* [gentoo-user] gentoo netheck
[not found] <50E32270.8000500@gmail.com>
@ 2013-01-01 18:01 ` Analuin Abyssbeholder
2013-01-01 18:12 ` Analuin Abyssbeholder
2013-01-01 18:44 ` Bryan Gardiner
0 siblings, 2 replies; 6+ messages in thread
From: Analuin Abyssbeholder @ 2013-01-01 18:01 UTC (permalink / raw
To: gentoo-user
[-- Attachment #1: Type: text/plain, Size: 586 bytes --]
Today I wanted to install nethack and found it is masked:
The following mask changes are necessary to proceed:
#required by nethack (argument)
# /usr/portage/profiles/package.mask:
# Tavis Ormandy <taviso@gentoo.org> <taviso@gentoo.org> (21 Mar 2006)
# masked pending unresolved security issues #125902
=games-roguelike/nethack-3.4.3-r1
Then I googled and view https://bugs.gentoo.org/show_bug.cgi?id=125902#c82.
It turned out the bug has been existed for more than six years and is
related to gentoo's group game policy. So can I just manually install
nethack as a common user ?
[-- Attachment #2: Type: text/html, Size: 967 bytes --]
^ permalink raw reply [flat|nested] 6+ messages in thread
* [gentoo-user] gentoo netheck
2013-01-01 18:01 ` [gentoo-user] gentoo netheck Analuin Abyssbeholder
@ 2013-01-01 18:12 ` Analuin Abyssbeholder
2013-01-01 18:44 ` Bryan Gardiner
1 sibling, 0 replies; 6+ messages in thread
From: Analuin Abyssbeholder @ 2013-01-01 18:12 UTC (permalink / raw
To: gentoo-user
[-- Attachment #1: Type: text/plain, Size: 672 bytes --]
I'm sorry for the last email. My gmail made a mistake by sending an
incomplete draft.
Today I wanted to install nethack and found it is masked:
The following mask changes are necessary to proceed:
#required by nethack (argument)
# /usr/portage/profiles/package.mask:
# Tavis Ormandy <taviso@gentoo.org> <taviso@gentoo.org> (21 Mar 2006)
# masked pending unresolved security issues #125902
=games-roguelike/nethack-3.4.3-r1
Then I googled and view https://bugs.gentoo.org/show_bug.cgi?id=125902#c82.
It turned out the bug has been existed for more than six years and is
related to gentoo's group game policy. So can I just manually install
nethack as a common user ?
[-- Attachment #2: Type: text/html, Size: 1053 bytes --]
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [gentoo-user] gentoo netheck
2013-01-01 18:01 ` [gentoo-user] gentoo netheck Analuin Abyssbeholder
2013-01-01 18:12 ` Analuin Abyssbeholder
@ 2013-01-01 18:44 ` Bryan Gardiner
2013-01-01 22:28 ` [gentoo-user] " Nuno J. Silva
1 sibling, 1 reply; 6+ messages in thread
From: Bryan Gardiner @ 2013-01-01 18:44 UTC (permalink / raw
To: gentoo-user
On Wed, 2 Jan 2013 02:01:52 +0800
Analuin Abyssbeholder <cntqrxj@gmail.com> wrote:
> Today I wanted to install nethack and found it is masked:
>
> The following mask changes are necessary to proceed:
> #required by nethack (argument)
> # /usr/portage/profiles/package.mask:
> # Tavis Ormandy <taviso@gentoo.org> <taviso@gentoo.org> (21 Mar 2006)
> # masked pending unresolved security issues #125902
> =games-roguelike/nethack-3.4.3-r1
>
> Then I googled and view
> https://bugs.gentoo.org/show_bug.cgi?id=125902#c82.
>
> It turned out the bug has been existed for more than six years and is
> related to gentoo's group game policy. So can I just manually install
> nethack as a common user ?
If you're the only user of your computer, you could also just unmask
the version in Portage. The bug is that any user in the games group
can edit all save files, so if you want to hack your own saves, go
ahead :). Or if you trust all games users.
Doesn't look like there's any newer version of NetHack out, either.
Cheers,
Bryan
^ permalink raw reply [flat|nested] 6+ messages in thread
* [gentoo-user] Re: gentoo netheck
2013-01-01 18:44 ` Bryan Gardiner
@ 2013-01-01 22:28 ` Nuno J. Silva
2013-01-02 1:21 ` Philip Webb
0 siblings, 1 reply; 6+ messages in thread
From: Nuno J. Silva @ 2013-01-01 22:28 UTC (permalink / raw
To: gentoo-user
On 2013-01-01, Bryan Gardiner wrote:
> On Wed, 2 Jan 2013 02:01:52 +0800
> Analuin Abyssbeholder <cntqrxj@gmail.com> wrote:
>
>> Today I wanted to install nethack and found it is masked:
>>
>> The following mask changes are necessary to proceed:
>> #required by nethack (argument)
>> # /usr/portage/profiles/package.mask:
>> # Tavis Ormandy <taviso@gentoo.org> <taviso@gentoo.org> (21 Mar 2006)
>> # masked pending unresolved security issues #125902
>> =games-roguelike/nethack-3.4.3-r1
>>
>> Then I googled and view
>> https://bugs.gentoo.org/show_bug.cgi?id=125902#c82.
