Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!

Bug 142938

Summary: net-dialup/ppp - pppd permissions
Product: Gentoo Linux Reporter: Konrad Karczewski <konrad.karczewski>
Component: New packagesAssignee: Gentoo Dialup Developers <net-dialup>
Status: RESOLVED INVALID    
Severity: normal    
Priority: High    
Version: unspecified   
Hardware: All   
OS: Linux   
Whiteboard:
Package list:
Runtime testing required: ---

Description Konrad Karczewski 2006-08-05 17:12:27 UTC
After ppp installation the pppd has 4511 privileges and belongs to 'root:root'. It would be better to have execution permission limited to the group members by default - there's a 'dialout' group which probably can be used for this purpose. It's not a problem to this by hand but every update will of course 'reset' all changes and this creates a potential security risk.
Comment 1 Alin Năstac (RETIRED) gentoo-dev 2006-08-06 01:18:23 UTC
pppd is used also for PPPoE, PPPoA and PPTP connections, not just for dial-up.
These permissions have been used by all distros since the beggining of time (pppd security track record is fairly clean). 
Comment 2 Jakub Moc (RETIRED) gentoo-dev 2006-08-06 13:22:21 UTC
*** Bug 143011 has been marked as a duplicate of this bug. ***
Comment 3 Konrad Karczewski 2006-08-06 14:01:58 UTC
Well the security track is fairly clean but not entirely spotless. As to the permissions: on Debian they're 4754 and ownership 'root:dip', and in RH 755 - there's no suid.
I don't want to say it's an extremely serious vulnerability but the proposed solution in not very complicated as well. Maybe the hardened team should be involved in this discussion?