Re: strip setuid/setgid bits on backup (was Re: small security-related rsync extension)

2002-07-22 Thread Dave Dykstra
I'm catching up on a couple weeks of rsync messages, and I haven't seen anybody explain in this thread the real problem with .nfs files and executables. With a NFS cluster of machines (at least pre-NFSv4), a software distribution system does have to rename executables that might be running (as op

Re: strip setuid/setgid bits on backup (was Re: small security-related rsync extension)

2002-07-18 Thread Martin Pool
On 16 Jul 2002, Dan Stromberg <[EMAIL PROTECTED]> wrote: > If by sillyrename, you mean busy text files are renamed to .nfs*, "sillyrename" is in fact the technical term for this. I am not making it up. I'm pretty sure Callaghan's book calls it that, Sun people call it that, and it is the term

Re: strip setuid/setgid bits on backup (was Re: small security-related rsync extension)

2002-07-16 Thread Dan Stromberg
On Tue, Jul 16, 2002 at 10:50:03AM +1000, Martin Pool wrote: > On 15 Jul 2002, Dan Stromberg <[EMAIL PROTECTED]> wrote: > > > The issue was that demand > > paging would glitch from .nfs* for no good reason. > > That is an extremely unconvincing argument for changing rsync. > > > > Is it possibl

Re: strip setuid/setgid bits on backup (was Re: small security-related rsync extension)

2002-07-15 Thread Martin Pool
On 15 Jul 2002, Dan Stromberg <[EMAIL PROTECTED]> wrote: > The issue was that demand > paging would glitch from .nfs* for no good reason. That is an extremely unconvincing argument for changing rsync. > > Is it possible to just rsync onto the NFS server, rather than onto the > > clients? That

Re: strip setuid/setgid bits on backup (was Re: small security-related rsync extension)

2002-07-15 Thread Dan Stromberg
On Sat, Jul 13, 2002 at 10:22:29AM +1000, Martin Pool wrote: > On 12 Jul 2002, Dan Stromberg <[EMAIL PROTECTED]> wrote: > > > Because when we update, for example, bash, everbody's bash is going to > > die on them if we don't keep around backups (segfault as you demand page > > from a binary that

Re: strip setuid/setgid bits on backup (was Re: small security-related rsync extension)

2002-07-12 Thread Martin Pool
On 12 Jul 2002, Dan Stromberg <[EMAIL PROTECTED]> wrote: > Because when we update, for example, bash, everbody's bash is going to > die on them if we don't keep around backups (segfault as you demand page > from a binary that has Mostly the Same Stuff in Different Places). rsync creates a new fi

Re: strip setuid/setgid bits on backup (was Re: small security-related rsync extension)

2002-07-12 Thread Martin Pool
On 12 Jul 2002, Ben Escoto <[EMAIL PROTECTED]> wrote: > On Thu, 2002-07-11 at 21:59, Martin Pool wrote: > > I have been thinking about what general strategies software tools use > > to address this problem of focus. They seem to be > > Haven't the rsync people already evalutated some of these op

Re: strip setuid/setgid bits on backup (was Re: small security-related rsync extension)

2002-07-12 Thread Dan Stromberg
On Fri, Jul 12, 2002 at 02:59:11PM +1000, Martin Pool wrote: > On 11 Jul 2002, Dan Stromberg <[EMAIL PROTECTED]> wrote: > > > > I don't get what you are doing. Where did these insecure > > > suid root files come from in the first place? > > > > Have you ever read bugtraq on a regular basis? Th

Re: strip setuid/setgid bits on backup (was Re: small security-related rsync extension)

2002-07-12 Thread Martin Pool
On 11 Jul 2002, Dan Stromberg <[EMAIL PROTECTED]> wrote: > > I don't get what you are doing. Where did these insecure > > suid root files come from in the first place? > > Have you ever read bugtraq on a regular basis? They're coming out of > the woodwork. Another question would be, why do yo

Re: strip setuid/setgid bits on backup (was Re: small security-related rsync extension)

2002-07-12 Thread Dan Stromberg
On Tue, Jul 09, 2002 at 12:20:09PM -0600, Robert Weber wrote: > > > This brings up an issue that I believe can be solved in a simpler way than > > > with brute force C code. I suspect some of you will cringe when you hear > > > this, but a taintperl log parsing program would be best for this. rs

