GNU bug report logs - #18280
chmod: fix symlink race condition

Please note: This is a static page, with minimal formatting, updated once a day.
Click here to see this page with the latest information and nicer formatting.

Package: coreutils; Severity: wishlist; Reported by: Tobias Stoeckmann <tobias@HIDDEN>; Keywords: patch; merged with #11108, #32772; dated Sat, 16 Aug 2014 17:47:02 UTC; Maintainer for coreutils is bug-coreutils@HIDDEN.
Forcibly Merged 11108 18280 32772. Request was from Assaf Gordon <assafgordon@HIDDEN> to control <at> debbugs.gnu.org. Full text available.
Changed bug title to 'chmod: fix symlink race condition' from 'chmod: race condition' Request was from Assaf Gordon <assafgordon@HIDDEN> to control <at> debbugs.gnu.org. Full text available.
Severity set to 'wishlist' from 'normal' Request was from Assaf Gordon <assafgordon@HIDDEN> to control <at> debbugs.gnu.org. Full text available.

Message received at 18280 <at> debbugs.gnu.org:


Received: (at 18280) by debbugs.gnu.org; 17 Aug 2014 14:46:16 +0000
From debbugs-submit-bounces <at> debbugs.gnu.org Sun Aug 17 10:46:15 2014
Received: from localhost ([127.0.0.1]:45557 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.80)
	(envelope-from <debbugs-submit-bounces <at> debbugs.gnu.org>)
	id 1XJ1ip-0003V8-C8
	for submit <at> debbugs.gnu.org; Sun, 17 Aug 2014 10:46:15 -0400
Received: from smtp.cs.ucla.edu ([131.179.128.62]:48534)
 by debbugs.gnu.org with esmtp (Exim 4.80)
 (envelope-from <eggert@HIDDEN>) id 1XJ1il-0003Un-M7
 for 18280 <at> debbugs.gnu.org; Sun, 17 Aug 2014 10:46:12 -0400
Received: from localhost (localhost.localdomain [127.0.0.1])
 by smtp.cs.ucla.edu (Postfix) with ESMTP id E31E3A60010;
 Sun, 17 Aug 2014 07:46:04 -0700 (PDT)
X-Virus-Scanned: amavisd-new at smtp.cs.ucla.edu
Received: from smtp.cs.ucla.edu ([127.0.0.1])
 by localhost (smtp.cs.ucla.edu [127.0.0.1]) (amavisd-new, port 10024)
 with ESMTP id dJWRy89+YOVO; Sun, 17 Aug 2014 07:45:56 -0700 (PDT)
Received: from [192.168.1.9] (pool-71-177-17-123.lsanca.dsl-w.verizon.net
 [71.177.17.123])
 by smtp.cs.ucla.edu (Postfix) with ESMTPSA id 3A60CA6000B;
 Sun, 17 Aug 2014 07:45:56 -0700 (PDT)
Message-ID: <53F0C01C.4040303@HIDDEN>
Date: Sun, 17 Aug 2014 07:45:48 -0700
From: Paul Eggert <eggert@HIDDEN>
Organization: UCLA Computer Science Department
User-Agent: Mozilla/5.0 (X11; Linux x86_64;
 rv:31.0) Gecko/20100101 Thunderbird/31.0
MIME-Version: 1.0
To: Tobias Stoeckmann <tobias@HIDDEN>
Subject: Re: bug#18280: chmod: race condition
References: <20140816174447.GA3384@HIDDEN>
 <53EFC4B3.5060607@HIDDEN> <20140817114612.GA4815@HIDDEN>
In-Reply-To: <20140817114612.GA4815@HIDDEN>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 7bit
X-Spam-Score: -3.0 (---)
X-Debbugs-Envelope-To: 18280
Cc: 18280 <at> debbugs.gnu.org
X-BeenThere: debbugs-submit <at> debbugs.gnu.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <http://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=unsubscribe>
List-Archive: <http://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit <at> debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=help>
List-Subscribe: <http://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
X-Spam-Score: -3.0 (---)

Tobias Stoeckmann wrote:
> For me, it sounds like configure should run a functionality test, calling
> fchmodat with AT_SYMLINK_NOFOLLOW and see if it fails and ENOTSUP is set
> in errno.  In that case, don't call fchmodat or force 0 for flags,
> otherwise use AT_SYMLINK_NOFOLLOW.

