Security
Centralizing policy rules with PolicyKit
Linux security policy is very simple at its core: the root user can do anything, while all other users can do very little. Unfortunately, administrators want to be able to allow other users to do a limited subset of the things root is permitted to do. Various solutions have been implemented to try and solve this problem, with a recent one being PolicyKit.
Mounting removable filesystems, CDs, USB devices, and the like, is a classic example of a root-only task that some non-privileged users might be allowed to perform. In the past, various mechanisms using groups or mount options in /etc/fstab have been used with some success, but the mechanisms were specific to mounting and did not provide the flexibility that some administrators would like. Network configuration - particularly for wireless networking - is another common task that users might be allowed to do.
PolicyKit is an attempt to centralize these kinds of decisions into a single policy file that the administrator can use to set the kinds of access regular users should be allowed. Previous solutions required changing each utility to handle policy, each in its own unique format and file(s). PolicyKit is meant to avoid all of that, creating a single place, with a consistent syntax (the now ubiquitous XML), that details the policy rules for that system.
The PolicyKit philosophy decouples the "mechanism" of performing the privileged operation from the user interface used to request it. A GUI network configuration tool might allow a user to choose a different network to associate with, but would have no direct means to make that change. It would, instead, contact a privileged network management daemon through an interprocess communication mechanism (such as D-Bus). That daemon would use the PolicyKit API to determine whether to grant the request.
In order to make that decision, PolicyKit needs three pieces of information, the subject, object, and action. The subject is the user and process requesting the action, while the object is what entity the action is being requested on. In a network configuration example, the subject would be a uid, along with additional identifying information such as SELinux security context, the action would be to change the association, and the object would be the network device.
The mechanism code calls the PolicyKit library, passing the subject, object, and action, receiving back a decision. The decision could be a simple yes or no, or it could, instead, require that the user authenticate - either as themselves or as root - before allowing the operation. Re-authentication can be required on sensitive actions, such as those that malware or malicious users might want to perform, to provide an additional layer of security. All of this policy is governed by the entries in the PolicyKit configuration file. Once the decision has been rendered, it is up to the mechanism to enforce it. This may require coordination with the UI, especially if authentication is required.
Administrators can modify the PolicyKit configuration by way of an XML file, usually PolicyKit.conf. The man page gives a few examples of entries like the following:
<match action="org.freedesktop.hal.storage.mount-fixed">
<match user="davidz">
<return result="yes"/>
</match>
<match user="freddy">
<return result="no"/>
</match>
</match>
As should be relatively easy to see, this configuration would allow the user
"davidz" to perform the action "mount-fixed" while disallowing the user
"freddy". Depending on the default value for that action, as specified in
the mechanism's configuration, users not listed could be denied,
allowed, or be required to authenticate.
Configuration for mechanisms, which lists the supported actions along with a default policy, is specified in a separate XML file. The mechanism could generate the file on startup and remove it on exit, completely removing the action from the system when it is inactive. Action configuration also includes the message strings that will be displayed by the UI when authenticating or denying users.
PolicyKit has been added to Fedora 8, but is, as yet, mostly unused. There are plans to integrate various GNOME configuration tools with PolicyKit for Fedora 9 and a GNOME API has been created to assist with that. One would guess that a KDE API is in the wings as well.
PolicyKit is not meant to replace SELinux or other security mechanisms, it is simply a means to allow users more privileges in a centralized, easily audited, way. PolicyKit works within the existing access control framework, using whatever privileges have been given to the mechanism. In the end, PolicyKit just provides advice to another program, it is up to that program to enforce the decision, while the OS can and does enforce its own rules upon that process.
