3 ms·

The normal way I use machines these days is that anyone with login access has some ability to become root. But anyone who is hosting shellboxes (including "bas

by dijit 4y ago

The normal way I use machines these days is that anyone with login access has some ability to become root. But anyone who is hosting shellboxes (including "bastion" hosts in ISO27001 environments): this is pretty serious.

nine_k 4y ago
Shouldn't a shell box just disable core dumps altogether?
wizeman 4y ago
> The normal way I use machines these days is that anyone with login access has some ability to become root. That is good, but you don't necessarily need login access to exploit this. You could exploit it via an RCE vulnerability in some other program, like the HTTP server or NTP client.
ajross 4y ago
I'll bet you don't. The natural extension of that logic is that you don't bother with UID separation for running processes (since you don't believe it provides any protection), so for convenience all your software runs as root and all your ssh logins are directly to root, etc... No one does that, and I'll bet anything you don't either. In fact the Unix uid/gid does provide real security value in practice. It is not absolute, and relative to other barriers commonly used (LSM, cgroup containers, VMs, firewalls, BPF syscall filtering, etc...) it's comparatively weak and porous. But it's not something to dismiss either. The nature of "defense in depth" security analysis is that you have to embrace that depth and not throw bits out. UID separation has the distinct advantage of being dirt simple to understand and extremely cheap to deploy. Use it.
- yjftsjthsd-h 4y ago
  >> The normal way I use machines these days is that anyone with login access has some ability to become root. > I'll bet you don't I'll... bet they do? You realize that description most trivially matches "I give people sudo access", right? So they say they do something and you promptly say that you don't think they do that, because "nobody" does a more extreme version of the same idea that they never suggested? That's a classic straw man.
  - ajross 4y ago
    That seems like a maximally uncharitable way of interpreting what I thought was a pretty uncontroversial point. The point was that when deploying software for use, best practice says "don't run it as root", and not "assume all software has root access". Do you really disagree? Because the grandparent poster definitely seems to, and I think that's pretty clearly wrong.
    - jeltz 4y ago
      Like your maximally uncharitable interpretation of the original comment.
      - ajross 4y ago
        That still seems senselessly combative. I wasn't being mean, at least re-reading my comment it doesn't seem so to me. What's the deal here? Who did I offend, and how? To repeat a third time: don't run stuff as root simply because you assume root elevation exploits exist. I stand by that, and don't really think anyone here disagrees.
        tremon 4y ago
        I don't think you were being mean, but you are being dense. This is the OP's statement: > anyone with login access has some ability to become root If you take that to mean "I run all my software as root", then you're being maximally uncharitable. And when people point out to you that your interpretation isn't the only one available (nor the most logical one), you accuse others of being senselessly combative?
        kelnos 4y ago
        > I wasn't being mean, at least re-reading my comment it doesn't seem so to me. I don't have a dog in this race, but you started your comment with "I bet you don't", which, to me, is unnecessarily combative and/or snarky. Right out of the gate I was predisposed to think ill of whatever you had to say.

by dijit 4y ago

nine_k 4y ago

Shouldn't a shell box just disable core dumps altogether?

wizeman 4y ago

> The normal way I use machines these days is that anyone with login access has some ability to become root. That is good, but you don't necessarily need login access to exploit this. You could exploit it via an RCE vulnerability in some other program, like the HTTP server or NTP client.

ajross 4y ago

I'll bet you don't. The natural extension of that logic is that you don't bother with UID separation for running processes (since you don't believe it provides any protection), so for convenience all your software runs as root and all your ssh logins are directly to root, etc... No one does that, and I'll bet anything you don't either. In fact the Unix uid/gid does provide real security value in practice. It is not absolute, and relative to other barriers commonly used (LSM, cgroup containers, VMs, firewalls, BPF syscall filtering, etc...) it's comparatively weak and porous. But it's not something to dismiss either. The nature of "defense in depth" security analysis is that you have to embrace that depth and not throw bits out. UID separation has the distinct advantage of being dirt simple to understand and extremely cheap to deploy. Use it.

yjftsjthsd-h 4y ago
>> The normal way I use machines these days is that anyone with login access has some ability to become root. > I'll bet you don't I'll... bet they do? You realize that description most trivially matches "I give people sudo access", right? So they say they do something and you promptly say that you don't think they do that, because "nobody" does a more extreme version of the same idea that they never suggested? That's a classic straw man.
- ajross 4y ago
  That seems like a maximally uncharitable way of interpreting what I thought was a pretty uncontroversial point. The point was that when deploying software for use, best practice says "don't run it as root", and not "assume all software has root access". Do you really disagree? Because the grandparent poster definitely seems to, and I think that's pretty clearly wrong.
  - jeltz 4y ago
    Like your maximally uncharitable interpretation of the original comment.
    - ajross 4y ago
      That still seems senselessly combative. I wasn't being mean, at least re-reading my comment it doesn't seem so to me. What's the deal here? Who did I offend, and how? To repeat a third time: don't run stuff as root simply because you assume root elevation exploits exist. I stand by that, and don't really think anyone here disagrees.
      - tremon 4y ago
        I don't think you were being mean, but you are being dense. This is the OP's statement: > anyone with login access has some ability to become root If you take that to mean "I run all my software as root", then you're being maximally uncharitable. And when people point out to you that your interpretation isn't the only one available (nor the most logical one), you accuse others of being senselessly combative?
      - kelnos 4y ago
        > I wasn't being mean, at least re-reading my comment it doesn't seem so to me. I don't have a dog in this race, but you started your comment with "I bet you don't", which, to me, is unnecessarily combative and/or snarky. Right out of the gate I was predisposed to think ill of whatever you had to say.