SoylentNews is people
SoylentNews
Submitted via IRC for TheMightyBuzzard
A bug in Linux's systemd init system causes root permissions to be given to services associated with invalid usernames, and while this could pose a security risk, exploitation is not an easy task.
A developer who uses the online moniker "mapleray" last week discovered a problem related to systemd unit files, the configuration files used to describe resources and their behavior. Mapleray noticed that a systemd unit file containing an invalid username – one that starts with a digit (e.g. "0day") – will initiate the targeted process with root privileges instead of regular user privileges.
Systemd is designed not to allow usernames that start with a numeric character, but Red Hat, CentOS and other Linux distributions do allow such usernames.
"It's systemd's parsing of the User= parameter that determines the naming doesn't follow a set of conventions, and decides to fall back to its default value, root," explained developer Mattias Geniar.
While this sounds like it could be leveraged to obtain root privileges on any Linux installation using systemd, exploiting the bug in an attack is not an easy task. Geniar pointed out that the attacker needs root privileges in the first place to edit the systemd unit file and use it.
[...] Systemd developers have classified this issue as "not-a-bug" and they apparently don't plan on fixing it. Linux users are divided on the matter – some believe this is a vulnerability that could pose a serious security risk, while others agree that a fix is not necessary.
See, this is why we can't have nice init systems.
Source: http://www.securityweek.com/linux-systemd-gives-root-privileges-invalid-usernames
(Score: 2) by Snospar on Tuesday July 04 2017, @07:47AM (5 children)
I still don't understand why Debian, and others, were so quick to jump on the Red Hat bandwagon and make the change to systemd. They've pulled a huge number of distros into this corporate fight where I thought that one of Linux strengths was the diversity of distros and in the case of Debian the democracy of large numbers of developers making reasoned choices. From a long term Debian users point of view they seemed to dive into systemd before it was even ready for prime time (I remember various supporting tools weren't even present when they first jumped). I still don't know WHY Debian would behave like that - they don't have Oracle pissing on their chips.
Huge thanks to all the Soylent volunteers without whom this community (and this post) would not be possible.
(Score: 2) by Azuma Hazuki on Tuesday July 04 2017, @07:58AM (2 children)
You and me both. I had high hopes, early on, that Debian would provide a sort of anti-RHEL bulwark and be a major force for non-systemd Linux. Essentially, I was hoping they'd rally the rest of the Linux world behind them and then everyone would say in a very loud voice "Okay RedHat, you do your thing, and certify your users on it, but that's YOUR thing."
Instead, their capitulation essentially gave over almost the entire Linux world to the RHEL way. I am almost maudlin-grateful for Gentoo, Devuan, Slackware, and the shiny new Arch-OpenRC ISO and repo on Sourceforge which I just finished installing not 2 hours ago.
Unfortunately, with Debian gone this way, *buntu and Mint are also inevitably being dragged along. I really do think Linux as we all knew it died with systemd, and all to fuel RHEL and Oracle's dick-measuring contest it seems.
And the worst part is, taken in vacuum, *that makes the systemd crew the good guys by comparison.* Arrrrgh.
I am "that girl" your mother warned you about...
(Score: 2) by Snospar on Tuesday July 04 2017, @08:20AM
I'm really hoping that Devuan gathers momentum and becomes a great success. Naive perhaps, but if they can keep fighting the systemd contagion as it touches more and more aspects of Linux then hopefully more users and developers will start to switch over. Who knows, maybe we will see *buntu or Mint based on Devuan in the future!
I know we have Gentoo, Arch, Slackware, etc that have managed to stay systemd-free but there are many who are very comfortable with the Debian way.
Huge thanks to all the Soylent volunteers without whom this community (and this post) would not be possible.
(Score: 1) by pTamok on Tuesday July 04 2017, @12:23PM
I too "had high hopes, early on, that Debian would provide a sort of anti-RHEL bulwark and be a major force for non-systemd Linux".
I was very wrong.
I don't know if Devuan has the scale needed. I hope it has, but the early signs are not good.
(Score: 0) by Anonymous Coward on Tuesday July 04 2017, @04:53PM
They wanted to ship Gnome as the default desktop.
Gnome depends on systemd-logind unless you want to patch to shim, and one can just ask Canonical how well that works.
systemd-logind in turn depends on systemd-pid1 to handle all things cgroups.
Basically Debian, for all its presence in the Linux community, do not have the manpower to go up against the code churn of Fedora/Red Hat.
End result is that these days whatever goes into Fedora eventually ends up being the de-facto standard for the Linux ecosystem.
(Score: 2) by Thexalon on Tuesday July 04 2017, @06:03PM
1. Because the pro-systemd people gamed the vote quite intentionally.
2. Poettering & friends were and still are deliberately breaking otherwise working userspace software to make systemd appear to be more and more a requirement for a Linux system, to the point that Gentoo and other anti-systemd distros have to patch things to not require it.
The only thing that stops a bad guy with a compiler is a good guy with a compiler.