Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 630912 - net-im/bitlbee: root privilege escalation via "chown -R" in pkg_postinst
Summary: net-im/bitlbee: root privilege escalation via "chown -R" in pkg_postinst
Status: RESOLVED FIXED
Alias: None
Product: Gentoo Security
Classification: Unclassified
Component: Auditing (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: Gentoo Security
URL:
Whiteboard:
Keywords: PullRequest
Depends on:
Blocks:
 
Reported: 2017-09-13 17:43 UTC by Michael Orlitzky
Modified: 2020-05-05 08:46 UTC (History)
2 users (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Michael Orlitzky gentoo-dev 2017-09-13 17:43:54 UTC
The ebuilds for bitlbee call "chown -R" on the live root filesystem in pkg_postinst:

  pkg_postinst() {
      chown -R bitlbee:bitlbee "${ROOT}"/var/lib/bitlbee
      ...

This can be exploited by the "bitlbee" user to gain root. After the package is installed, the "bitlbee" user can place a hard link in /var/lib/bitlbee pointing to a root-owned file. The next time the package is upgraded or reinstalled, the "chown -R" command will give away root's file to "bitlbee". For example,

  1. emerge bitlbee
  2. su -s /bin/sh -c 'ln /etc/passwd /var/lib/bitlbee/x' bitlbee
  3. emerge bitlbee
  4. /etc/password is owned by bitlbee:bitlbee
Comment 1 Robin Johnson archtester Gentoo Infrastructure gentoo-dev Security 2020-04-03 23:16:30 UTC
Unrestricting and reassigning to security@ per bug #705894
Comment 2 Robin Johnson archtester Gentoo Infrastructure gentoo-dev Security 2020-04-03 23:18:36 UTC
unrestricting per bug 705894
Comment 3 Larry the Git Cow gentoo-dev 2020-05-05 08:46:57 UTC
The bug has been closed via the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=ed6f485c2830f0ae5ba116cc440dfab05bdaa7db

commit ed6f485c2830f0ae5ba116cc440dfab05bdaa7db
Author:     Petr Vaněk <arkamar@atlas.cz>
AuthorDate: 2020-05-01 12:04:33 +0000
Commit:     Joonas Niilola <juippis@gentoo.org>
CommitDate: 2020-05-05 08:46:35 +0000

    net-im/bitlbee: remove unnecessary chown from pkg_postinst phase
    
    Closes: https://bugs.gentoo.org/630912
    Package-Manager: Portage-2.3.89, Repoman-2.3.20
    Signed-off-by: Petr Vaněk <arkamar@atlas.cz>
    Closes: https://github.com/gentoo/gentoo/pull/14984
    Signed-off-by: Joonas Niilola <juippis@gentoo.org>

 net-im/bitlbee/bitlbee-3.5.1.ebuild  | 4 ----
 net-im/bitlbee/bitlbee-3.6-r1.ebuild | 4 ----
 net-im/bitlbee/bitlbee-9999.ebuild   | 4 ----
 3 files changed, 12 deletions(-)