894754 – sys-apps/shadow should use capabilities instead of suid root for new{g,u}idmap binaries

Bug 894754 - sys-apps/shadow should use capabilities instead of suid root for new{g,u}idmap binaries

Summary: sys-apps/shadow should use capabilities instead of suid root for new{g,u}idma...

Status:	CONFIRMED

Alias:	None

Product:	Gentoo Linux
Classification:	Unclassified
Component:	Current packages (show other bugs)
Hardware:	All Linux

Importance:	Normal normal
Assignee:	Gentoo's Team for Core System packages

URL:
Whiteboard:
Keywords:

Depends on:
Blocks:

Reported:	2023-02-16 09:33 UTC by Michael Vetter
Modified:	2023-06-17 02:44 UTC (History)
CC List:	2 users (show)

See Also:	564896
Package list:
Runtime testing required:	---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Michael Vetter 2023-02-16 09:33:54 UTC

shadow should use capabilities instead of suid root for new{g,u}idmap binaries.

According to https://github.com/shadow-maint/shadow/blob/master/libmisc/idmapping.c#L124 this is superior from a functionality perspective.

And I think from a security perspective less binaries with suid root are preferable as well.

Reproducible: Always

Comment 1 Sam James archtester

2023-02-16 09:37:43 UTC

We'll have to do it conditionally as not all filesystems support caps. Thanks!

Comment 2 Larry the Git Cow gentoo-dev

2023-06-17 02:40:21 UTC Comment hidden (obsolete)

The bug has been closed via the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=16921604a6bd3ec292570577a472d18aebe60389

commit 16921604a6bd3ec292570577a472d18aebe60389
Author:     Sam James <sam@gentoo.org>
AuthorDate: 2023-06-17 02:29:25 +0000
Commit:     Sam James <sam@gentoo.org>
CommitDate: 2023-06-17 02:32:11 +0000

    sys-apps/shadow: backport password leak fix, backport usermod gid --prefix fix
    
    Bug: https://bugs.gentoo.org/908613
    Closes: https://bugs.gentoo.org/894754
    Signed-off-by: Sam James <sam@gentoo.org>

 .../shadow/files/shadow-4.13-password-leak.patch   | 135 +++++++++++
 .../files/shadow-4.13-usermod-prefix-gid.patch     |  33 +++
 sys-apps/shadow/shadow-4.13-r4.ebuild              | 268 +++++++++++++++++++++
 3 files changed, 436 insertions(+)

Comment 3 Sam James archtester

2023-06-17 02:44:30 UTC

Sorry, tagged wrong bug.