Standards, the kernel, and Postfix
Posted Aug 23, 2008 0:23 UTC (Sat) by giraffedata
In reply to: Standards, the kernel, and Postfix
Parent article: Standards, the kernel, and Postfix
- Suppose /etc/inittab is a symlink to /etc/inittab.thishost.
- Now suppose an attacker hard-links /etc/inittab to /home/attacker/maildir/somefile.
- Next, the attacker mails himself a specially formatted email containing inittab records.
I'm guessing from the clues in the article that there's more to it: The above would ordinarily fail because Postfix sets the process permissions to attacker's before writing the mail file and attacker doesn't have write permission to /etc/inittab.thishost. But Postfix, I'm guessing, notices that /home/atacker/maildir/somefile is a symbolic link owned by root, assumes that the only way that could get there is that root created it there, and therefore feels safe in using root's permissions or even DAC_OVERRIDE privilege to write through it. I can see that might be a useful feature.
to post comments)