27 Dec
2004
27 Dec
'04
9:41 a.m.
Hi,
careful with the linux security module: As reported on Bugtraq,
there's a vulnerability when loading LSM as a module instead of
compiling it into the kernel:
"When POSIX Capability LSM module isn't compiled into kernel, after
inserting Capability module into kernel, all existed normal users
processes will have total Capability privileges of superuser (root)."
Read on here:
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2004-12/0390.h…
Ciao
--
Frank Barknecht _ ______footils.org__
28 Dec
28 Dec
4:28 p.m.
New subject: [linux-audio-dev] LSM: Linux 2.6 Kernel Capability LSM Module Local Privilege Elevation
On Mon, 2004-12-27 at 14:41 +0100, Frank Barknecht wrote:
Wow, this is a HORRIBLE bug.
Lee
5:17 p.m.
New subject: [linux-audio-dev] LSM: Linux 2.6 Kernel Capability LSM Module Local Privilege Elevation
On Tue, 2004-12-28 at 12:28, Lee Revell wrote:
On Mon, 2004-12-27 at 14:41 +0100, Frank Barknecht
wrote:
Wow, this is a HORRIBLE bug.
Indeed. I tried it and it works. Someone should have been pointing a
camera at me to capture the "moment" :-) Spent the better part of
yesterday building new Planet CCRMA kernels without this "feature".
-- Fernando
5:32 p.m.
New subject: [linux-audio-dev] LSM: Linux 2.6 Kernel Capability LSM Module Local Privilege Elevation
On Tue, 2004-12-28 at 13:17 -0800, Fernando Lopez-Lezcano wrote:
On Tue, 2004-12-28 at 12:28, Lee Revell wrote:
Me too. Confirmed it with the brand-new 2.6.10. My jaw hit the desk.
This apparently was never posted to LKML. I just posted it. This
should trigger a 2.6.10.1 IMHO.
Lee
On Mon, 2004-12-27 at 14:41 +0100, Frank
Barknecht wrote:
Wow, this is a HORRIBLE bug.
Indeed. I tried it and it works. Someone should have been pointing a
camera at me to capture the "moment" :-) Spent the better part of
yesterday building new Planet CCRMA kernels without this "feature".
5:35 p.m.
New subject: [linux-audio-dev] LSM: Linux 2.6 Kernel Capability LSM Module Local Privilege Elevation
On Tue, 2004-12-28 at 13:17 -0800, Fernando Lopez-Lezcano wrote:
On Tue, 2004-12-28 at 12:28, Lee Revell wrote:
Yes, fortunately realtime-lsm does not depend on the capability module.
Still, I would expect that many audio users load it out of confusion.
Lee
On Mon, 2004-12-27 at 14:41 +0100, Frank
Barknecht wrote:
Wow, this is a HORRIBLE bug.
Indeed. I tried it and it works. Someone should have been pointing a
camera at me to capture the "moment" :-) Spent the better part of
yesterday building new Planet CCRMA kernels without this "feature".
29 Dec
29 Dec
1:51 a.m.
New subject: [linux-audio-dev] LSM: Linux 2.6 Kernel Capability LSM Module Local Privilege Elevation
On Tue, 2004-12-28 at 13:35, Lee Revell wrote:
On Tue, 2004-12-28 at 13:17 -0800, Fernando
Lopez-Lezcano wrote:
At least in FC3 the capability module is not a module, it is built into
the kernel. Thus the problem, the realtime lsm does not work (tried it)
if capability is built into the kernel, apparently the two modules can't
be stacked, it is one or the other. So, any low latency kernel that
wants to use realtime lsm is, I think, going to be affected.
-- Fernando
On Tue, 2004-12-28 at 12:28, Lee Revell wrote:
Yes, fortunately realtime-lsm does not depend on the capability module.
Still, I would expect that many audio users load it out of confusion. On Mon, 2004-12-27 at 14:41 +0100, Frank
Barknecht wrote:
Wow, this is a HORRIBLE bug.
Indeed. I tried it and it works. Someone should have been pointing a
camera at me to capture the "moment" :-) Spent the better part of
yesterday building new Planet CCRMA kernels without this "feature".
2:15 a.m.
New subject: [linux-audio-dev] LSM: Linux 2.6 Kernel Capability LSM Module Local Privilege Elevation
On Tue, 2004-12-28 at 21:51 -0800, Fernando Lopez-Lezcano wrote:
On Tue, 2004-12-28 at 13:35, Lee Revell wrote:
No, the capability module that is referred to in the advisory is the
POSIX capabilities module. I have this configured as a module on my
system, but never load it, and realtime-lsm does not depend on it.
realtime-lsm only depnds on the "commoncap" module.
