Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 142938 - net-dialup/ppp - pppd permissions
Summary: net-dialup/ppp - pppd permissions
Status: RESOLVED INVALID
Alias: None
Product: Gentoo Linux
Classification: Unclassified
Component: New packages (show other bugs)
Hardware: All Linux
: High normal (vote)
Assignee: Gentoo Dialup Developers
URL:
Whiteboard:
Keywords:
: 143011 (view as bug list)
Depends on:
Blocks:
 
Reported: 2006-08-05 17:12 UTC by Konrad Karczewski
Modified: 2006-08-06 14:01 UTC (History)
0 users

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Konrad Karczewski 2006-08-05 17:12:27 UTC
After ppp installation the pppd has 4511 privileges and belongs to 'root:root'. It would be better to have execution permission limited to the group members by default - there's a 'dialout' group which probably can be used for this purpose. It's not a problem to this by hand but every update will of course 'reset' all changes and this creates a potential security risk.
Comment 1 Alin Năstac (RETIRED) gentoo-dev 2006-08-06 01:18:23 UTC
pppd is used also for PPPoE, PPPoA and PPTP connections, not just for dial-up.
These permissions have been used by all distros since the beggining of time (pppd security track record is fairly clean). 
Comment 2 Jakub Moc (RETIRED) gentoo-dev 2006-08-06 13:22:21 UTC
*** Bug 143011 has been marked as a duplicate of this bug. ***
Comment 3 Konrad Karczewski 2006-08-06 14:01:58 UTC
Well the security track is fairly clean but not entirely spotless. As to the permissions: on Debian they're 4754 and ownership 'root:dip', and in RH 755 - there's no suid.
I don't want to say it's an extremely serious vulnerability but the proposed solution in not very complicated as well. Maybe the hardened team should be involved in this discussion?