3 ms·

Interestingly it fails for me because my `su` isn't world-readable: $ stat /bin/su File: /bin/su Size: 59552 Blocks: 118 IO Block: 5

• rkeene2 5mo ago
  A workaround might be to make all setuid/setgid files non-world-readable because then they cannot be opened at all, and thus there is no setuid file to replace the contents of.
  • hashstring 5mo ago
    Eh, if you can pollute page caches this won’t safe you. Think modifying shared libraries, ld preload, cron, I guess on some systems /etc/passwd even. There are a lot of files readable that should definitely not be writable.
    • rkeene2 5mo ago
      Fair enough -- a simpler change might be to poison /etc/passwd and call `su` to a user that has uid 0, since that requires no shell code nor a readable binary, and this seems to have worked in a slightly modified POC: f=g.open("/etc/passwd",0); e="rkeene:x:0:0:System administrator:/root:/run/current-system/sw/bin/bash\n".encode() ... g.system("/run/wrappers/bin/su - rkeene")
      • tyilo 5mo ago
        There is a PoC that does exactly that here: https://github.com/tgies/copy-fail-c https://github.com/tgies/copy-fail-c
• zerocrates 5mo ago
  It being readable is the default configuration most places, after all the purpose is to call it from a non-privileged user. But I could see it being made non-readable since its use is discouraged nowadays... though then I'd expect sudo to be readable as an alternative.
  • rkeene2 5mo ago
    My `sudo` is also not readable. Files/directories don't need to be readable to be executed. I can still use `su` and `sudo`.
    • zerocrates 5mo ago
      Oh yeah, duh. Still every machine I've looked at, and I've since looked at a couple more, has it r-x for world.