Yes, that sounds like a reasonable way to move forward.  At least, that 
is what I was thinking of doing in 2012.  I never got around to it, 
partly because (although it's an improvement) it's not a complete fix 
for the race.




Information forwarded to bug-coreutils@HIDDEN:
bug#18280; Package coreutils. Full text available.

Message received at 18280 <at> debbugs.gnu.org:


Received: (at 18280) by debbugs.gnu.org; 17 Aug 2014 11:46:26 +0000
From debbugs-submit-bounces <at> debbugs.gnu.org Sun Aug 17 07:46:26 2014
Received: from localhost ([127.0.0.1]:45158 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.80)
	(envelope-from <debbugs-submit-bounces <at> debbugs.gnu.org>)
	id 1XIyuo-0006Mv-3W
	for submit <at> debbugs.gnu.org; Sun, 17 Aug 2014 07:46:26 -0400
Received: from mout.kundenserver.de ([212.227.126.187]:62728)
 by debbugs.gnu.org with esmtp (Exim 4.80)
 (envelope-from <tobias@HIDDEN>) id 1XIyul-0006Mf-Ma
 for 18280 <at> debbugs.gnu.org; Sun, 17 Aug 2014 07:46:24 -0400
Received: from fungi.pizza.local (p4FE308F2.dip0.t-ipconnect.de [79.227.8.242])
 by mrelayeu.kundenserver.de (node=mreue006) with ESMTP (Nemesis)
 id 0M8X4h-1WOWXz3loJ-00wG2S; Sun, 17 Aug 2014 13:46:17 +0200
Received: from fungi.pizza.local (localhost [127.0.0.1])
 by fungi.pizza.local (8.14.8/8.14.8) with ESMTP id s7HBkEFM010031;
 Sun, 17 Aug 2014 13:46:14 +0200 (CEST)
Received: (from tobias@localhost)
 by fungi.pizza.local (8.14.8/8.14.8/Submit) id s7HBkD4w004973;
 Sun, 17 Aug 2014 13:46:13 +0200 (CEST)
Date: Sun, 17 Aug 2014 13:46:13 +0200
From: Tobias Stoeckmann <tobias@HIDDEN>
To: Paul Eggert <eggert@HIDDEN>
Subject: Re: bug#18280: chmod: race condition
Message-ID: <20140817114612.GA4815@HIDDEN>
References: <20140816174447.GA3384@HIDDEN>
 <53EFC4B3.5060607@HIDDEN>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <53EFC4B3.5060607@HIDDEN>
User-Agent: Mutt/1.5.22 (2013-10-16)
X-Provags-ID: V02:K0:FETZcAcDS2B279jNUoSTY65tU/PTM+NA92wnTGrTHnl
 VouPF9Jy6ff842sRNU1ODtDaS7u446XR6zLj5YD1K9U4wZQqsx
 ClTZyZpCEnryY71XFrUs8F+OjXpS6DEmj0taN8hj0alIZeo/Xb
 aHnrXfzuWRWWtIS5AGWiZP+fqkyQ5R/3PQK15Qmzqwc9rqAfWD
 RWdG1lKy4dg8wCOYwrnT4UzCj2Nv8W5lqzH07+A5HJcKLGkLrJ
 Qc8/Pvx/lwhI3o6cjaieNZWm0wZqhB9P7yMag2ax6bkvQa49ku
 fg68kV3vU0Lp98TkyJUVlzOCdieqftiVxUUDm982wz/zKO/NU4
 RhmaQ4ElzpmcMpbmYdD5lJFfjUUs9DsErRdrAew5q
X-UI-Out-Filterresults: notjunk:1;
X-Spam-Score: 0.0 (/)
X-Debbugs-Envelope-To: 18280
Cc: 18280 <at> debbugs.gnu.org
X-BeenThere: debbugs-submit <at> debbugs.gnu.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <http://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=unsubscribe>
List-Archive: <http://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit <at> debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=help>
List-Subscribe: <http://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
X-Spam-Score: 0.0 (/)

On Sat, Aug 16, 2014 at 01:53:07PM -0700, Paul Eggert wrote:
> Tobias Stoeckmann wrote:
> >But I will recommend to look into
> >the use of fchmodat() instead, supplying the argument
> >AT_SYMLINK_NOFOLLOW.
> 
> Sorry, that won't work, and this is a known bug.  Please see:
> 
> http://bugs.gnu.org/11108

I investigated into this and installed the mentioned Fedora 17
distribution on a virtual machine.  The bug report is correct, chmod
fails to adjust the permission of files and directories with fchmodat
and AT_SYMLINK_NOFOLLOW in place.

