Standards, the kernel, and Postfix [LWN.net]

Standards, the kernel, and Postfix

Posted Aug 23, 2008 0:23 UTC (Sat) by giraffedata (subscriber, #1954)
In reply to: Standards, the kernel, and Postfix by jzbiciak
Parent article: Standards, the kernel, and Postfix

Suppose /etc/inittab is a symlink to /etc/inittab.thishost.
Now suppose an attacker hard-links /etc/inittab to /home/attacker/maildir/somefile.
Next, the attacker mails himself a specially formatted email containing inittab records.

I'm guessing from the clues in the article that there's more to it: The above would ordinarily fail because Postfix sets the process permissions to attacker's before writing the mail file and attacker doesn't have write permission to /etc/inittab.thishost. But Postfix, I'm guessing, notices that /home/atacker/maildir/somefile is a symbolic link owned by root, assumes that the only way that could get there is that root created it there, and therefore feels safe in using root's permissions or even DAC_OVERRIDE privilege to write through it. I can see that might be a useful feature.

(Log in to post comments)