Lee
On Tue, 2004-12-28 at 13:17 -0800, Fernando
Lopez-Lezcano wrote:
At least in FC3 the capability module is not a module, it is built into
the kernel. Thus the problem, the realtime lsm does not work (tried it)
if capability is built into the kernel, apparently the two modules can't
be stacked, it is one or the other. So, any low latency kernel that
wants to use realtime lsm is, I think, going to be affected. On Tue, 2004-12-28 at 12:28, Lee Revell wrote:
Yes, fortunately realtime-lsm does not depend on the capability module.
Still, I would expect that many audio users load it out of confusion. On Mon, 2004-12-27 at 14:41 +0100, Frank
Barknecht wrote:
> Read on here:
> http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2004-12/0390.h…
Wow, this is a HORRIBLE bug.
Indeed. I tried it and it works. Someone should have been pointing a
camera at me to capture the "moment" :-) Spent the better part of
yesterday building new Planet CCRMA kernels without this "feature".
3:36 a.m.
New subject: [linux-audio-dev] LSM: Linux 2.6 Kernel Capability LSM Module Local Privilege Elevation
On Tue, 2004-12-28 at 22:15, Lee Revell wrote:
On Tue, 2004-12-28 at 21:51 -0800, Fernando
Lopez-Lezcano wrote:
On Tue, 2004-12-28 at 13:35, Lee Revell wrote:
No, the capability module that is referred to in the advisory is the
POSIX capabilities module. I have this configured as a module on my
system, but never load it and realtime-lsm does not depend on it.
realtime-lsm only depnds on the "commoncap" module. On Tue, 2004-12-28 at 13:17 -0800, Fernando
Lopez-Lezcano wrote:
At least in FC3 the capability module is not a module, it is built into
the kernel. Thus the problem, the realtime lsm does not work (tried it)
if capability is built into the kernel, apparently the two modules can't
be stacked, it is one or the other. So, any low latency kernel that
wants to use realtime lsm is, I think, going to be affected. On Tue, 2004-12-28 at 12:28, Lee Revell wrote:
> On Mon, 2004-12-27 at 14:41 +0100, Frank Barknecht wrote:
> > Read on here:
> > http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2004-12/0390.h…
>
> Wow, this is a HORRIBLE bug.
Indeed. I tried it and it works. Someone should have been pointing a
camera at me to capture the "moment" :-) Spent the better part of
yesterday building new Planet CCRMA kernels without this "feature".
Yes, fortunately realtime-lsm does not depend on the capability module.
Still, I would expect that many audio users load it out of confusion. > So, any low latency kernel that
> wants to use realtime lsm is, I think, going to be affected.
Why I think this is a yes. Any kernel that wants to use the realtime-lsm
will have to either not build the POSIX capabilities lsm, or build it as
a module. In the later case the system will be vulnerable. The
realtime-lsm does not depend on the POSIX capabilities lsm but it forces
you to build it as a module, exposing the vulnerability, which maybe I
misunderstood as not being present if you build with the POSIX lsm into
the kernel (as opposed to building it as a module).
I do understand that loading the realtime lsm only does not create a
vulnerability (other than well known possibilities of DOS attacks by
mean linux audio users :-)
-- Fernando
5:22 a.m.
New subject: [linux-audio-dev] LSM: Linux 2.6 Kernel Capability LSM Module Local Privilege Elevation
On Tue, 2004-12-28 at 23:36 -0800, Fernando Lopez-Lezcano wrote:
Any kernel that wants to use the realtime-lsm
will have to either not build the POSIX capabilities lsm, or build it as
a module. In the later case the system will be vulnerable. The
realtime-lsm does not depend on the POSIX capabilities lsm but it forces
you to build it as a module, exposing the vulnerability, which maybe I
misunderstood as not being present if you build with the POSIX lsm into
the kernel (as opposed to building it as a module).
I do understand that loading the realtime lsm only does not create a
vulnerability (other than well known possibilities of DOS attacks by
mean linux audio users :-)
OK, that is a clearer explanation than mine ;-)
Anyway the kernel folks don't seem worried.
Lee
12:53 p.m.
