4 ms·

>execution of arbitrary code as root. How the hell is this still possible in this day and age? Why is this service running as root? It really is incredible ho

>execution of arbitrary code as root. How the hell is this still possible in this day and age? Why is this service running as root? It really is incredible how much bad decision making goes into your typical linux distro. This should be a non-root service with an ACL on whatever files samba needs to access. It doesn't "need" to be root. Reminds me of the Windows days where every service "needed" a System or Ring0 access and every application local admin rights. Its just incredible how there's nothing between a buffer overflow (which are common and will never go away considering the languages used) and root. I wonder if SELinux could even do anything here or if samba is such a security nightmare that you just have to give it root and hope for the best. Samba is the poster child of the ugly, hacky, security questionable code that we all should be working away from, not making excuses for: http://www.cvedetails.com/vulnerability-list/vendor_id-102/Samba.html http://www.cvedetails.com/vulnerability-list/vendor_id-102/S... If you want AD, pay for AD. If you want to share files with Windows clients you have a million options nowadays. This reverse-engineered pig is just a liability and helps keep real solutions from emerging because you can just install samba and be done with it. The technical debt and liabilities here are just kicked down the road. I wonder how bad this is going to get in the world of the "internet of things" and cheap NAS's with poor firewalling being sold by the millions. edit: downvotes dont suddenly make samba a good application

throwaway2048 12y ago
Your comment demonstrates zero understanding of what samba is, or why it might need root. Hint, its tied to authenticating users and accessing their files. Granted there could be better privilege separation, and a more modular approach, but just writing it off as "why is it running as root" is like asking why does sshd need to run as root. Its just a profoundly ignorant dismissal. EDIT: parent substantially edited his comment after this was posted
- drzaiusapelord 12y ago
  If you need to be root to access Linux PAM, then linux is more fucked up than I thought. > Its just a profoundly ignorant dismissal. and its this FOSS jerk attitude that guarantees that things won't change. Linux is perfect! It cannot be criticized! sigh
  - barrkel 12y ago
    It's not just authentication, it's authorization. Files should be accessed with the identity of the remote user in order to present a consistent view of the file system, test and set permissions consistently, and set ownership consistently. It's either that, or build a completely parallel permissions and ownership system maintained in a separate database, with mappings per file, etc. (Samba kind of does build a parallel system, but it's not completely parallel. Technically I think it could be possible to improve, so that Samba forks off subprocesses that switch identity based on the connected user's supplied credentials interacting with PAM etc., but that's not how it's done, and I don't know enough of the details of CIFS authentication to know if there's roadblockers there.)
    - praseodym 12y ago
      Samba's smbd forks subprocesses with the connected user's account, so I think this is done whenever possible.
      - tedunangst 12y ago
        Worth repeating that it's hard to change uid to the connected user if you don't start as root.
icebraining 12y ago
edit: downvotes dont suddenly make samba a good application Samba being an insecure application doesn't make every decision they made (such as running the auth service as root) necessarily bad. Don't assume people are downvoting you for "criticizing samba"; they may just disagree with your specific criticism, or even just with your tone.
icebraining 12y ago
By the way, from just 10 days ago: Microsoft just patched a 15-year-old bug that in some cases allows attackers to take complete control of PCs running all supported versions of Windows. The critical vulnerability will remain unpatched in Windows Server 2003, leaving that version wide open for the remaining five months Microsoft pledged to continue supporting it. The flaw, which took Microsoft more than 12 months to fix, affects all users who connect to business, corporate, or government networks using the Active Directory service. Bad, bad Samba! Just pay for AD! /s http://arstechnica.com/security/2015/02/15-year-old-bug-allows-malicious-code-execution-in-all-versions-of-windows/ http://arstechnica.com/security/2015/02/15-year-old-bug-allo...
- drzaiusapelord 12y ago
  There's a world of difference between a local and remote exploit.
  - icebraining 12y ago
    From the link: "The vulnerability is remotely exploitable and may grant the attacker administrator-level privileges on the target machine/device."
jra_samba 12y ago
FYI. In Windows the same process doing the same things that Samba does here also runs as SYSTEM. Some things just need root access I'm afraid. And yeah, coding them in C is a bad idea in 2015, but Samba was started in 1992 and we have a lot of legacy code to maintain...

throwaway2048 12y ago

Your comment demonstrates zero understanding of what samba is, or why it might need root. Hint, its tied to authenticating users and accessing their files. Granted there could be better privilege separation, and a more modular approach, but just writing it off as "why is it running as root" is like asking why does sshd need to run as root. Its just a profoundly ignorant dismissal. EDIT: parent substantially edited his comment after this was posted

drzaiusapelord 12y ago
If you need to be root to access Linux PAM, then linux is more fucked up than I thought. > Its just a profoundly ignorant dismissal. and its this FOSS jerk attitude that guarantees that things won't change. Linux is perfect! It cannot be criticized! sigh
- barrkel 12y ago
  It's not just authentication, it's authorization. Files should be accessed with the identity of the remote user in order to present a consistent view of the file system, test and set permissions consistently, and set ownership consistently. It's either that, or build a completely parallel permissions and ownership system maintained in a separate database, with mappings per file, etc. (Samba kind of does build a parallel system, but it's not completely parallel. Technically I think it could be possible to improve, so that Samba forks off subprocesses that switch identity based on the connected user's supplied credentials interacting with PAM etc., but that's not how it's done, and I don't know enough of the details of CIFS authentication to know if there's roadblockers there.)
  - praseodym 12y ago
    Samba's smbd forks subprocesses with the connected user's account, so I think this is done whenever possible.
    - tedunangst 12y ago
      Worth repeating that it's hard to change uid to the connected user if you don't start as root.

icebraining 12y ago

edit: downvotes dont suddenly make samba a good application Samba being an insecure application doesn't make every decision they made (such as running the auth service as root) necessarily bad. Don't assume people are downvoting you for "criticizing samba"; they may just disagree with your specific criticism, or even just with your tone.

icebraining 12y ago

By the way, from just 10 days ago: Microsoft just patched a 15-year-old bug that in some cases allows attackers to take complete control of PCs running all supported versions of Windows. The critical vulnerability will remain unpatched in Windows Server 2003, leaving that version wide open for the remaining five months Microsoft pledged to continue supporting it. The flaw, which took Microsoft more than 12 months to fix, affects all users who connect to business, corporate, or government networks using the Active Directory service. Bad, bad Samba! Just pay for AD! /s http://arstechnica.com/security/2015/02/15-year-old-bug-allows-malicious-code-execution-in-all-versions-of-windows/ http://arstechnica.com/security/2015/02/15-year-old-bug-allo...

drzaiusapelord 12y ago
There's a world of difference between a local and remote exploit.
- icebraining 12y ago
  From the link: "The vulnerability is remotely exploitable and may grant the attacker administrator-level privileges on the target machine/device."

jra_samba 12y ago

FYI. In Windows the same process doing the same things that Samba does here also runs as SYSTEM. Some things just need root access I'm afraid. And yeah, coding them in C is a bad idea in 2015, but Samba was started in 1992 and we have a lot of legacy code to maintain...