3 ms·
Unrelated to the auth bypass, but on the topic of linux-pam; this summer I landed exposing prctl(PR_SET_NO_NEW_PRIVS) in pam_limits [0]. It's a convenient way
by pengaru 6y ago
Unrelated to the auth bypass, but on the topic of linux-pam; this summer I landed exposing prctl(PR_SET_NO_NEW_PRIVS) in pam_limits [0]. It's a convenient way to prevent logins from potentially attaining new privileges, even if bad actors find bugs in suid programs or even know the root password (assuming remote root logins are disabled).
[0] https://github.com/linux-pam/linux-pam/commit/dd9cf929e7ec79e5341a44119e00d70ec7dd5f51 https://github.com/linux-pam/linux-pam/commit/dd9cf929e7ec79...
- cyphar 6y agoI would love to see no_new_privs more widely used, so thanks! Unfortunately it should be noted on most distributions this will cause counterintuitive breakages -- most notably ping won't work for unprivileged users (but luckily you can fix this by changing net.ipv4.ping_group_range to include the unprivileged user groups -- I hope distributions fix this eventually...).