New subject: [linux-audio-dev] LSM: Linux 2.6 Kernel Capability LSM Module Local Privilege Elevation
On Wed, 2004-12-29 at 04:21 -0500, Lee Revell wrote:
On Tue, 2004-12-28 at 23:36 -0800, Fernando
Lopez-Lezcano wrote:
Spoke too soon. Here's the fix:
http://lkml.org/lkml/2004/12/29/59
Lee
Any kernel that wants to use the realtime-lsm
will have to either not build the POSIX capabilities lsm, or build it as
a module. In the later case the system will be vulnerable. The
realtime-lsm does not depend on the POSIX capabilities lsm but it forces
you to build it as a module, exposing the vulnerability, which maybe I
misunderstood as not being present if you build with the POSIX lsm into
the kernel (as opposed to building it as a module).
I do understand that loading the realtime lsm only does not create a
vulnerability (other than well known possibilities of DOS attacks by
mean linux audio users :-)
OK, that is a clearer explanation than mine ;-)
Anyway the kernel folks don't seem worried.
6:07 a.m.
New subject: [linux-audio-dev] LSM: Linux 2.6 Kernel Capability LSM Module Local Privilege Elevation
Hallo,
Fernando Lopez-Lezcano hat gesagt: // Fernando Lopez-Lezcano wrote:
Why I think this is a yes. Any kernel that wants to
use the realtime-lsm
will have to either not build the POSIX capabilities lsm, or build it as
a module. In the later case the system will be vulnerable. The
realtime-lsm does not depend on the POSIX capabilities lsm but it forces
you to build it as a module,
I don't understand: Why does it do so? Shouldn't this be "fixed" in
the realtime-lsm then?
Ciao
--
Frank Barknecht _ ______footils.org__
2:55 p.m.
New subject: [linux-audio-dev] LSM: Linux 2.6 Kernel Capability LSM Module Local Privilege Elevation
On Wed, 2004-12-29 at 02:07, Frank Barknecht wrote:
Hallo,
Fernando Lopez-Lezcano hat gesagt: // Fernando Lopez-Lezcano wrote:
I don't understand the technical details. I did try this last week but
it does not work, you can either have the POSIX lsm or the realtime lsm
subscribed as a secondary module (whatever that is), but not both at the
same time. Apparently (Jack O'Quinn told me this) the modules can't
currently be stacked. I suspect this is not an issue with the
realtime-lsm module but with the underlying kernel support.
-- Fernando
Why I think this is a yes. Any kernel that wants
to use the realtime-lsm
will have to either not build the POSIX capabilities lsm, or build it as
a module. In the later case the system will be vulnerable. The
realtime-lsm does not depend on the POSIX capabilities lsm but it forces
you to build it as a module,
I don't understand: Why does it do so? Shouldn't this be "fixed" in
the realtime-lsm then?
3:09 p.m.
New subject: [linux-audio-dev] LSM: Linux 2.6 Kernel Capability LSM Module Local Privilege Elevation
On Wed, 2004-12-29 at 10:54 -0800, Fernando Lopez-Lezcano wrote:
On Wed, 2004-12-29 at 02:07, Frank Barknecht wrote:
I think it's actually an issue with the POSIX capabilities module,
there's nothing the realtime LSM can do about it. For example you can
load realtime LSM on top of SELinux.
Lee
Hallo,
Fernando Lopez-Lezcano hat gesagt: // Fernando Lopez-Lezcano wrote:
I don't understand the technical details. I did try this last week but
it does not work, you can either have the POSIX lsm or the realtime lsm
subscribed as a secondary module (whatever that is), but not both at the
same time. Apparently (Jack O'Quinn told me this) the modules can't
currently be stacked. I suspect this is not an issue with the
realtime-lsm module but with the underlying kernel support.
Why I think this is a yes. Any kernel that wants
to use the realtime-lsm
will have to either not build the POSIX capabilities lsm, or build it as
a module. In the later case the system will be vulnerable. The
realtime-lsm does not depend on the POSIX capabilities lsm but it forces
you to build it as a module,
I don't understand: Why does it do so? Shouldn't this be "fixed" in
the realtime-lsm then? 
3:47 p.m.
New subject: [linux-audio-dev] LSM: Linux 2.6 Kernel Capability LSM Module Local Privilege Elevation
Fernando Lopez-Lezcano <nando(a)ccrma.stanford.edu> writes:
I don't understand the technical details. I did
try this last week but
it does not work, you can either have the POSIX lsm or the realtime lsm
subscribed as a secondary module (whatever that is), but not both at the
same time. Apparently (Jack O'Quinn told me this) the modules can't
currently be stacked. I suspect this is not an issue with the
realtime-lsm module but with the underlying kernel support.