Opening the manual page helped me though:

$ man fchmodat
[...]
AT_SYMLINK_NOFOLLOW
    If pathname is a symbolic link, do not dereference it: instead operate
    on the link itself. This flag is not currently implemented.
[...]
ENOTSUP
    flags specified AT_SYMLINK_NOFOLLOW, which is not supported.


So in short, Fedora 17 and even later versions simply don't support the
flag.  I'm not convinced that due to the lack of implementation of some
systems, everyone should suffer.

For me, it sounds like configure should run a functionality test, calling
fchmodat with AT_SYMLINK_NOFOLLOW and see if it fails and ENOTSUP is set
in errno.  In that case, don't call fchmodat or force 0 for flags,
otherwise use AT_SYMLINK_NOFOLLOW.


Tobias




Information forwarded to bug-coreutils@HIDDEN:
bug#18280; Package coreutils. Full text available.
Forcibly Merged 11108 18280. Request was from Paul Eggert <eggert@HIDDEN> to control <at> debbugs.gnu.org. Full text available.

Message received at 18280 <at> debbugs.gnu.org:


Received: (at 18280) by debbugs.gnu.org; 16 Aug 2014 20:53:22 +0000
From debbugs-submit-bounces <at> debbugs.gnu.org Sat Aug 16 16:53:22 2014
Received: from localhost ([127.0.0.1]:44829 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.80)
	(envelope-from <debbugs-submit-bounces <at> debbugs.gnu.org>)
	id 1XIkyX-0002qQ-KY
	for submit <at> debbugs.gnu.org; Sat, 16 Aug 2014 16:53:21 -0400
Received: from smtp.cs.ucla.edu ([131.179.128.62]:51345)
 by debbugs.gnu.org with esmtp (Exim 4.80)
 (envelope-from <eggert@HIDDEN>) id 1XIkyU-0002pp-NM
 for 18280 <at> debbugs.gnu.org; Sat, 16 Aug 2014 16:53:19 -0400
Received: from localhost (localhost.localdomain [127.0.0.1])
 by smtp.cs.ucla.edu (Postfix) with ESMTP id 9580DA60010;
 Sat, 16 Aug 2014 13:53:12 -0700 (PDT)
X-Virus-Scanned: amavisd-new at smtp.cs.ucla.edu
Received: from smtp.cs.ucla.edu ([127.0.0.1])
 by localhost (smtp.cs.ucla.edu [127.0.0.1]) (amavisd-new, port 10024)
 with ESMTP id QcU0ED2b1LNi; Sat, 16 Aug 2014 13:53:07 -0700 (PDT)
Received: from [192.168.1.9] (pool-71-177-17-123.lsanca.dsl-w.verizon.net
 [71.177.17.123])
 by smtp.cs.ucla.edu (Postfix) with ESMTPSA id C949E39E8011;
 Sat, 16 Aug 2014 13:53:07 -0700 (PDT)
Message-ID: <53EFC4B3.5060607@HIDDEN>
Date: Sat, 16 Aug 2014 13:53:07 -0700
From: Paul Eggert <eggert@HIDDEN>
Organization: UCLA Computer Science Department
User-Agent: Mozilla/5.0 (X11; Linux x86_64;
 rv:31.0) Gecko/20100101 Thunderbird/31.0
MIME-Version: 1.0
To: Tobias Stoeckmann <tobias@HIDDEN>, 18280 <at> debbugs.gnu.org
Subject: Re: bug#18280: chmod: race condition
References: <20140816174447.GA3384@HIDDEN>
In-Reply-To: <20140816174447.GA3384@HIDDEN>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 7bit
X-Spam-Score: -1.3 (-)
X-Debbugs-Envelope-To: 18280
X-BeenThere: debbugs-submit <at> debbugs.gnu.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <http://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=unsubscribe>
List-Archive: <http://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit <at> debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=help>
List-Subscribe: <http://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
X-Spam-Score: -1.3 (-)

Tobias Stoeckmann wrote:
> But I will recommend to look into
> the use of fchmodat() instead, supplying the argument
> AT_SYMLINK_NOFOLLOW.

