From owner-freebsd-current  Fri Sep 15  5:13: 1 2000
Delivered-To: freebsd-current@freebsd.org
Received: from critter.freebsd.dk (flutter.freebsd.dk [212.242.40.147])
	by hub.freebsd.org (Postfix) with ESMTP id 2B12937B422
	for <freebsd-current@FreeBSD.ORG>; Fri, 15 Sep 2000 05:12:58 -0700 (PDT)
Received: from critter (localhost [127.0.0.1])
	by critter.freebsd.dk (8.11.0/8.9.3) with ESMTP id e8FCCmN62839;
	Fri, 15 Sep 2000 14:12:48 +0200 (CEST)
	(envelope-from phk@critter.freebsd.dk)
To: Alain Thivillon <Alain.Thivillon@hsc.fr>
Cc: freebsd-current@FreeBSD.ORG
Subject: Re: DevFs status and security ? 
In-Reply-To: Your message of "Fri, 15 Sep 2000 13:55:48 +0200."
             <20000915135548.A436@yoko.hsc.fr> 
Date: Fri, 15 Sep 2000 14:12:48 +0200
Message-ID: <62837.969019968@critter>
From: Poul-Henning Kamp <phk@critter.freebsd.dk>
Sender: owner-freebsd-current@FreeBSD.ORG
Precedence: bulk
X-Loop: FreeBSD.ORG


Looks like I forgot an access check in DEVFS.  I'll look at it tonight.

Poul-Henning

In message <20000915135548.A436@yoko.hsc.fr>, Alain Thivillon writes:
>There is a huge security hole in -CURRENT devfs, i don't known if this
>is a temporary issue or a 'real' bug:
>
>$ id
>uid=2089(yann) gid=2089(yann) groups=2089(yann)
>$ uname -a
>FreeBSD yoko.hsc.fr 5.0-CURRENT FreeBSD 5.0-CURRENT #57: Fri Sep 15
>13:36:26 CEST 2000     titi@yoko.hsc.fr:/usr/src/sys/compile/YOKO50
>i386
>$ df
>Filesystem  1K-blocks     Used    Avail Capacity  Mounted on
>/dev/ad0s3a   6252604  5027631   724765    87%    /
>devfs               1        1        0   100%    /dev
>procfs              4        4        0   100%    /proc
>$ ls -l /dev/null
>crw-rw-rw-  1 root  wheel    2,   2 Sep 15 13:47 /dev/null
>$ chown yann /dev/null
>$ chown yann /dev/mem
>$ ls -l /dev/null
>crw-rw-rw-  1 yann  wheel    2,   2 Sep 15 13:47 /dev/null
>$ chmod 600 /dev/null
>$ ls -l /dev/null
>crw-------  1 yann  wheel    2,   2 Sep 15 13:47 /dev/null
>$ strings /dev/mem | head -10
>Read
>Boot
> error
>(TKT
>( CT
>(@;T
>((0S
>(,/S
>(l-S
>(d/S
>
>	Every user can change all owners and perms on devfs files. I
>have verified that /dev/null permissions are REALLY changed (other users
>can not use him) and that Mem can REALLY be read by anyone.
>
>	Did i miss something ? Strange that nobody reported it (my
>problems appeeared when procmail changed perms of /dev/null :))
>
>
>
>To Unsubscribe: send mail to majordomo@FreeBSD.org
>with "unsubscribe freebsd-current" in the body of the message
>

--
Poul-Henning Kamp       | UNIX since Zilog Zeus 3.20
phk@FreeBSD.ORG         | TCP/IP since RFC 956
FreeBSD coreteam member | BSD since 4.3-tahoe    
Never attribute to malice what can adequately be explained by incompetence.


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-current" in the body of the message