[opensuse-security] Change /var/{cache,log}/squid ownership to squid:squid
Hi, Can you take a look? https://bugzilla.opensuse.org/show_bug.cgi?id=918434 Squid daemon having its own exclusive group should allow us drop root group ownership on these folders. Current 13.2 package (3.4.4-3.4.2): # ls -al /var/{cache,log}/squid /var/cache/squid: total 76 drwxr-x--- 18 squid root 4096 Feb 20 07:31 . drwxr-xr-x 8 root root 4096 Feb 20 07:30 .. drwxr-x--- 258 squid nogroup 4096 Feb 20 07:31 00 drwxr-x--- 258 squid nogroup 4096 Feb 20 07:31 01 drwxr-x--- 258 squid nogroup 4096 Feb 20 07:31 02 drwxr-x--- 258 squid nogroup 4096 Feb 20 07:31 03 drwxr-x--- 258 squid nogroup 4096 Feb 20 07:31 04 drwxr-x--- 258 squid nogroup 4096 Feb 20 07:31 05 drwxr-x--- 258 squid nogroup 4096 Feb 20 07:31 06 drwxr-x--- 258 squid nogroup 4096 Feb 20 07:31 07 drwxr-x--- 258 squid nogroup 4096 Feb 20 07:31 08 drwxr-x--- 258 squid nogroup 4096 Feb 20 07:31 09 drwxr-x--- 258 squid nogroup 4096 Feb 20 07:31 0A drwxr-x--- 258 squid nogroup 4096 Feb 20 07:31 0B drwxr-x--- 258 squid nogroup 4096 Feb 20 07:31 0C drwxr-x--- 258 squid nogroup 4096 Feb 20 07:31 0D drwxr-x--- 258 squid nogroup 4096 Feb 20 07:31 0E drwxr-x--- 258 squid nogroup 4096 Feb 20 07:31 0F -rw-r----- 1 squid nogroup 72 Feb 20 07:31 swap.state /var/log/squid: total 96 drwxr-x--- 2 squid root 4096 Feb 20 07:33 . drwxr-xr-x 7 root root 4096 Feb 20 07:33 .. -rw-r----- 1 squid root 0 Feb 20 07:33 access.log -rw-r----- 1 squid nogroup 416 Feb 20 07:32 access.log-20150220.xz -rw-r----- 1 squid root 79913 Feb 20 07:33 cache.log -rw-r----- 1 squid nogroup 1580 Feb 20 07:32 cache.log-20150220.xz After the changes: # ls -al /var/{cache,log}/squid /var/cache/squid: total 76 drwxr-x--- 18 squid squid 4096 Feb 20 07:34 . drwxr-xr-x 8 root root 4096 Feb 20 07:30 .. drwxr-x--- 258 squid squid 4096 Feb 20 07:31 00 drwxr-x--- 258 squid squid 4096 Feb 20 07:31 01 drwxr-x--- 258 squid squid 4096 Feb 20 07:31 02 drwxr-x--- 258 squid squid 4096 Feb 20 07:31 03 drwxr-x--- 258 squid squid 4096 Feb 20 07:31 04 drwxr-x--- 258 squid squid 4096 Feb 20 07:31 05 drwxr-x--- 258 squid squid 4096 Feb 20 07:31 06 drwxr-x--- 258 squid squid 4096 Feb 20 07:31 07 drwxr-x--- 258 squid squid 4096 Feb 20 07:31 08 drwxr-x--- 258 squid squid 4096 Feb 20 07:31 09 drwxr-x--- 258 squid squid 4096 Feb 20 07:31 0A drwxr-x--- 258 squid squid 4096 Feb 20 07:31 0B drwxr-x--- 258 squid squid 4096 Feb 20 07:31 0C drwxr-x--- 258 squid squid 4096 Feb 20 07:31 0D drwxr-x--- 258 squid squid 4096 Feb 20 07:31 0E drwxr-x--- 258 squid squid 4096 Feb 20 07:31 0F -rw-r----- 1 squid squid 72 Feb 20 07:34 swap.state /var/log/squid: total 176 drwxr-x--- 2 squid squid 4096 Feb 19 17:15 . drwxr-xr-x 7 root root 4096 Feb 20 07:33 .. -rw-r----- 1 squid squid 0 Feb 20 07:33 access.log -rw-r----- 1 squid squid 416 Feb 20 07:32 access.log-20150220.xz -rw-r----- 1 squid squid 163672 Feb 20 07:34 cache.log -rw-r----- 1 squid squid 1580 Feb 20 07:32 cache.log-20150220.xz logrotate config fragment is using 'su squid squid' as an extra safety measure. -- To unsubscribe, e-mail: opensuse-security+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse-security+owner@opensuse.org
Marcos Felipe Rasia de Mello schrieb:
[...] /var/log/squid: total 176 drwxr-x--- 2 squid squid 4096 Feb 19 17:15 . drwxr-xr-x 7 root root 4096 Feb 20 07:33 .. -rw-r----- 1 squid squid 0 Feb 20 07:33 access.log -rw-r----- 1 squid squid 416 Feb 20 07:32 access.log-20150220.xz -rw-r----- 1 squid squid 163672 Feb 20 07:34 cache.log -rw-r----- 1 squid squid 1580 Feb 20 07:32 cache.log-20150220.xz
logrotate config fragment is using 'su squid squid' as an extra safety measure.