Sorry, that won't work, and this is a known bug.  Please see:

http://bugs.gnu.org/11108




Information forwarded to bug-coreutils@HIDDEN:
bug#18280; Package coreutils. Full text available.

Message received at submit <at> debbugs.gnu.org:


Received: (at submit) by debbugs.gnu.org; 16 Aug 2014 17:46:28 +0000
From debbugs-submit-bounces <at> debbugs.gnu.org Sat Aug 16 13:46:28 2014
Received: from localhost ([127.0.0.1]:44784 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.80)
	(envelope-from <debbugs-submit-bounces <at> debbugs.gnu.org>)
	id 1XIi3g-0004fD-9b
	for submit <at> debbugs.gnu.org; Sat, 16 Aug 2014 13:46:28 -0400
Received: from eggs.gnu.org ([208.118.235.92]:51059)
 by debbugs.gnu.org with esmtp (Exim 4.80)
 (envelope-from <tobias@HIDDEN>) id 1XIi2e-0004cJ-A4
 for submit <at> debbugs.gnu.org; Sat, 16 Aug 2014 13:45:24 -0400
Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71)
 (envelope-from <tobias@HIDDEN>) id 1XIi2P-00077n-4O
 for submit <at> debbugs.gnu.org; Sat, 16 Aug 2014 13:45:18 -0400
X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on eggs.gnu.org
X-Spam-Level: 
X-Spam-Status: No, score=0.8 required=5.0 tests=BAYES_50 autolearn=disabled
 version=3.3.2
Received: from lists.gnu.org ([2001:4830:134:3::11]:50400)
 by eggs.gnu.org with esmtp (Exim 4.71)
 (envelope-from <tobias@HIDDEN>) id 1XIi2P-00077j-1p
 for submit <at> debbugs.gnu.org; Sat, 16 Aug 2014 13:45:09 -0400
Received: from eggs.gnu.org ([2001:4830:134:3::10]:52767)
 by lists.gnu.org with esmtp (Exim 4.71)
 (envelope-from <tobias@HIDDEN>) id 1XIi2H-0001CC-Gz
 for bug-coreutils@HIDDEN; Sat, 16 Aug 2014 13:45:08 -0400
Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71)
 (envelope-from <tobias@HIDDEN>) id 1XIi2A-0006vh-1h
 for bug-coreutils@HIDDEN; Sat, 16 Aug 2014 13:45:01 -0400
Received: from mout.kundenserver.de ([212.227.126.131]:65358)
 by eggs.gnu.org with esmtp (Exim 4.71)
 (envelope-from <tobias@HIDDEN>) id 1XIi29-0006vS-O7
 for bug-coreutils@HIDDEN; Sat, 16 Aug 2014 13:44:53 -0400
Received: from fungi.pizza.local (p4FE317A0.dip0.t-ipconnect.de
 [79.227.23.160])
 by mrelayeu.kundenserver.de (node=mreue003) with ESMTP (Nemesis)
 id 0LqYDd-1WnTwh44dl-00e8Tr; Sat, 16 Aug 2014 19:44:51 +0200
Received: from fungi.pizza.local (localhost [127.0.0.1])
 by fungi.pizza.local (8.14.8/8.14.8) with ESMTP id s7GHimvM024554
 for <bug-coreutils@HIDDEN>; Sat, 16 Aug 2014 19:44:48 +0200 (CEST)
Received: (from tobias@localhost)
 by fungi.pizza.local (8.14.8/8.14.8/Submit) id s7GHimeo016773
 for bug-coreutils@HIDDEN; Sat, 16 Aug 2014 19:44:48 +0200 (CEST)
Date: Sat, 16 Aug 2014 19:44:47 +0200
From: Tobias Stoeckmann <tobias@HIDDEN>
To: bug-coreutils@HIDDEN
Subject: chmod: race condition
Message-ID: <20140816174447.GA3384@HIDDEN>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
User-Agent: Mutt/1.5.22 (2013-10-16)
X-Provags-ID: V02:K0:XtGISlbyjRYj8uzZD2vayXDdUOUzsgPE0jzFTvPvzni
 7JKKJVDIW6zIeNXuic1k7vKgLYRD9zwlpsS9FS3SU3Cr4DJwCa
 KCbEyolJT0Y+MQlKtnDrP2+4jiPQpIVliGn8Kft3OZ1l8FPAET
 hwO/kbYqRZ1udXW2GGoYxK425WKsvqixzQx2CsRVel2pyiHZo2
 YTLaX20GSu/4cSx0Ullf8OrfXy0BtDUn9qeFJxRxT5pjGvHxiJ
 +vkRFT1uVvxcB0/DvKosucbmOaZwKyWUcqyKyhzRUV7tm3ufJh
 t/MsknO+UQOKo0Lr6IrhYMWFE5dawV4FmLB8yTo8JRsz198y+B
 HncI2Ce5Vzdjx3DBi9U0jBJSjd4cwLG4G5EG0Aoy5tZWv9Ue/m
 qVIKSMggF0Xsg==
X-UI-Out-Filterresults: notjunk:1;
X-detected-operating-system: by eggs.gnu.org: GNU/Linux 3.x [generic]
X-detected-operating-system: by eggs.gnu.org: Error: Malformed IPv6 address
 (bad octet value).
X-Received-From: 2001:4830:134:3::11
X-Spam-Score: -5.0 (-----)
X-Debbugs-Envelope-To: submit
X-Mailman-Approved-At: Sat, 16 Aug 2014 13:46:27 -0400
X-BeenThere: debbugs-submit <at> debbugs.gnu.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <http://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=unsubscribe>
List-Archive: <http://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit <at> debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=help>
List-Subscribe: <http://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
X-Spam-Score: -5.0 (-----)

