From 69eedc59283888a1d7d5f59284e032f9cad89b73 Mon Sep 17 00:00:00 2001 From: Jakub Hrozek <jhrozek@redhat.com> Date: Fri, 15 Jun 2018 22:29:34 +0200 Subject: [PATCH] SUDO: Create the socket with stricter permissions MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This patch switches the sudo responder from being created as a public responder where the permissions are open and not checked by the sssd deaamon to a private socket. In this case, sssd creates the pipes with strict permissions (see the umask in the call to create_pipe_fd() in set_unix_socket()) and additionaly checks the permissions with every read via the tevent integrations (see accept_fd_handler()). Resolves: https://pagure.io/SSSD/sssd/issue/3766 (CVE-2018-10852) Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com> (cherry picked from commit ed90a20a0f0e936eb00d268080716c0384ffb01d) --- src/responder/sudo/sudosrv.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/responder/sudo/sudosrv.c b/src/responder/sudo/sudosrv.c index ac4258710d3a9b48285522abd23bdd59ba42ad4e..e87a24499c2d82fafaa8e1f9b386e44332394266 100644 --- a/src/responder/sudo/sudosrv.c +++ b/src/responder/sudo/sudosrv.c @@ -94,7 +94,8 @@ sudo_cmds = get_sudo_cmds(); ret = sss_process_init(mem_ctx, ev, cdb, sudo_cmds, - SSS_SUDO_SOCKET_NAME, -1, NULL, -1, + NULL, -1, /* No public socket */ + SSS_SUDO_SOCKET_NAME, -1, /* Private socket only */ CONFDB_SUDO_CONF_ENTRY, SSS_SUDO_SBUS_SERVICE_NAME, SSS_SUDO_SBUS_SERVICE_VERSION, -- 2.17.1