[Bug 580857] New: set /usr/bin/sign to 4750 permission

newer
[Bug 475808] symbol lookup error:...

bugzilla_noreply＠novell.com

18 Feb 2010 18 Feb '10

11:53

http://bugzilla.novell.com/show_bug.cgi?id=580857 http://bugzilla.novell.com/show_bug.cgi?id=580857#c0 Summary: set /usr/bin/sign to 4750 permission Classification: openSUSE Product: openSUSE.org Version: unspecified Platform: Other OS/Version: Other Status: NEW Severity: Major Priority: P5 - None Component: BuildService AssignedTo: meissner@novell.com ReportedBy: adrian@novell.com QAContact: adrian@novell.com CC: mls@novell.com Found By: --- Blocker: --- To avoid user confusion and that the setup of an OBS breaks signing on each update of obs-signd package, I am going to set the sign executable to 4750 permission. This is basically used to open a port <1024 to ensure that a root process is speaking to the remote sign server. This package will also end up in SLE 11 SP1 SDK. You may want to have a review of the package before, look in "openSUSE:Tools" project in the "obs-signd" package if you want to see it. -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

Show replies by date

bugzilla_noreply＠novell.com

18 Feb 18 Feb

11:55

New subject: [Bug 580857] AUDIT-0: require setuid root of /usr/bin/sign to 4750 permission

http://bugzilla.novell.com/show_bug.cgi?id=580857 http://bugzilla.novell.com/show_bug.cgi?id=580857#c1 Marcus Meissner changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |NEEDINFO CC| |meissner@novell.com Info Provider| |adrian@novell.com AssignedTo|meissner@novell.com |security-team@suse.de Summary|set /usr/bin/sign to 4750 |AUDIT-0: require setuid |permission |root of /usr/bin/sign to | |4750 permission --- Comment #1 from Marcus Meissner 2010-02-18 11:55:04 UTC --- where can we find the sourec of the sign binary you want to change? -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

bugzilla_noreply＠novell.com

12:00

New subject: [Bug 580857] AUDIT-0: require setuid root of /usr/bin/sign to 4750 permission

http://bugzilla.novell.com/show_bug.cgi?id=580857 http://bugzilla.novell.com/show_bug.cgi?id=580857#c2 Adrian Schröter changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEEDINFO |NEW Info Provider|adrian@novell.com | --- Comment #2 from Adrian Schröter 2010-02-18 12:00:45 UTC --- in the mentioned OBS project or in git: git clone git://gitorious.org/opensuse/sign.git -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

bugzilla_noreply＠novell.com

22 Feb 22 Feb

13:36

New subject: [Bug 580857] AUDIT-0: require setuid root of /usr/bin/sign to 4750 permission

http://bugzilla.novell.com/show_bug.cgi?id=580857 http://bugzilla.novell.com/show_bug.cgi?id=580857#c3 --- Comment #3 from Ludwig Nussel 2010-02-22 14:36:04 CET --- tell users to add an entry to /etc/permissions.local instead of chmod ... -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

bugzilla_noreply＠novell.com

23 Feb 23 Feb

08:01

New subject: [Bug 580857] AUDIT-0: require setuid root of /usr/bin/sign to 4750 permission

http://bugzilla.novell.com/show_bug.cgi?id=580857 http://bugzilla.novell.com/show_bug.cgi?id=580857#c4 --- Comment #4 from Ludwig Nussel 2010-02-23 09:01:17 CET --- IMO the privileged port thing doesn't justify a setuid bit. Also, same rule as with any other package applies. Since signing is only an optional feature I would not approve shipping a package with the setuid bit set by default. If signd really must not trust the requesting host but only specific processes on such a host some kind of authentication should be used instead. Like e.g. a shared secret. -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

bugzilla_noreply＠novell.com

12 Oct 12 Oct

13:06

New subject: [Bug 580857] AUDIT-0: require setuid root of /usr/bin/sign to 4750 permission

https://bugzilla.novell.com/show_bug.cgi?id=580857 https://bugzilla.novell.com/show_bug.cgi?id=580857#c5 Sebastian Krahmer changed: What |Removed |Added ---------------------------------------------------------------------------- CC|meissner@novell.com |security-team@suse.de AssignedTo|security-team@suse.de |adrian@novell.com --- Comment #5 from Sebastian Krahmer 2010-10-12 13:06:13 UTC --- Can be closed then? -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

bugzilla_noreply＠novell.com

13:22

New subject: [Bug 580857] AUDIT-0: require setuid root of /usr/bin/sign to 4750 permission

https://bugzilla.novell.com/show_bug.cgi?id=580857 https://bugzilla.novell.com/show_bug.cgi?id=580857#c6 Adrian Schröter changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |adrian@novell.com AssignedTo|adrian@novell.com |mls@novell.com --- Comment #6 from Adrian Schröter 2010-10-12 13:22:07 UTC --- well, we don't have an alternative implementation yet (like using SSL with certificate or password). -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

bugzilla_noreply＠novell.com

6 Sep 6 Sep

14:28

New subject: [Bug 580857] AUDIT-0: require setuid root of /usr/bin/sign to 4750 permission

https://bugzilla.novell.com/show_bug.cgi?id=580857 https://bugzilla.novell.com/show_bug.cgi?id=580857#c7 --- Comment #7 from Sebastian Krahmer 2011-09-06 14:28:14 UTC ---

...

From the setuid view its safe, it drops euid and only temporarily re-gains it for low port binds. However wasting a s bit is overkill today, we should prefer the appropriate capability in future.

-- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

bugzilla_noreply＠novell.com

8 Mar 8 Mar

08:59

New subject: [Bug 580857] AUDIT-0: require setuid root of /usr/bin/sign to 4750 permission

https://bugzilla.novell.com/show_bug.cgi?id=580857 https://bugzilla.novell.com/show_bug.cgi?id=580857#c8 Thomas Biege changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |RESOLVED Resolution| |FIXED --- Comment #8 from Thomas Biege 2012-03-08 08:59:22 UTC --- thomas@aleph:~> rpm -q obs-signd obs-signd-2.1.3-5.8.x86_64 thomas@aleph:~> l /usr/bin/sign /usr/sbin/signd -rwsr-x--- 1 root obsrun 47752 3. Feb 15:33 /usr/bin/sign* -rwxr-xr-x 1 root root 17778 3. Feb 15:33 /usr/sbin/signd* For the setuid review we are done. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

4439

Age (days ago)

5188

Last active (days ago)

List overview

Download

8 comments

1 participants

participants (1)

bugzilla_noreply＠novell.com

[Bug 580857] New: set /usr/bin/sign to 4750 permission

tags

participants (1)