Hi,

chmod is vulnerable to a TOCTTOU (time of check to time of use) race
condition. Tested this on an OpenBSD system.  For people unfamiliar
with OpenBSD, /etc/master.passwd basically equals /etc/shadow:

# chmod --version | head -n 1
chmod (GNU coreutils) 8.23
# ls -l /etc/master.passwd
-rw-------  1 root  wheel  4244 Jul 23 21:14 /etc/master.passwd
# chmod -R g+w /usr/src
<second console interferes here>
# ls -l /etc/master.passwd
-rw-rw-r--  1 root  wheel  4244 Jul 23 21:14 /etc/master.passwd

$ rm /usr/src/Makefile
$ ln -s /etc/master.passwd /usr/src/Makefile

For the second console, the user belonged to the same group as
/usr/src (wsrc in this example).

The second console is able to modify Makefile because the directory
/usr/src was already made group-writable.

The race happens in src/chmod.c, around function process_file.  Before
it gets called, fts_read() retrieved information about the _file_
Makefile, i.e. before the second console removed it.

Then the file gets replaced by a symlink, pointing to a file we want
to get modified.  Now chmodat() resolves the path again and actually
evaluates the _symlink_.  The destination file /etc/master.passwd can
be happily parsed by the attacker now.


I won't supply a patch now, as I remember that GNU is a bit picky about
accepting patches from everyone.  But I will recommend to look into
the use of fchmodat() instead, supplying the argument
AT_SYMLINK_NOFOLLOW.  We discuss this solution at OpenBSD currently.


Tobias




Acknowledgement sent to Tobias Stoeckmann <tobias@HIDDEN>:
New bug report received and forwarded. Copy sent to bug-coreutils@HIDDEN. Full text available.
Report forwarded to bug-coreutils@HIDDEN:
bug#18280; Package coreutils. Full text available.
Please note: This is a static page, with minimal formatting, updated once a day.
Click here to see this page with the latest information and nicer formatting.
Last modified: Tue, 30 Oct 2018 04:30:02 UTC

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997 nCipher Corporation Ltd, 1994-97 Ian Jackson.