Slash Boxes

SoylentNews is people

posted by Fnord666 on Monday July 03 2017, @10:12PM   Printer-friendly
from the it's-a-feature dept.

Submitted via IRC for TheMightyBuzzard

A bug in Linux's systemd init system causes root permissions to be given to services associated with invalid usernames, and while this could pose a security risk, exploitation is not an easy task.

A developer who uses the online moniker "mapleray" last week discovered a problem related to systemd unit files, the configuration files used to describe resources and their behavior. Mapleray noticed that a systemd unit file containing an invalid username – one that starts with a digit (e.g. "0day") – will initiate the targeted process with root privileges instead of regular user privileges.

Systemd is designed not to allow usernames that start with a numeric character, but Red Hat, CentOS and other Linux distributions do allow such usernames.

"It's systemd's parsing of the User= parameter that determines the naming doesn't follow a set of conventions, and decides to fall back to its default value, root," explained developer Mattias Geniar.

While this sounds like it could be leveraged to obtain root privileges on any Linux installation using systemd, exploiting the bug in an attack is not an easy task. Geniar pointed out that the attacker needs root privileges in the first place to edit the systemd unit file and use it.

[...] Systemd developers have classified this issue as "not-a-bug" and they apparently don't plan on fixing it. Linux users are divided on the matter – some believe this is a vulnerability that could pose a serious security risk, while others agree that a fix is not necessary.

See, this is why we can't have nice init systems.


Original Submission

This discussion has been archived. No new comments can be posted.
Display Options Threshold/Breakthrough Mark All as Read Mark All as Unread
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
  • (Score: 2) by Azuma Hazuki on Tuesday July 04 2017, @07:58AM (2 children)

    by Azuma Hazuki (5086) Subscriber Badge on Tuesday July 04 2017, @07:58AM (#534721) Journal

    You and me both. I had high hopes, early on, that Debian would provide a sort of anti-RHEL bulwark and be a major force for non-systemd Linux. Essentially, I was hoping they'd rally the rest of the Linux world behind them and then everyone would say in a very loud voice "Okay RedHat, you do your thing, and certify your users on it, but that's YOUR thing."

    Instead, their capitulation essentially gave over almost the entire Linux world to the RHEL way. I am almost maudlin-grateful for Gentoo, Devuan, Slackware, and the shiny new Arch-OpenRC ISO and repo on Sourceforge which I just finished installing not 2 hours ago.

    Unfortunately, with Debian gone this way, *buntu and Mint are also inevitably being dragged along. I really do think Linux as we all knew it died with systemd, and all to fuel RHEL and Oracle's dick-measuring contest it seems.

    And the worst part is, taken in vacuum, *that makes the systemd crew the good guys by comparison.* Arrrrgh.

    I am "that girl" your mother warned you about...
    Starting Score:    1  point
    Karma-Bonus Modifier   +1  

    Total Score:   2  
  • (Score: 2) by Snospar on Tuesday July 04 2017, @08:20AM

    by Snospar (5366) Subscriber Badge on Tuesday July 04 2017, @08:20AM (#534727)

    I'm really hoping that Devuan gathers momentum and becomes a great success. Naive perhaps, but if they can keep fighting the systemd contagion as it touches more and more aspects of Linux then hopefully more users and developers will start to switch over. Who knows, maybe we will see *buntu or Mint based on Devuan in the future!

    I know we have Gentoo, Arch, Slackware, etc that have managed to stay systemd-free but there are many who are very comfortable with the Debian way.

  • (Score: 1) by pTamok on Tuesday July 04 2017, @12:23PM

    by pTamok (3042) on Tuesday July 04 2017, @12:23PM (#534772)

    I too "had high hopes, early on, that Debian would provide a sort of anti-RHEL bulwark and be a major force for non-systemd Linux".

    I was very wrong.

    I don't know if Devuan has the scale needed. I hope it has, but the early signs are not good.