Re: strip setuid/setgid bits on backup (was Re: small security-related rsync extension)

2002-07-11 Thread Martin Pool
On 8 Jul 2002, Dave Dykstra <[EMAIL PROTECTED]> wrote: > The idea of the rsync client executing programs has been descussed before > and rejected because it could easily be done by an external program if > rsync simply passes it filenames. The only case I can see for having rsync > execute progr

Re: strip setuid/setgid bits on backup (was Re: small security-related rsync extension)

2002-07-11 Thread Dan Stromberg
On Tue, Jul 09, 2002 at 02:36:22PM -0700, jw schultz wrote: > On Tue, Jul 09, 2002 at 11:03:25AM -0700, Dan Stromberg wrote: > > On Mon, Jul 08, 2002 at 02:04:57PM -0700, jw schultz wrote: > > > The default behavior should not modify files. The general > > > purpose is to have the copies be the s

Re: strip setuid/setgid bits on backup (was Re: small security-related rsync extension)

2002-07-11 Thread Dan Stromberg
On Tue, Jul 09, 2002 at 05:05:31PM -0600, [EMAIL PROTECTED] wrote: > I vote for the consistent, complete log format as a solution to this sort > of thing, and those who need to take non-rsync related actions based on > what rsync did can write their own applications to do so. > > People keep co

Re: strip setuid/setgid bits on backup (was Re: small security-related rsync extension)

2002-07-09 Thread jw schultz
On Tue, Jul 09, 2002 at 11:03:25AM -0700, Dan Stromberg wrote: > On Mon, Jul 08, 2002 at 02:04:57PM -0700, jw schultz wrote: > > The default behavior should not modify files. The general > > purpose is to have the copies be the same as the original. > > A general --chmod or --pmask option might b

Re: strip setuid/setgid bits on backup (was Re: small security-related rsync extension)

2002-07-09 Thread Robert Weber
> > This brings up an issue that I believe can be solved in a simpler way than > > with brute force C code. I suspect some of you will cringe when you hear > > this, but a taintperl log parsing program would be best for this. rsync > > could generate a verbose log file that is not human readable

Re: strip setuid/setgid bits on backup (was Re: small security-related rsync extension)

2002-07-09 Thread Dan Stromberg
On Mon, Jul 08, 2002 at 02:04:57PM -0700, jw schultz wrote: > The default behavior should not modify files. The general > purpose is to have the copies be the same as the original. > A general --chmod or --pmask option might be acceptable for > modifying the permissions flags but would need to be

Re: strip setuid/setgid bits on backup (was Re: small security-related rsync extension)

2002-07-09 Thread Dan Stromberg
On Tue, Jul 09, 2002 at 09:37:28AM -0600, Robert Weber wrote: > > > > > never seen a file created with a newline in the filename > > > (except, perhaps as a test). The newline in filename issue > > > > And in security exploits :-) Given a newline-based format, one *must* > > quote or deny newl

Re: strip setuid/setgid bits on backup (was Re: small security-related rsync extension)

2002-07-09 Thread Robert Weber
> > > never seen a file created with a newline in the filename > > (except, perhaps as a test). The newline in filename issue > > And in security exploits :-) Given a newline-based format, one *must* > quote or deny newlines in filenames, not assume they're rare. (No > obvious reason not to u

Re: strip setuid/setgid bits on backup (was Re: small security-related rsync extension)

2002-07-08 Thread Mark Eichin
> never seen a file created with a newline in the filename > (except, perhaps as a test). The newline in filename issue And in security exploits :-) Given a newline-based format, one *must* quote or deny newlines in filenames, not assume they're rare. (No obvious reason not to use URL-style %

Re: strip setuid/setgid bits on backup (was Re: small security-related rsync extension)

2002-07-08 Thread jw schultz
On Mon, Jul 08, 2002 at 05:40:58PM -0400, Lenny Foner wrote: > Date: Mon, 8 Jul 2002 21:18:18 +0800 > From: Adrian Ho <[EMAIL PROTECTED]> > > If the sender's/receiver's cwd is guaranteed to be the root of the > corresponding rsync'd hierarchies, then yes, relative paths would >

strip setuid/setgid bits on backup (was Re: small security-related rsync extension)