That is still just a hack though for software that really offers no other choice. In general it's better to not allow the daemon to write to the directory of it's log files. That avoids all kinds of trouble for anything that needs to operate on that directory (like logrotate or rpm but also the admin himself). It also has the benefit that the daemon user cannot corrupt or remove log files that have been rotated, ie can't cover the tracks. cu Ludwig -- (o_ Ludwig Nussel //\ V_/_ http://www.suse.de/ SUSE Linux GmbH, GF: Felix Imendörffer, Jane Smithard, Jennifer Guild, Dilip Upmanyu, Graham Norton, HRB 21284 (AG Nürnberg) Maxfeldstraße 5; 90409 Nürnberg; Germany -- To unsubscribe, e-mail: opensuse-security+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse-security+owner@opensuse.org
2015-02-20 11:53 GMT-02:00 Ludwig Nussel <ludwig.nussel@suse.de>:
Marcos Felipe Rasia de Mello schrieb:
[...] /var/log/squid: total 176 drwxr-x--- 2 squid squid 4096 Feb 19 17:15 . drwxr-xr-x 7 root root 4096 Feb 20 07:33 .. -rw-r----- 1 squid squid 0 Feb 20 07:33 access.log -rw-r----- 1 squid squid 416 Feb 20 07:32 access.log-20150220.xz -rw-r----- 1 squid squid 163672 Feb 20 07:34 cache.log -rw-r----- 1 squid squid 1580 Feb 20 07:32 cache.log-20150220.xz
logrotate config fragment is using 'su squid squid' as an extra safety measure.
That is still just a hack though for software that really offers no other choice. In general it's better to not allow the daemon to write to the directory of it's log files. That avoids all kinds of trouble for anything that needs to operate on that directory (like logrotate or rpm but also the admin himself). It also has the benefit that the daemon user cannot corrupt or remove log files that have been rotated, ie can't cover the tracks.
Does current root group ownership bring any security? What do you think about the proposed changes? -- To unsubscribe, e-mail: opensuse-security+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse-security+owner@opensuse.org
Marcos Felipe Rasia de Mello schrieb:
2015-02-20 11:53 GMT-02:00 Ludwig Nussel <ludwig.nussel@suse.de>:
Marcos Felipe Rasia de Mello schrieb:
[...] /var/log/squid: total 176 drwxr-x--- 2 squid squid 4096 Feb 19 17:15 . drwxr-xr-x 7 root root 4096 Feb 20 07:33 .. -rw-r----- 1 squid squid 0 Feb 20 07:33 access.log -rw-r----- 1 squid squid 416 Feb 20 07:32 access.log-20150220.xz -rw-r----- 1 squid squid 163672 Feb 20 07:34 cache.log -rw-r----- 1 squid squid 1580 Feb 20 07:32 cache.log-20150220.xz
logrotate config fragment is using 'su squid squid' as an extra safety measure.
That is still just a hack though for software that really offers no other choice. In general it's better to not allow the daemon to write to the directory of it's log files. That avoids all kinds of trouble for anything that needs to operate on that directory (like logrotate or rpm but also the admin himself). It also has the benefit that the daemon user cannot corrupt or remove log files that have been rotated, ie can't cover the tracks.
Does current root group ownership bring any security?
No. As I tried to explain if you want to improve security it would be better to change the directory to root:root.
What do you think about the proposed changes?
Looks more or less cosmetic to me. I have no opinion on that :-) cu Ludwig -- (o_ Ludwig Nussel //\ V_/_ http://www.suse.de/ SUSE Linux GmbH, GF: Felix Imendörffer, Jane Smithard, Jennifer Guild, Dilip Upmanyu, Graham Norton, HRB 21284 (AG Nürnberg) Maxfeldstraße 5; 90409 Nürnberg; Germany -- To unsubscribe, e-mail: opensuse-security+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse-security+owner@opensuse.org
2015-02-23 6:52 GMT-03:00 Ludwig Nussel <ludwig.nussel@suse.de>:
Marcos Felipe Rasia de Mello schrieb:
2015-02-20 11:53 GMT-02:00 Ludwig Nussel <ludwig.nussel@suse.de>:
Marcos Felipe Rasia de Mello schrieb:
[...] /var/log/squid: total 176 drwxr-x--- 2 squid squid 4096 Feb 19 17:15 . drwxr-xr-x 7 root root 4096 Feb 20 07:33 .. -rw-r----- 1 squid squid 0 Feb 20 07:33 access.log -rw-r----- 1 squid squid 416 Feb 20 07:32 access.log-20150220.xz -rw-r----- 1 squid squid 163672 Feb 20 07:34 cache.log -rw-r----- 1 squid squid 1580 Feb 20 07:32 cache.log-20150220.xz
logrotate config fragment is using 'su squid squid' as an extra safety measure.
That is still just a hack though for software that really offers no other choice. In general it's better to not allow the daemon to write to the directory of it's log files. That avoids all kinds of trouble for anything that needs to operate on that directory (like logrotate or rpm but also the admin himself). It also has the benefit that the daemon user cannot corrupt or remove log files that have been rotated, ie can't cover the tracks.
Does current root group ownership bring any security?
No. As I tried to explain if you want to improve security it would be better to change the directory to root:root.
What do you think about the proposed changes?
Looks more or less cosmetic to me. I have no opinion on that :-)
Marcus Meissner said on the bug report in question that security team would need to approve it. I call it a cleanup. ;-) -- To unsubscribe, e-mail: opensuse-security+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse-security+owner@opensuse.org
participants (2)
-
Ludwig Nussel -
Marcos Felipe Rasia de Mello