Could you try building *without* `capability', using `realtime'
instead?
--
joq
30 Dec
30 Dec
11:27 a.m.
New subject: [linux-audio-dev] LSM: Linux 2.6 Kernel Capability LSM Module Local Privilege Elevation
On Wed, 29 Dec 2004 at 11:07 +0100, Frank Barknecht wrote:
Hallo,
Fernando Lopez-Lezcano hat gesagt: // Fernando Lopez-Lezcano wrote:
Someone please correct me if I'm wrong, but it just looks like a case of a
simplistic check. It doesn't look like realtime-lsm really depends on
posix capabilities being compiled as a module, but on posix capabilities
not being compiled in. So I'm going to try this patch (it builds, we'll
see if it works fine, but I suspect it will):
diff -u /tmp/realtime-lsm-0.8.5/Makefile realtime-lsm-0.8.5/Makefile
--- /tmp/realtime-lsm-0.8.5/Makefile 2004-11-24 11:38:41.000000000 -0700
+++ realtime-lsm-0.8.5/Makefile 2004-12-30 08:22:58.000000000 -0700
@@ -20,7 +20,7 @@
$(MAKE) modules -C $(KERNEL_DIR) SUBDIRS=$(shell pwd)
config:
- @if grep CONFIG_SECURITY_CAPABILITIES=m $(KERNEL_DIR)/.config; \
+ @if ! grep CONFIG_SECURITY_CAPABILITIES=y $(KERNEL_DIR)/.config; \
then ln -sf $(KERNEL_DIR)/security/$(COMMONCAP) .; \
else echo "Failed: Security Capabilities not configured as module"; \
echo "Realtime LSM will not work with $(KERNEL_DIR)"; \
--
.O. Hans Fugal | De gustibus non disputandum est.
..O http://hans.fugal.net | Debian, vim, mutt, ruby, text, gpg
OOO | WindowMaker, gaim, UTF-8, RISC, JS Bach
---------------------------------------------------------------------
GnuPG Fingerprint: 6940 87C5 6610 567F 1E95 CB5E FC98 E8CD E0AA D460
Why I think this is a yes. Any kernel that wants
to use the realtime-lsm
will have to either not build the POSIX capabilities lsm, or build it as
a module. In the later case the system will be vulnerable. The
realtime-lsm does not depend on the POSIX capabilities lsm but it forces
you to build it as a module,
I don't understand: Why does it do so? Shouldn't this be "fixed" in
the realtime-lsm then?
12:18 p.m.
New subject: [linux-audio-dev] LSM: Linux 2.6 Kernel Capability LSM Module Local Privilege Elevation
Hans Fugal <hans(a)fugal.net> writes:
On Wed, 29 Dec 2004 at 11:07 +0100, Frank Barknecht
wrote:
> Hallo,
> Fernando Lopez-Lezcano hat gesagt: // Fernando Lopez-Lezcano wrote:
>
> > Why I think this is a yes. Any kernel that wants to use the realtime-lsm
> > will have to either not build the POSIX capabilities lsm, or build it as
> > a module. In the later case the system will be vulnerable. The
> > realtime-lsm does not depend on the POSIX capabilities lsm but it forces
> > you to build it as a module,
>
> I don't understand: Why does it do so? Shouldn't this be "fixed"
in
> the realtime-lsm then?
Actually, the bug is not in either. The "fix" is in security/dummy.c.
Someone please correct me if I'm wrong, but it
just looks like a case of a
simplistic check. It doesn't look like realtime-lsm really depends on
posix capabilities being compiled as a module, but on posix capabilities
not being compiled in. So I'm going to try this patch (it builds, we'll
see if it works fine, but I suspect it will):
The actual source code is in security/Kconfig...
config SECURITY_REALTIME
tristate "Realtime Capabilities"
depends on SECURITY && SECURITY_CAPABILITIES!=y
default n
help
This module selectively grants realtime privileges
controlled by parameters set at load time or via files in
/sys/module/realtime/parameters.
If you are unsure how to answer this question, answer N.
The reason for this check is that realtime-lsm does not work when the
capability LSM is installed built-in (i.e. not as a module). I am not
a wizard at Kconfig. Perhaps someone more skilled in this area can
explain what to do. Note that capability is not needed when realtime
is installed.
--
joq
1:28 p.m.
New subject: [linux-audio-dev] LSM: Linux 2.6 Kernel Capability LSM Module Local Privilege Elevation
I was actually working with the 0.8.5 tarball outside of the kernel.
