tags 656750 + patch thanks On Mon, 23 Jan 2012 12:55:58 -0500 Daniel Kahn Gillmor <[email protected]> wrote: > On 01/23/2012 12:19 PM, Jameson Graef Rollins wrote: > > It occurs to me that we already have/use a tmp directory in the > > monkeysphere authentication directory > > (/var/lib/monkeysphere/authentication/tmp). Maybe we should just > > explicitly set TMPDIR for the monkeysphere user to be that? > > Doing this and documenting it clearly seems like a reasonable approach > to me. > > --dkg >
The attached patch fixes the problem. Patch sets TMPDIR to /var/lib/monkeysphere/authentication/tmp only when needed, but I have tested other cases where temporary directory was being created. * Need Change - monkeysphere-host: add_revoker: with key from a remote server and with key file. - monkeysphere-host: publish_key: - monkeysphere-authentication: add_certifier: with key from remote server and with key file. * No change needed: - monkeysphere-host: show_key: does not use monkeysphere user. - monkeysphere-host: revoke_key: does not use monkeysphere user. So any temporary directory works. - monkeysphere: import_subkey: does not use monkeysphere user. Not implemented yet. - monkeysphere: gen_subkey: does not use monkeysphere user. - monkeysphere-authentication: update_users: Creates files that are fed to less privileged process via stdin. Could not test properly. With this change, I am hoping for a new release of monkeysphere suitable for FreedomBox in buster. Thanks, -- Sunil
From 34b83f6ee26d527d415f033fd57db6bfe81eed90 Mon Sep 17 00:00:00 2001 From: Sunil Mohan Adapa <[email protected]> Date: Wed, 16 Jan 2019 16:15:21 -0800 Subject: [PATCH] Better sharing of temp directory across root and monkeysphere user In a couple of cases, monkeysphere commands running as run create a temporary directory in TMPDIR (provided by environment) and then change the ownership/permissions on that directory for monkeysphere user to use that directory. This works in a normal setup but fails when libpam-tmpdir is installed. This PAM module causes the tmp directory to be /tmp/user/0/ so that it is harder to for users to access each other temporary files. This improves security but causes problem for above situation as the parent directory of the directory to be shared is not allowed access by other users. To fix this, explicitly set the TMPDIR to a known location that can be used to share files across users. /var/lib/monkeysphere/authentication/tmp is a directory that is already being setup and used for such purposes. Reuse it instead of created a new one. Apply the fix conservatively only in cases needed. Closes: #656750. Signed-off-by: Sunil Mohan Adapa <[email protected]> --- src/monkeysphere-host | 9 +++++++++ src/share/ma/add_certifier | 15 ++++++++++++++- src/share/mh/add_revoker | 13 +++++++------ src/share/mh/publish_key | 1 + 4 files changed, 31 insertions(+), 7 deletions(-) diff --git a/src/monkeysphere-host b/src/monkeysphere-host index 089c2b6..1f47df0 100755 --- a/src/monkeysphere-host +++ b/src/monkeysphere-host @@ -30,6 +30,15 @@ MHSHAREDIR="${SYSSHAREDIR}/mh" # datadir for host functions MHDATADIR="${SYSDATADIR}/host" +# temp directory to enable sharing a temporary directory between root and +# monkeysphere users. This is needed so that on secure environments with +# libpam-tmpdir, simply changing ownership/permissions on a directory is not +# enough to share the directory. Parent directories such as /tmp/user/0 will be +# inaccessible to monkeysphere user. +# +# XXX: Reusing monkeysphere-authentication's tmp directory. +MHTMPDIR="${SYSDATADIR}/authentication/tmp" + # host pub key files HOST_KEY_FILE="${SYSDATADIR}/host_keys.pub.pgp" diff --git a/src/share/ma/add_certifier b/src/share/ma/add_certifier index bd9885c..498bb68 100644 --- a/src/share/ma/add_certifier +++ b/src/share/ma/add_certifier @@ -98,15 +98,28 @@ if [ -f "$keyID" -o "$keyID" = '-' ] ; then log verbose "reading key from file '$keyID'..." fi + TMPDIR=$MATMPDIR + tmpDir=$(msmktempdir) + trap "rm -rf $tmpDir" EXIT + + # fix permissions and ownership on temporary directory which will + # be used by monkeysphere user + chmod 0700 "$tmpDir" + chown "$MONKEYSPHERE_USER":"$MONKEYSPHERE_GROUP" "$tmpDir" + # check the key is ok as monkeysphere user before loading log debug "checking keys in file..." - fingerprint=$(run_as_monkeysphere_user \ + fingerprint=$(run_as_monkeysphere_user /usr/bin/env TMPDIR=$tmpDir \ bash -c "$(printf ". %q && list_primary_fingerprints" "${SYSSHAREDIR}/common")" < "$keyID") if [ $(printf "%s" "$fingerprint" | egrep -c '^[A-F0-9]{40}$') -ne 1 ] ; then failure "There was not exactly one gpg key in the file." fi + # remove the temporary directory + trap - EXIT + rm -rf "$tmpDir" + # load the key gpg_sphere --import <"$keyID" 2>/dev/null \ || failure "could not read key from '$keyID'" diff --git a/src/share/mh/add_revoker b/src/share/mh/add_revoker index 34ecdb9..643f117 100644 --- a/src/share/mh/add_revoker +++ b/src/share/mh/add_revoker @@ -32,9 +32,15 @@ keyID=$(check_key_input "$@") # make a temporary directory for storing keys during import, and set # the trap to delete it on exit +TMPDIR=$MHTMPDIR tmpDir=$(msmktempdir) trap "rm -rf $tmpDir" EXIT +# fix permissions and ownership on temporary directory which will +# be used by monkeysphere user +chmod 0700 "$tmpDir" +chown "$MONKEYSPHERE_USER":"$MONKEYSPHERE_GROUP" "$tmpDir" + # if file is specified if [ -f "$revokerKeyID" -o "$revokerKeyID" = '-' ] ; then # load the key from stdin @@ -51,7 +57,7 @@ if [ -f "$revokerKeyID" -o "$revokerKeyID" = '-' ] ; then # check the key is ok as monkeysphere user before loading log debug "checking keys in file..." - fingerprint=$(run_as_monkeysphere_user \ + fingerprint=$(run_as_monkeysphere_user /usr/bin/env TMPDIR=$tmpDir \ bash -c "$(printf ". %q && list_primary_fingerprints" "${SYSSHAREDIR}/common")" < "$revokerKeyID") if [ $(printf "%s" "$fingerprint" | egrep -c '^[A-F0-9]{40}$') -ne 1 ] ; then @@ -64,11 +70,6 @@ if [ -f "$revokerKeyID" -o "$revokerKeyID" = '-' ] ; then # else, get the revoker key from the keyserver else - # fix permissions and ownership on temporary directory which will - # be used by monkeysphere user for storing the downloaded key - chmod 0700 "$tmpDir" - chown "$MONKEYSPHERE_USER":"$MONKEYSPHERE_GROUP" "$tmpDir" - # download the key from the keyserver as the monkeysphere user log verbose "searching keyserver $KEYSERVER for revoker keyID $revokerKeyID..." run_as_monkeysphere_user /usr/bin/env GNUPGHOME="$tmpDir" gpg --quiet --keyserver "$KEYSERVER" --recv-key "0x${revokerKeyID}!" \ diff --git a/src/share/mh/publish_key b/src/share/mh/publish_key index affb5fb..32caa52 100644 --- a/src/share/mh/publish_key +++ b/src/share/mh/publish_key @@ -31,6 +31,7 @@ else fi # create a temporary gnupg directory from which to publish the key +export TMPDIR=$MHTMPDIR export GNUPGHOME=$(msmktempdir) chmod 0700 "$GNUPGHOME" chown "$MONKEYSPHERE_USER":"$MONKEYSPHERE_GROUP" "$GNUPGHOME" -- 2.20.1
signature.asc
Description: OpenPGP digital signature