New vulnerabilities
3proxy: denial of service
| Package(s): | 3proxy | CVE #(s): | CVE-2007-5622 | ||||
| Created: | November 9, 2007 | Updated: | November 14, 2007 | ||||
| Description: | Double-free vulnerability in the ftpprchild function in ftppr in 3proxy 0.5 through 0.5.3i allows remote attackers to cause a denial of service (daemon crash) via multiple OPEN commands to the FTP proxy. | ||||||
| Alerts: |
| ||||||
Django: denial of service
| Package(s): | Django | CVE #(s): | CVE-2007-5712 | ||||||||||||
| Created: | November 12, 2007 | Updated: | September 22, 2008 | ||||||||||||
| Description: | From the CVE notice: The internationalization (i18n) framework in Django 0.91, 0.95, 0.95.1, and 0.96, and as used in other products such as PyLucid, when the USE_I18N option and the i18n component are enabled, allows remote attackers to cause a denial of service (memory consumption) via many HTTP requests with large Accept-Language headers. | ||||||||||||||
| Alerts: |
| ||||||||||||||
emacs: command execution via local variables
| Package(s): | emacs | CVE #(s): | CVE-2007-5795 | ||||||||||||||||||||
| Created: | November 14, 2007 | Updated: | February 5, 2008 | ||||||||||||||||||||
| Description: | From the original Debian problem report: "In Debian's version of GNU Emacs 22.1+1-2, the `hack-local-variables' function does not behave correctly when `enable-local-variables' is set to :safe. The documentation of `enable-local-variables' states that the value :safe means to set only safe variables, as determined by `safe-local-variable-p' and `risky-local-variable-p' (and the data driving them), but Emacs ignores this and instead sets all the local variables." When this setting (which is not the default) is in effect, opening a hostile file could lead to the execution of arbitrary commands. | ||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||
gforge: multiple vulnerabilities
| Package(s): | gforge | CVE #(s): | CVE-2007-3921 | ||||
| Created: | November 8, 2007 | Updated: | November 14, 2007 | ||||
| Description: | The GForge collaborative development tool uses temp files in an insecure manner. Local users can use this to truncate files with the privileges of the gforge user, they can also use this to cause a denial of service. | ||||||
| Alerts: |
| ||||||
glib2: multiple vulnerabilities
| Package(s): | glib2 | CVE #(s): | |||||
| Created: | November 8, 2007 | Updated: | November 14, 2007 | ||||
| Description: | The glib2 library has multiple (currently unspecified) vulnerabilities in PCRE. | ||||||
| Alerts: |
| ||||||
horde3: multiple vulnerabilities
| Package(s): | horde3 | CVE #(s): | CVE-2006-3548 CVE-2006-3549 CVE-2006-4256 CVE-2007-1473 CVE-2007-1474 | ||||
| Created: | November 12, 2007 | Updated: | November 14, 2007 | ||||
| Description: | From the Debian advisory: Several remote vulnerabilities have been discovered in the Horde web application framework. The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2006-3548: Moritz Naumann discovered that Horde allows remote attackers to inject arbitrary web script or HTML in the context of a logged in user (cross site scripting). CVE-2006-3549: Moritz Naumann discovered that Horde does not properly restrict its image proxy, allowing remote attackers to use the server as a proxy. CVE-2006-4256: Marc Ruef discovered that Horde allows remote attackers to include web pages from other sites, which could be useful for phishing attacks. CVE-2007-1473: Moritz Naumann discovered that Horde allows remote attackers to inject arbitrary web script or HTML in the context of a logged in user (cross site scripting). CVE-2007-1474: iDefense discovered that the cleanup cron script in Horde allows local users to delete arbitrary files. | ||||||
| Alerts: |
| ||||||
inotify-tools: arbitrary code execution
| Package(s): | inotify-tools | CVE #(s): | CVE-2007-5037 | ||||||||
| Created: | November 12, 2007 | Updated: | December 28, 2007 | ||||||||
| Description: | From the Fedora advisory: A vulnerability has been reported in inotify-tools, which can potentially be exploited by malicious users to compromise an application using the library. Successful exploitation may allow the execution of arbitrary code with privileges of the application using the affected library. NOTE: The programs shipped with inotify-tools are reportedly not affected. The vulnerability is reported in versions prior to 3.11. | ||||||||||
| Alerts: |
| ||||||||||
kernel: remote denial of service
| Package(s): | kernel | CVE #(s): | CVE-2006-6058 CVE-2007-4997 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | November 9, 2007 | Updated: | June 13, 2008 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | The Minix filesystem code in Linux kernel 2.6.x up to 2.6.18, and possibly
other versions, allows local users to cause a denial of service (hang) via
a malformed minix file stream that triggers an infinite loop in the
minix_bmap function. NOTE: this issue might be due to an integer overflow
or signedness error.
