Re: [gentoo-user] User eix-sync permissions problem

[Alan McKinnon <alan.mckinnon@gmail.com>]

On 11/02/2014 03:23, Walter Dnes wrote:
> On Tue, Feb 11, 2014 at 12:28:43AM +0000, Kerin Millar wrote
>> On 10/02/2014 23:57, Walter Dnes wrote:
>>>
>>>    What's the point, if you still have to run as root (or su or sudo) for
>>> the emerge update process?
>>
>> It's the principle of least privilege. Is there any specific reason for 
>> portage to fork and exec rsync as root? Is rsync sandboxed? Should rsync 
>> have unfettered read/write access to all mounted filesystems? Can it be 
>> guaranteed that rsync hasn't been compromised? Can it be guaranteed that 
>> PORTAGE_RSYNC_OPTS will contain safe options at all times?
>>
>> The answer to all of these questions is "no". Basically, the combination 
>> of usersync and non-root ownership of PORTDIR hardens the process in a 
>> sensible way while conferring no disadvantage.
> 
>   If /usr/portage is owned by portage:portage, then wouldn't a user
> (member of portage) be able to do mischief by tweaking ebuilds?  E.g.
> modify an ebuild to point to a tarball located on a usb stick, at
> http://127.0.0.1/media/sdc1/my_tarball.tgz.  This would allow a local
> user to supply code that gets built and then installed in /usr/bin, or
> /sbin, etc.
> 

Yes, you can do that. You can also rm with gainful abandon all over the
place and wreak havoc like that. There are many attack vectors involving
user doing dumb things, and no software is ever going to deal fully with
user stupidity or mischief. Modifying an ebuild is no difference
attack-wise to putting it in a local overlay, and you can already do that.

What software security attempts to provide you is protection against
unexpected side-effects like a malformed path (eg unquoted spaces) in an
rm statement run as root, or bad guys out there banging on the door.

Once an attacker can run yoru shell, it's basically game over at that
point wrt security and just a matter of time. So you have a choice
between syncing as a regular user or syncing as root, there are pros and
cons to each. Experience shows that in the general case the former
offers more and better protection. But, if the latter really does suit
your specific needs, then you have the choice to do it that way.

You don't *have* to follow recommendations in man pages at all, but it's
highly recommended you be well informed when making your personal choice.



-- 
Alan McKinnon
alan.mckinnon@gmail.com