Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 630812 - app-office/openerp: root privilege escalation via "chown -R" in pkg_postinst
Summary: app-office/openerp: root privilege escalation via "chown -R" in pkg_postinst
Status: RESOLVED OBSOLETE
Alias: None
Product: Gentoo Security
Classification: Unclassified
Component: Auditing (show other bugs)
Hardware: All Linux
: Normal normal
Assignee: Gentoo Security
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2017-09-12 14:56 UTC by Michael Orlitzky
Modified: 2020-04-03 23:25 UTC (History)
2 users (show)

See Also:
Package list:
Runtime testing required: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Michael Orlitzky gentoo-dev 2017-09-12 14:56:14 UTC 
The openerp ebuilds call chown recursively on the live root filesystem in pkg_postinst:

  pkg_postinst() {
      chown -R ${OPENERP_USER}:${OPENERP_GROUP} /etc/openerp
      ...

The "openerp" user can place a hard link in /etc/openerp pointing to a sensitive root-owned file, and the next time that openerp is emerged, that file will be given to the "openerp" user. For example,

  1. emerge openerp
  2. sudo su -s /bin/sh -c 'ln /etc/passwd /etc/openerp/x' openerp
  3. emerge openerp
  4. the file /etc/passwd is owned by openerp:openerp
Comment 1 Michael Orlitzky gentoo-dev 2019-09-14 16:33:22 UTC 
This package was removed almost a year ago:

commit 976bc8af740fe5b78ae71df52e3ca9ad73800051
Author: Virgil Dupras <vdupras@gentoo.org>
Date:   Wed Nov 7 07:22:14 2018 -0500

    app-office/openerp: remove last-rited package

    and orphan dependency.

    Bug: https://bugs.gentoo.org/629270
    Signed-off-by: Virgil Dupras <vdupras@gentoo.org>

 app-office/openerp/Manifest                    |   2 -
 app-office/openerp/files/openerp               |  22 -----
 app-office/openerp/files/openerp-2             |  23 -----
 app-office/openerp/files/openerp-confd         |   3 -
 app-office/openerp/files/openerp-confd-2       |   3 -
 app-office/openerp/files/openerp.cfg           |  64 -------------
 app-office/openerp/files/openerp.cfg.2         |  65 --------------
 app-office/openerp/files/openerp.logrotate     |   9 --
 app-office/openerp/metadata.xml                |   8 --
 app-office/openerp/openerp-7.0.20140125.ebuild | 119 -------------------------
 app-office/openerp/openerp-8.0.20140125.ebuild | 119 -------------------------
 11 files changed, 437 deletions(-)
Comment 2 Robin Johnson archtester Gentoo Infrastructure gentoo-dev Security 2020-04-03 23:25:25 UTC 
unrestricting and re-assigning per bug 705894