731058 – net-proxy/shadowsocks-libev should not be run as root

Bug 731058 - net-proxy/shadowsocks-libev should not be run as root

Summary: net-proxy/shadowsocks-libev should not be run as root

Status:	RESOLVED FIXED

Alias:	None

Product:	Gentoo Security
Classification:	Unclassified
Component:	Default Configs (show other bugs)
Hardware:	All All

Importance:	Normal normal (vote)
Assignee:	Gentoo Security

URL:
Whiteboard:
Keywords:

Depends on:
Blocks:

Reported:	2020-07-06 10:50 UTC by Artem Ilgamov
Modified:	2020-09-28 03:15 UTC (History)
CC List:	3 users (show)

See Also:
Package list:
Runtime testing required:	---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Artem Ilgamov 2020-07-06 10:50:54 UTC

There is no particular reason to run shadowsocks-libev as root whatsoever. Please consider running it as dedicated user or nobody:nogroup to avoid system damage in CVE cases, such as https://bugs.gentoo.org/634422.

Comment 1 John Helmert III archtester

2020-09-21 03:16:25 UTC

Maintainer, please give your input on this.

Comment 2 Yixun Lan archtester

2020-09-26 14:56:29 UTC

(In reply to John Helmert III (ajak) from comment #1)
> Maintainer, please give your input on this.

sounds good to me, I almost have the fixes ready, will push once tested

Comment 3 Larry the Git Cow gentoo-dev

2020-09-27 08:23:35 UTC

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=34fde22d157226fb9bae167225265d6724588186

commit 34fde22d157226fb9bae167225265d6724588186
Author:     Yixun Lan <dlan@gentoo.org>
AuthorDate: 2020-09-26 15:05:20 +0000
Commit:     Yixun Lan <dlan@gentoo.org>
CommitDate: 2020-09-27 08:14:10 +0000

    net-proxy/shadowsocks-libev: run as non-privilege user
    
    * fix security issue, run as non-root user
    * use systemd unit files from the package source
    
    Bug: https://bugs.gentoo.org/731058
    Package-Manager: Portage-3.0.0, Repoman-2.3.23
    Signed-off-by: Yixun Lan <dlan@gentoo.org>

 .../files/shadowsocks-libev-local_at.service                  | 11 -----------
 .../files/shadowsocks-libev-redir_at.service                  | 11 -----------
 .../files/shadowsocks-libev-server_at.service                 | 11 -----------
 .../files/shadowsocks-libev-tunnel_at.service                 | 11 -----------
 net-proxy/shadowsocks-libev/files/shadowsocks.initd           |  9 ++++++---
 ...s-libev-3.3.4.ebuild => shadowsocks-libev-3.3.4-r1.ebuild} | 11 ++++++-----
 6 files changed, 12 insertions(+), 52 deletions(-)

Comment 4 John Helmert III archtester

2020-09-28 03:15:07 UTC

Thanks dlan. Looks like all is fixed here.