[Bug 1225574] New: AUDIT-FIND: apache2-mod_mono: configuration defaults to predictable socket path in /tmp
https://bugzilla.suse.com/show_bug.cgi?id=1225574 Bug ID: 1225574 Summary: AUDIT-FIND: apache2-mod_mono: configuration defaults to predictable socket path in /tmp Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: security-team@suse.de Reporter: wolfgang.frisch@suse.com QA Contact: qa-bugs@suse.de Target Milestone: --- Found By: --- Blocker: --- apache2-mod_mono, by default, creates a socket `/tmp/mod_mono_server_global`, allowing unprivileged users to break the module by creating an identically named file in that location. However a) this behavior is documented b) it is mitigated by a systemd hardening in the apache2 package:
[Unit] Description=The Apache Webserver After=network.target nss-lookup.target time-sync.target remote-fs.target Before=getty@tty1.service plymouth-quit.service xdm.service PartOf=apache2.target [Service] Type=notify PrivateTmp=true -- You are receiving this mail because: You are on the CC list for the bug.
https://bugzilla.suse.com/show_bug.cgi?id=1225574 Wolfgang Frisch <wolfgang.frisch@suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |IN_PROGRESS -- You are receiving this mail because: You are on the CC list for the bug.
https://bugzilla.suse.com/show_bug.cgi?id=1225574 https://bugzilla.suse.com/show_bug.cgi?id=1225574#c2 Wolfgang Frisch <wolfgang.frisch@suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|IN_PROGRESS |RESOLVED Resolution|--- |WONTFIX --- Comment #2 from Wolfgang Frisch <wolfgang.frisch@suse.com> --- Not following up on this, as it is mitigated by our apache2 systemd config. -- You are receiving this mail because: You are on the CC list for the bug.
https://bugzilla.suse.com/show_bug.cgi?id=1225574 Wolfgang Frisch <wolfgang.frisch@suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Resolution|WONTFIX |--- Status|RESOLVED |REOPENED -- You are receiving this mail because: You are on the CC list for the bug.
https://bugzilla.suse.com/show_bug.cgi?id=1225574 Wolfgang Frisch <wolfgang.frisch@suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Comment #3 is|1 |0 private| | -- You are receiving this mail because: You are on the CC list for the bug.
https://bugzilla.suse.com/show_bug.cgi?id=1225574 https://bugzilla.suse.com/show_bug.cgi?id=1225574#c4 --- Comment #4 from Wolfgang Frisch <wolfgang.frisch@suse.com> --- Side note: When the problem is mitigated by systemd PrivateTmp, the socket and thus the module become quite useless, which is another reason to change the default. -- You are receiving this mail because: You are on the CC list for the bug.
https://bugzilla.suse.com/show_bug.cgi?id=1225574 Wolfgang Frisch <wolfgang.frisch@suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|security-team@suse.de |wolfgang.frisch@suse.com -- You are receiving this mail because: You are on the CC list for the bug.
participants (1)
-
bugzilla_noreply＠suse.com