Integer underflow in the ieee80211_rx function in net/ieee80211/ieee80211_rx.c in the Linux kernel 2.6.x before 2.6.23 allows remote attackers to cause a denial of service (crash) via a crafted SKB length value in a runt IEEE 802.11 frame when the IEEE80211_STYPE_QOS_DATA flag is set, aka an "off-by-two error." | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
link-grammar: stack-based buffer overflow
| Package(s): | link-grammar | CVE #(s): | CVE-2007-5395 | ||||||||||||||||||||
| Created: | November 13, 2007 | Updated: | December 17, 2007 | ||||||||||||||||||||
| Description: | Stack-based buffer overflow in the separate_word function in tokenize.c in Link Grammar 4.1b and possibly other versions, as used in AbiWord Link Grammar 4.2.4, allows remote attackers to execute arbitrary code via a long word, as reachable through the separate_sentence function. | ||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||
madwifi: denial of service
| Package(s): | madwifi | CVE #(s): | CVE-2007-5448 | ||||||||
| Created: | November 8, 2007 | Updated: | January 11, 2008 | ||||||||
| Description: | The MadWifi driver for Atheros Wireless Lan cards does not process beacon frames correctly. This can be used by a remote attacker to cause a denial of service. | ||||||||||
| Alerts: |
| ||||||||||
openldap: denial of service
| Package(s): | openldap | CVE #(s): | CVE-2007-5707 | ||||||||||||||||||||||||||||||||||||||||
| Created: | November 8, 2007 | Updated: | April 9, 2008 | ||||||||||||||||||||||||||||||||||||||||
| Description: | The OpenLDAP Lightweight Directory Access Protocol suite has a problem with handling of malformed objectClasses LDAP attributes by the slapd daemon. Both local and remote attackers can use this to crash slapd, causing a denial of service. | ||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||
php: denial of service
| Package(s): | php | CVE #(s): | CVE-2007-4887 | ||||||||||||
| Created: | November 12, 2007 | Updated: | November 20, 2007 | ||||||||||||
| Description: | From the CVE entry: The dl function in PHP 5.2.4 and earlier allows context-dependent attackers to cause a denial of service (application crash) via a long string in the library parameter. NOTE: there are limited usage scenarios under which this would be a vulnerability. | ||||||||||||||
| Alerts: |
| ||||||||||||||
poppler and xpdf: multiple vulnerabilities
| Package(s): | poppler xpdf | CVE #(s): | CVE-2007-4352 CVE-2007-5392 CVE-2007-5393 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | November 8, 2007 | Updated: | February 26, 2008 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | The xpdf and poppler PDF libraries contain several vulnerabilities which can lead to arbitrary command execution via hostile PDF files. Numerous other applications which use these libraries (PDF viewers, CUPS, etc.) will be affected by the vulnerabilities as well. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
tomboy: execution of arbitrary code
| Package(s): | tomboy | CVE #(s): | CVE-2005-4790 | ||||||||||||||||||||||||||||||||||||||||||||
| Created: | November 9, 2007 | Updated: | February 22, 2011 | ||||||||||||||||||||||||||||||||||||||||||||
| Description: | Jan Oravec reported that the "/usr/bin/tomboy" script sets the
"LD_LIBRARY_PATH" environment variable incorrectly, which might result
in the current working directory (.) to be included when searching for
dynamically linked libraries of the Mono Runtime application.
Note that the tomboy vulnerability was added in 2007. | ||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||
zope-cmfplone: arbitrary code execution
| Package(s): | zope-cmfplone | CVE #(s): | CVE-2007-5741 | ||||||||||||
| Created: | November 12, 2007 | Updated: | December 28, 2007 | ||||||||||||
| Description: | From the Debian advisory: It was discovered that Plone, a web content management system, allows remote attackers to execute arbitrary code via specially crafted web browser cookies. | ||||||||||||||
| Alerts: |
| ||||||||||||||
Page editor: Jake Edge
Next page:
Kernel development>>