From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-wr1-f41.google.com (mail-wr1-f41.google.com [209.85.221.41]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E00A3334C06 for ; Thu, 4 Dec 2025 09:32:15 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.221.41 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1764840737; cv=none; b=OtnzplmN9qVMiKdjBzny8cIu4ZxRgrzTmtrlzpPSlaASk+/sBc6eSzf9WFkQZ3mNNupa3h2X4sixcEJGx+TC43Iqh88CommuSckhpqx8riz2eM1RtPSTFVpBNCSBr4i8Gei9ZKm/7WFdXOWlRhSXxwLv0yLji52tblavnO6s6ys= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1764840737; c=relaxed/simple; bh=7KDSP+eJnIgbODlTxSo2m0C89a6pRbVbkfcbCzde8G8=; h=Date:From:To:Cc:Subject:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=cFESXaIMrbYBZgLSsC/jnbI/tOThlugUJQW2nAEQwsm6krYx3BCFhuo81YU3x9/pZzWnnd9hGeQdbwdNT4SXKrpOeJ5LEpWO8gPLjkx9NE8jPScvLypzhqX7gCddWpp443Ysivxpc4omhokrtPi6LhIRmYcP2PyEKKjqO4bCbnQ= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=KiErZhOh; arc=none smtp.client-ip=209.85.221.41 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="KiErZhOh" Received: by mail-wr1-f41.google.com with SMTP id ffacd0b85a97d-42e2e52cc04so280562f8f.0 for ; Thu, 04 Dec 2025 01:32:15 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1764840734; x=1765445534; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:subject:cc:to:from:date:from:to:cc:subject:date :message-id:reply-to; bh=P9pe+wJENeZc5IcOvHk937NmwKikq+O3BvHjwpbysZ0=; b=KiErZhOhZY8yDuUXrrd4zP5DgXNsChXXR8AEJ5y0LV2jtZM2sJ+GgXZxIHDSLJ8kqv t44/5lQBDSqO1nzX1gXjajizaf9DBRiBc4XkHgIgKH+Xja0RyniP3P61D8gVRTSiLt+6 8Z7/WeZqNU2wuaBxW/cUiUScO/UwTSuwzGMNpQLEUMcdAXzEv35UUekmSeJHLB9V+jKt fowJSb/fb0YCwM8/cTvus4tpzgzrIs3NCZix7EnxiyB75sW/tZGp5Dbg3c/WKf2g6LMs RLWLTfrZMikaP1W1EOHIRYkvwupCRhiBZrQhZ4toQBCEr2kiXWIwNNcI8e0F0dSNEuqr RQkw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1764840734; x=1765445534; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:subject:cc:to:from:date:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=P9pe+wJENeZc5IcOvHk937NmwKikq+O3BvHjwpbysZ0=; b=iWWSfkzBsust2eHPTWOfgxvR9jHJTKIEQpdYu5Q9+JX3MNIFUVT0C1MWLNyaZgss3a jf5Swc+7Yz87DNWSE15KhTuu/nRT6BgofSDI6KajurIK39c2GdpUFMTV5yRIEiLG6ZR1 t95LA/rbArHNCby9PL3EU4uHgaq33ZVH/d/6eNHeydKDMmWvASr1iaHU8Pll+GZqyESY ywSwWeJKFZG6pjvJZ3CvPO46iQuVvQ5HwOqI3Wft5AHLUKhCSl8rtJkWnOf7i93/Vpyl 3u0wt5QQQakxmPJfeiyK9Ul387cJvt5/uqYiHR1LdrePZ5zqXq/kprbg2QMXNcS8osK2 kJ9g== X-Forwarded-Encrypted: i=1; AJvYcCWmqX8fII56bMFyaeu6LtAgMKpmpz0SsunFZZWCd+LgY+K01BgvqvmJjrT6M1Udg2SgLALgSTcbWfJHFi8=@vger.kernel.org X-Gm-Message-State: AOJu0YxuiVedVedVQW/US1gdKleljE6B/fjVeHrpI1z8wqyYfhPUTQat TFKXl15d86a+D2QhHjJEH+Puyp4ZoAE5OI5cbDVrPU9x2cvGJXpApiCw X-Gm-Gg: ASbGncut5ztpQA+55o1dHl5Svf00nvgzJnFGkwS29jiFcJRkL1+dmwhY3PolwqoRPuH DhjgnzpCQsY79cShIeVSH3RLHNFewtnPTvYyZQXWRR7ntyGvjyTzqE+8/hLiKmO4IbQ/2V1NMG5 Vvr/aLzrnzIa+kI7oj5Lrsu/iGmw2a3+6JugtrrwEdo01ODezxfLtC4UCODuKLVqCmS7ey0wafr GGxY5jdXAlpnwfcctzJvS/+YAS9jIIwj3WRLtx6DVlTk4J7d8uRD7Ez9SP4esUoKts5NBEir/P3 QDAuxnMSuvmRt8i75yRRCu6ReVV2CgN4XnZBkIE+6X/gnkvZULaQk5YxCYH3DdRucjft96+itae RHIY8L4TnSw7sr+2oS1jU0E7zgWS5KLoOSgHN8Yo/b501k36RLiB9KtYQO1TvYoWXsTC8XnopEa in7gO6MsArsn5IWBfyPunNVVuZlNMpvSgAbCLAS6nVPChrBGmPYXnh X-Google-Smtp-Source: AGHT+IEpeLb5DzDFyyRRjLJBycEA8/oon798RLVjm4cwDE2uj2+226ExQ98mf5m0TZ5rx0eulXU/Nw== X-Received: by 2002:a05:6000:2dc4:b0:429:d725:4125 with SMTP id ffacd0b85a97d-42f7987519fmr2415263f8f.54.1764840733805; Thu, 04 Dec 2025 01:32:13 -0800 (PST) Received: from pumpkin (82-69-66-36.dsl.in-addr.zen.co.uk. [82.69.66.36]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-42f7d2226e7sm2182928f8f.27.2025.12.04.01.32.10 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 04 Dec 2025 01:32:12 -0800 (PST) Date: Thu, 4 Dec 2025 09:32:09 +0000 From: David Laight To: Al Viro Cc: Bernd Edlinger , "Eric W. Biederman" , Roberto Sassu , Alexey Dobriyan , Oleg Nesterov , Kees Cook , Andy Lutomirski , Will Drewry , Christian Brauner , Andrew Morton , Michal Hocko , Serge Hallyn , James Morris , Randy Dunlap , Suren Baghdasaryan , Yafang Shao , Helge Deller , Adrian Reber , Thomas Gleixner , Jens Axboe , Alexei Starovoitov , "linux-fsdevel@vger.kernel.org" , "linux-kernel@vger.kernel.org" , linux-kselftest@vger.kernel.org, linux-mm@kvack.org, linux-security-module@vger.kernel.org, tiozhang , Luis Chamberlain , "Paulo Alcantara (SUSE)" , Sergey Senozhatsky , Frederic Weisbecker , YueHaibing , Paul Moore , Aleksa Sarai , Stefan Roesch , Chao Yu , xu xin , Jeff Layton , Jan Kara , David Hildenbrand , Dave Chinner , Shuah Khan , Elena Reshetova , David Windsor , Mateusz Guzik , Ard Biesheuvel , "Joel Fernandes (Google)" , "Matthew Wilcox (Oracle)" , Hans Liljestrand , Penglei Jiang , Lorenzo Stoakes , Adrian Ratiu , Ingo Molnar , "Peter Zijlstra (Intel)" , Cyrill Gorcunov , Eric Dumazet , zohar@linux.ibm.com, linux-integrity@vger.kernel.org, Ryan Lee , apparmor Subject: Re: Are setuid shell scripts safe? (Implied by security_bprm_creds_for_exec) Message-ID: <20251204093209.706f30a6@pumpkin> In-Reply-To: <20251204054915.GI1712166@ZenIV> References: <87tsyozqdu.fsf@email.froward.int.ebiederm.org> <87wm3ky5n9.fsf@email.froward.int.ebiederm.org> <87h5uoxw06.fsf_-_@email.froward.int.ebiederm.org> <6dc556a0a93c18fffec71322bf97441c74b3134e.camel@huaweicloud.com> <87v7iqtcev.fsf_-_@email.froward.int.ebiederm.org> <87ms42rq3t.fsf@email.froward.int.ebiederm.org> <20251204054915.GI1712166@ZenIV> X-Mailer: Claws Mail 4.1.1 (GTK 3.24.38; arm-unknown-linux-gnueabihf) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit On Thu, 4 Dec 2025 05:49:15 +0000 Al Viro wrote: > On Wed, Dec 03, 2025 at 02:16:29PM +0100, Bernd Edlinger wrote: > > > Hmm, yes, that looks like an issue. > > > > I would have expected the security engine to look at bprm->filenanme > > especially in the case, when bprm->interp != bprm->filename, > > and check that it is not a sym-link with write-access for the > > current user and of course also that the bprm->file is not a regular file > > which is writable by the current user, if that is the case I would have expected > > the secuity engine to enforce non-new-privs on a SUID executable somehow. > > Check that _what_ is not a symlink? And while we are at it, what do write > permissions to any symlinks have to do with anything whatsoever? > You'd need to check for write permissions to all the directories in the full path of the symlink and in all the directories traversed by the symlink. (and that may not be enough....) Passing the shell (or whatever) /dev/fd/n doesn't seem (to me) any different from what happens when the elf interpreter runs a suid program. You might want to check for non-owner write permissions to the /dev/fd/n entry, but that is true for any suid executable, not just scripts. FWIW the SYSV shells normally set the effective uid back the real uid. So making a script suid didn't work unless the script started "#!/bin/sh -p". Whether that improved security (rather than being annoying) is another matter. David