Well, you could have just gone to bugs.gentoo.org and searched for
125902 :-)
>> It turned out the bug has been existed for more than six years and is
>> related to gentoo's group game policy. So can I just manually install
>> nethack as a common user ?
>
> If you're the only user of your computer, you could also just unmask
> the version in Portage. The bug is that any user in the games group
> can edit all save files, so if you want to hack your own saves, go
> ahead :). Or if you trust all games users.
The main problem is not the cheating, but that nethack does not employ
any kind of checks on the scores file when reading it, this effectively
enables an attack vector where anyone with access to the scores file can
exploit vulnerabilities in nethack simply by writing a specially-crafted
score file.
Nethack just relies on being setgid to a group and installing the scores
file as writeable by that group. Unfortunately, that happens to be the
very same "games" group Gentoo uses to group users who are allowed to
play games, therefore rendering nethack's protection useless.
>
> Doesn't look like there's any newer version of NetHack out, either.
>
> Cheers,
> Bryan
>
>
--
Nuno Silva (aka njsg)
http://njsg.sdf-eu.org/
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [gentoo-user] Re: gentoo netheck
2013-01-01 22:28 ` [gentoo-user] " Nuno J. Silva
@ 2013-01-02 1:21 ` Philip Webb
2013-01-02 14:30 ` Nuno J. Silva
0 siblings, 1 reply; 6+ messages in thread
From: Philip Webb @ 2013-01-02 1:21 UTC (permalink / raw
To: gentoo-user
130102 Nuno J. Silva wrote:
> On 2013-01-01, Bryan Gardiner wrote:
>> Today I wanted to install nethack and found it is masked:
> If you're the only user of your computer, you could also just unmask
> the version in Portage. The bug is that any user in the games group
> can edit all save files, so if you want to hack your own saves, go ahead.
> The main problem is not the cheating, but that nethack does not employ
> any kind of checks on the scores file when reading it, this effectively
> enables an attack vector where anyone with access to the scores file can
> exploit vulnerabilities in nethack simply by writing a specially-crafted
> score file.
> Nethack just relies on being setgid to a group and installing the scores
> file as writeable by that group. Unfortunately, that happens to be the
> very same "games" group Gentoo uses to group users who are allowed to
> play games, therefore rendering nethack's protection useless.
Does the insecurity extend beyond Nethack itself ?
-- if not, hard-masking it seems a bit draconian:
it sb quite safe on a single-user system.
--
========================,,============================================
SUPPORT ___________//___, Philip Webb
ELECTRIC /] [] [] [] [] []| Cities Centre, University of Toronto
TRANSIT `-O----------O---' purslowatchassdotutorontodotca
^ permalink raw reply [flat|nested] 6+ messages in thread
* [gentoo-user] Re: gentoo netheck
2013-01-02 1:21 ` Philip Webb
@ 2013-01-02 14:30 ` Nuno J. Silva
0 siblings, 0 replies; 6+ messages in thread
From: Nuno J. Silva @ 2013-01-02 14:30 UTC (permalink / raw
To: gentoo-user
On 2013-01-02, Philip Webb wrote:
> 130102 Nuno J. Silva wrote:
>> On 2013-01-01, Bryan Gardiner wrote:
>>> Today I wanted to install nethack and found it is masked:
>> If you're the only user of your computer, you could also just unmask
>> the version in Portage. The bug is that any user in the games group
>> can edit all save files, so if you want to hack your own saves, go ahead.
>> The main problem is not the cheating, but that nethack does not employ
>> any kind of checks on the scores file when reading it, this effectively
>> enables an attack vector where anyone with access to the scores file can
>> exploit vulnerabilities in nethack simply by writing a specially-crafted
>> score file.
>> Nethack just relies on being setgid to a group and installing the scores
>> file as writeable by that group. Unfortunately, that happens to be the
>> very same "games" group Gentoo uses to group users who are allowed to
>> play games, therefore rendering nethack's protection useless.
>
> Does the insecurity extend beyond Nethack itself ?
> -- if not, hard-masking it seems a bit draconian:
> it sb quite safe on a single-user system.
It's an attack vector. If it is exploited, it extends to your whole
account, plus any system/service whose passwords/credentials are stored
in your files.
Now if it's a single-user system, the attacker would need to already
have access to a user in the games group in your system, and the only
account in that group is likely yours, so I doubt there would be a big
issue.
--
Nuno Silva (aka njsg)
http://njsg.sdf-eu.org/
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2013-01-02 14:31 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
[not found] <50E32270.8000500@gmail.com>
2013-01-01 18:01 ` [gentoo-user] gentoo netheck Analuin Abyssbeholder
2013-01-01 18:12 ` Analuin Abyssbeholder
2013-01-01 18:44 ` Bryan Gardiner
2013-01-01 22:28 ` [gentoo-user] " Nuno J. Silva
2013-01-02 1:21 ` Philip Webb
2013-01-02 14:30 ` Nuno J. Silva
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox