Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!

Bug 630912

Summary: net-im/bitlbee: root privilege escalation via "chown -R" in pkg_postinst
Product: Gentoo Security Reporter: Michael Orlitzky <mjo>
Component: AuditingAssignee: Gentoo Security <security>
Severity: normal CC: radhermit, security-audit
Priority: Normal Keywords: PullRequest
Version: unspecified   
Hardware: All   
OS: Linux   
See Also:
Package list:
Runtime testing required: ---

Description Michael Orlitzky gentoo-dev 2017-09-13 17:43:54 UTC
The ebuilds for bitlbee call "chown -R" on the live root filesystem in pkg_postinst:

  pkg_postinst() {
      chown -R bitlbee:bitlbee "${ROOT}"/var/lib/bitlbee

This can be exploited by the "bitlbee" user to gain root. After the package is installed, the "bitlbee" user can place a hard link in /var/lib/bitlbee pointing to a root-owned file. The next time the package is upgraded or reinstalled, the "chown -R" command will give away root's file to "bitlbee". For example,

  1. emerge bitlbee
  2. su -s /bin/sh -c 'ln /etc/passwd /var/lib/bitlbee/x' bitlbee
  3. emerge bitlbee
  4. /etc/password is owned by bitlbee:bitlbee
Comment 1 Robin Johnson archtester Gentoo Infrastructure gentoo-dev Security 2020-04-03 23:16:30 UTC
Unrestricting and reassigning to security@ per bug #705894
Comment 2 Robin Johnson archtester Gentoo Infrastructure gentoo-dev Security 2020-04-03 23:18:36 UTC
unrestricting per bug 705894
Comment 3 Larry the Git Cow gentoo-dev 2020-05-05 08:46:57 UTC
The bug has been closed via the following commit(s):

commit ed6f485c2830f0ae5ba116cc440dfab05bdaa7db
Author:     Petr Vaněk <>
AuthorDate: 2020-05-01 12:04:33 +0000
Commit:     Joonas Niilola <>
CommitDate: 2020-05-05 08:46:35 +0000

    net-im/bitlbee: remove unnecessary chown from pkg_postinst phase
    Package-Manager: Portage-2.3.89, Repoman-2.3.20
    Signed-off-by: Petr Vaněk <>
    Signed-off-by: Joonas Niilola <>

 net-im/bitlbee/bitlbee-3.5.1.ebuild  | 4 ----
 net-im/bitlbee/bitlbee-3.6-r1.ebuild | 4 ----
 net-im/bitlbee/bitlbee-9999.ebuild   | 4 ----
 3 files changed, 12 deletions(-)