2002-07-08 Thread Lenny Foner
Date: Mon, 8 Jul 2002 21:18:18 +0800 From: Adrian Ho <[EMAIL PROTECTED]> If the sender's/receiver's cwd is guaranteed to be the root of the corresponding rsync'd hierarchies, then yes, relative paths would suffice. > > UPDATEfoo/ > CREATEfoo/bar1 > UP

Re: strip setuid/setgid bits on backup (was Re: small security-related rsync extension)

2002-07-08 Thread jw schultz
On Mon, Jul 08, 2002 at 05:56:57PM +1000, Martin Pool wrote: > Any thoughts on whether this should go in? I can see arguments either > way. It seems like we ought to think about whether it would be better > to do it as part of a generalized --chmod or --chmod-backup facility. > > > > On 21 Ju

Re: strip setuid/setgid bits on backup (was Re: small security-related rsync extension)

2002-07-08 Thread jw schultz
On Mon, Jul 08, 2002 at 08:52:29AM -0700, Eric Horst wrote: > > Hi, I'm new around here and thought I'd join the discussion. Hope that's > ok. > > > I'm inclined to push for more flexibility with: > > > > --post-process= > > Runs on the receiver just before rsync exits. > > is passe

Re: strip setuid/setgid bits on backup (was Re: small security-related rsync extension)

2002-07-08 Thread Dave Dykstra
The idea of the rsync client executing programs has been descussed before and rejected because it could easily be done by an external program if rsync simply passes it filenames. The only case I can see for having rsync execute programs is in the daemon; that was once approved in principle but no

Re: strip setuid/setgid bits on backup (was Re: small security-related rsync extension)

2002-07-08 Thread jw schultz
On Mon, Jul 08, 2002 at 09:18:18PM +0800, Adrian Ho wrote: > On Mon, Jul 08, 2002 at 03:52:16AM -0700, jw schultz wrote: > > Also the path should not be fully qualified but instead should match > > that of the commandline with cwd the same as the rsync launch. > > If the sender's/receiver's cwd i

Re: strip setuid/setgid bits on backup (was Re: small security-related rsync extension)

2002-07-08 Thread Adrian Ho
On Mon, Jul 08, 2002 at 03:52:16AM -0700, jw schultz wrote: > However, if it lists created, modified and deleted files it will need > to differentiate. It should instead list the files and the action. Well, yeah, that's probably more useful in general. 8-) > Also the path should not be fully q

Re: strip setuid/setgid bits on backup (was Re: small security-related rsync extension)

2002-07-08 Thread jw schultz
On Mon, Jul 08, 2002 at 06:01:48PM +0800, Adrian Ho wrote: > On Mon, Jul 08, 2002 at 05:37:13PM +0800, Adrian Ho wrote: > > I'm inclined to push for more flexibility with: > > Actually, make that: > > --post-send= > --post-recv= > Runs on the sender/receiver just before rsync exits. >

Re: strip setuid/setgid bits on backup (was Re: small security-related rsync extension)

2002-07-08 Thread Adrian Ho
On Mon, Jul 08, 2002 at 05:37:13PM +0800, Adrian Ho wrote: > I'm inclined to push for more flexibility with: Actually, make that: --post-send= --post-recv= Runs on the sender/receiver just before rsync exits. is passed a list of fully-qualified pathnames on stdin (one per line)

Re: strip setuid/setgid bits on backup (was Re: small security-related rsync extension)

2002-07-08 Thread Adrian Ho
On Mon, Jul 08, 2002 at 05:56:57PM +1000, Martin Pool wrote: > Any thoughts on whether this should go in? I can see arguments either > way. It seems like we ought to think about whether it would be better > to do it as part of a generalized --chmod or --chmod-backup facility. I'm inclined to pu

strip setuid/setgid bits on backup (was Re: small security-related rsync extension)

2002-07-08 Thread Martin Pool
Any thoughts on whether this should go in? I can see arguments either way. It seems like we ought to think about whether it would be better to do it as part of a generalized --chmod or --chmod-backup facility. -- Martin On 21 Jun 2002, Dan Stromberg <[EMAIL PROTECTED]> wrote: > Included bel

small security-related rsync extension

2002-06-21 Thread Dan Stromberg
Included below is a shar archive containing two patches that together: 1) make backup files get their setuid and setgid bits stripped by default 2) add a "-s" option that allows backup files to continue to have these privileges This means that if you update a collection of binaries with rsync,