SoylentNews is people
SoylentNews
Submitted via IRC for TheMightyBuzzard
A bug in Linux's systemd init system causes root permissions to be given to services associated with invalid usernames, and while this could pose a security risk, exploitation is not an easy task.
A developer who uses the online moniker "mapleray" last week discovered a problem related to systemd unit files, the configuration files used to describe resources and their behavior. Mapleray noticed that a systemd unit file containing an invalid username – one that starts with a digit (e.g. "0day") – will initiate the targeted process with root privileges instead of regular user privileges.
Systemd is designed not to allow usernames that start with a numeric character, but Red Hat, CentOS and other Linux distributions do allow such usernames.
"It's systemd's parsing of the User= parameter that determines the naming doesn't follow a set of conventions, and decides to fall back to its default value, root," explained developer Mattias Geniar.
While this sounds like it could be leveraged to obtain root privileges on any Linux installation using systemd, exploiting the bug in an attack is not an easy task. Geniar pointed out that the attacker needs root privileges in the first place to edit the systemd unit file and use it.
[...] Systemd developers have classified this issue as "not-a-bug" and they apparently don't plan on fixing it. Linux users are divided on the matter – some believe this is a vulnerability that could pose a serious security risk, while others agree that a fix is not necessary.
See, this is why we can't have nice init systems.
Source: http://www.securityweek.com/linux-systemd-gives-root-privileges-invalid-usernames
(Score: 2) by Azuma Hazuki on Tuesday July 04 2017, @02:27AM (4 children)
It occurs to me that Poettering's approach is basically how a Windows user would have written Linux programs. That is not a nice thought.
I am "that girl" your mother warned you about...
(Score: 2) by Thexalon on Tuesday July 04 2017, @02:31AM (1 child)
FTFY. After that point, Windows had concepts like users, privileges & permissions, and a whole lot of other very useful concepts that Unix had had for decades, but Poettering doesn't seem to care for.
The only thing that stops a bad guy with a compiler is a good guy with a compiler.
(Score: 0) by Anonymous Coward on Tuesday July 04 2017, @05:49AM
That may be true, but I still have to run (¹allegedly) current commercial code on Win7 boxes which requires admin rights to work, try them as normal user? all sorts of weird BS happens or it just fails to run.
I still occasionally get 'bitten' by this BS with the occasional weird edge-case 'works-as-admin-but-not-as-user' snafus with Windows software, and we're not talking about just 'cheap' software having this problem, one of our expensive CAM packages has only just (just, in this case being in the past two years) gotten to the point where it no longer requires to be run as an admin user to work properly and it now runs without issue as a normal user, whereas, in the past, running it as a normal user meant that it might work 90% of the time, but then horribly fail on some operations...
The point is, while Windows does 'understand' these concepts, there's a hell of a lot of reused Windows code which doesn't, and programmers out there who still don't.
He is, indeed one of the Knights who say NIH!
¹ I say 'allegedly', I'm of the opinion that the code is exactly the same and only the version number has been changed just to make it look as if the damnable thing is still being developed..
(Score: 2) by Runaway1956 on Tuesday July 04 2017, @07:26AM (1 child)
Mmmm. That's scary to even think about. Your Windows user is likely to import DLL files for use as libraries. And, Microsoft would probably let him get away with it because embrace, extend, extinguish. Never mind that DLL's wreck anything or everything in existing libraries.
(Score: 2) by Azuma Hazuki on Tuesday July 04 2017, @07:53AM
A DLL is the Windows equivalent of a .so and in theory should be no more or less harmful all else being equal. We're long past "DLL Hell" aren't we? Now the problem is what's *in* the .dll files...this Linux Subsystem for Windows isn't even a solution looking for a problem, it's a shambling undead mess given an assassination mission.
I am "that girl" your mother warned you about...