Jann, thanks for the comment; I believe the checks aren't strictly necessary; the grep command used to extract one specific variable with the given legal values is the more important part of this patch.
That said, /run/user is a filesystem in its own right, so cross-mount hardlinks aren't possible, and at least on my system, all the directories are mode 700, so hardlinking to another user's file on the filesystem will be difficult. Have you thought of anything else in the meantime? Thanks -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to upstart in Ubuntu. https://bugs.launchpad.net/bugs/1425685 Title: Missing input sanitation in upstart logrotation cronjob Status in upstart package in Ubuntu: Fix Released Bug description: Ubuntu Vivid 1504 (development branch) installs an insecure upstart logrotation script which will read user-supplied data from /run/user/[uid]/upstart/sessions and pass then unsanitized to an env command. As user run directory is user-writable, the user may inject arbitrary commands into the logrotation script, which will be executed during daily cron job execution around midnight with root privileges. Problematic part of /etc/cron.daily/upstart: for session in /run/user/*/upstart/sessions/* do env $(cat $session) /sbin/initctl emit rotate-logs >/dev/null 2>&1 || true done On a system with e.g. libpam-systemd installed, standard login on TTY or via SSH will create the directory /run/user/[uid] writable to the user. By preparing a suitable session file, user supplied code will be run during the daily cron-jobs. See [1] for more information. # lsb_release -rd Description: Ubuntu Vivid Vervet (development branch) Release: 15.04 # apt-cache policy upstart-bin upstart-bin: Installed: 1.13.2-0ubuntu7 Candidate: 1.13.2-0ubuntu7 Version table: *** 1.13.2-0ubuntu7 0 500 http://archive.ubuntu.com/ubuntu/ vivid/main i386 Packages 100 /var/lib/dpkg/status [1] http://www.halfdog.net/Security/2015/UpstartLogrotationPrivilegeEscalation/ To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/upstart/+bug/1425685/+subscriptions -- Mailing list: https://launchpad.net/~touch-packages Post to : touch-packages@lists.launchpad.net Unsubscribe : https://launchpad.net/~touch-packages More help : https://help.launchpad.net/ListHelp
