Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!

Bug 630904

Summary: media-gfx/replicatorg: root privilege escalation via "chown -R" in pkg_postinst
Product: Gentoo Security Reporter: Michael Orlitzky <mjo>
Component: AuditingAssignee: Gentoo Security Audit Team <security-audit>
Status: RESOLVED OBSOLETE    
Severity: normal CC: mgorny
Priority: Normal    
Version: unspecified   
Hardware: All   
OS: Linux   
Whiteboard:
Package list:
Runtime testing required: ---

Description Michael Orlitzky gentoo-dev 2017-09-13 16:43:13 UTC
The replicatorg ebuilds call "chown -R" in pkg_postinst:

  pkg_postinst() {
      ...
      chmod -R g+w "${ROOT}"/opt/replicatorg
      chown -R root:replicator "${ROOT}"/opt/replicatorg

This can be exploited by anyone in the "replicator" group to gain root. A member of that group can place a hard link to a root-owned file under /opt/replicatorg, and the next time the package is upgraded or reinstalled, the "chown -R" will give ownership of root's stuff to the member of the "replicator" group. For example,

  1. emerge replicatorg
  2. add yourself to the "replicator" group
  3. ln /etc/passwd /opt/replicatorg/lib/x
  4. emerge replicatorg
  5. /etc/passwd is group-writable by the "replicator" group

I've marked this private but the package is maintainer-needed, so security@ will need to pick someone to CC.
Comment 1 Michał Górny archtester Gentoo Infrastructure gentoo-dev Security 2018-12-04 16:57:35 UTC
The package has been removed now.
Comment 2 Kristian Fiskerstrand gentoo-dev Security 2019-02-24 21:48:15 UTC
Removing group restriction