2022 18:10:06 +0200
In-Reply-To: <538d2dd4-7777-49ad-b0e5-8ceb12d03c60@HIDDEN>
References: <46b16bf3-e41c-4ccf-9817-879df6eeb8cb@HIDDEN>
 <57fde5d78af3ecc18b57191238cd81b0de65378e.camel@HIDDEN>
 <538d2dd4-7777-49ad-b0e5-8ceb12d03c60@HIDDEN>
Content-Type: text/plain; charset="UTF-8"
User-Agent: Evolution 3.42.1 
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
X-Spam-Score: -0.0 (/)
X-BeenThere: debbugs-submit <at> debbugs.gnu.org
X-Mailman-Version: 2.1.18
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit <at> debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
X-Spam-Score: -1.0 (-)

Am Sonntag, dem 28.11.2021 um 11:09 +0330 schrieb Hamzeh Nasajpour:
> Hi Lillana,
> 
> Thanks for your response and sorry for delay.
> 
> > We could inject /run/current-system, given that /run likewise ought
> > to be root-writable 
> > only, but I'm not sure how much that helps.  The obvious solution
> > is to
> > use canonical (store) paths with pkexec.
> 
> Honestly, I couldn't find out your solution. Can you clarify it?
That is instead of writing "pkexec sh", write "pkexec /run/current-
system/profile/bin/sh" or similar.

Cheers

Last modified: Fri, 9 Sep 2022 16:15:02 UTC

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997 nCipher Corporation Ltd, 1994-97 Ian Jackson.