There doesn't seem to be any problem with SECURITY_CAPABILITIES=n when
using the realtime-lsm 2.6.10 patch. (Again, I built but didn't reboot
to test)
On Thu, 30 Dec 2004 at 10:20 -0600, Jack O'Quin wrote:
Hans Fugal <hans(a)fugal.net> writes:
--
.O. Hans Fugal | De gustibus non disputandum est.
..O http://hans.fugal.net | Debian, vim, mutt, ruby, text, gpg
OOO | WindowMaker, gaim, UTF-8, RISC, JS Bach
---------------------------------------------------------------------
GnuPG Fingerprint: 6940 87C5 6610 567F 1E95 CB5E FC98 E8CD E0AA D460
On Wed, 29 Dec 2004 at 11:07 +0100, Frank
Barknecht wrote:
> Hallo,
> Fernando Lopez-Lezcano hat gesagt: // Fernando Lopez-Lezcano wrote:
>
> > Why I think this is a yes. Any kernel that wants to use the realtime-lsm
> > will have to either not build the POSIX capabilities lsm, or build it as
> > a module. In the later case the system will be vulnerable. The
> > realtime-lsm does not depend on the POSIX capabilities lsm but it forces
> > you to build it as a module,
>
> I don't understand: Why does it do so? Shouldn't this be "fixed"
in
> the realtime-lsm then?
Actually, the bug is not in either. The "fix" is in security/dummy.c.
Someone please correct me if I'm wrong, but
it just looks like a case of a
simplistic check. It doesn't look like realtime-lsm really depends on
posix capabilities being compiled as a module, but on posix capabilities
not being compiled in. So I'm going to try this patch (it builds, we'll
see if it works fine, but I suspect it will):
The actual source code is in security/Kconfig...
config SECURITY_REALTIME
tristate "Realtime Capabilities"
depends on SECURITY && SECURITY_CAPABILITIES!=y
default n
help
This module selectively grants realtime privileges
controlled by parameters set at load time or via files in
/sys/module/realtime/parameters.
If you are unsure how to answer this question, answer N.
The reason for this check is that realtime-lsm does not work when the
capability LSM is installed built-in (i.e. not as a module). I am not
a wizard at Kconfig. Perhaps someone more skilled in this area can
explain what to do. Note that capability is not needed when realtime
is installed.
--
joq
28 Dec
28 Dec
5:36 p.m.
New subject: [linux-audio-dev] LSM: Linux 2.6 Kernel Capability LSM Module Local Privilege Elevation
Hallo,
Fernando Lopez-Lezcano hat gesagt: // Fernando Lopez-Lezcano wrote:
On Tue, 2004-12-28 at 12:28, Lee Revell wrote:
Oh, it seems to be not *that* bad, however. See this discussion on the
linux-security-module list: http://tinyurl.com/5ey2b
I admit, I'm not much smarter than before, though...
Ciao
--
Frank Barknecht _ ______footils.org__
On Mon, 2004-12-27 at 14:41 +0100, Frank
Barknecht wrote:
Wow, this is a HORRIBLE bug.
Indeed. I tried it and it works. Someone should have been pointing a
camera at me to capture the "moment" :-) Spent the better part of
yesterday building new Planet CCRMA kernels without this "feature".
5:46 p.m.
New subject: [linux-audio-dev] LSM: Linux 2.6 Kernel Capability LSM Module Local Privilege Elevation
On Tue, 2004-12-28 at 22:36 +0100, Frank Barknecht wrote:
Hallo,
Fernando Lopez-Lezcano hat gesagt: // Fernando Lopez-Lezcano wrote:
Well, just because the NSA guy would not do that on his system, does not
mean it isn't a problem for Joe User. ;-)
Lee
On Tue, 2004-12-28 at 12:28, Lee Revell wrote:
Oh, it seems to be not *that* bad, however. See this discussion on the
linux-security-module list: http://tinyurl.com/5ey2b On Mon, 2004-12-27 at 14:41 +0100, Frank
Barknecht wrote:
Wow, this is a HORRIBLE bug.
Indeed. I tried it and it works. Someone should have been pointing a
camera at me to capture the "moment" :-) Spent the better part of
yesterday building new Planet CCRMA kernels without this "feature".
7297
days inactive
7300
days old
linux-audio-dev@lists.linuxaudio.org
18 comments
5 participants
participants (5)
-
Fernando Lopez-Lezcano -
Frank Barknecht -
Hans Fugal -
Jack O'Quin -
Lee Revell