[PATCH] ldd: never run file directly

[PATCH] ldd: never run file directly

[Florian Weimer]

[-- Attachment #1: Type: text/plain, Size: 175 bytes --]

We have this old patch in our packages.  I think most distributions use
something similar, as a guard against surprises.

Can we finally apply this upstream?

Thanks,
Florian

[-- Attachment #2: glibc-fedora-ldd.patch --]
[-- Type: text/x-patch, Size: 1171 bytes --]

From 83e5edd390eabe8f8e8e0d051f929b77a30c0767 Mon Sep 17 00:00:00 2001
From: Andreas Schwab <schwab@redhat.com>
Date: Fri, 18 Mar 2011 16:22:52 +0100
Subject: [PATCH] ldd: never run file directly

* elf/ldd.bash.in: Never run file directly.

---
 ChangeLog       |    4 ++++
 elf/ldd.bash.in |   14 +-------------
 2 files changed, 5 insertions(+), 13 deletions(-)

--- a/elf/ldd.bash.in
+++ b/elf/ldd.bash.in
@@ -166,18 +166,6 @@ warning: you do not have execution permission for" "\`$file'" >&2
       fi
     done
     case $ret in
-    0)
-      # If the program exits with exit code 5, it means the process has been
-      # invoked with __libc_enable_secure.  Fall back to running it through
-      # the dynamic linker.
-      try_trace "$file"
-      rc=$?
-      if [ $rc = 5 ]; then
-	try_trace "$RTLD" "$file"
-	rc=$?
-      fi
-      [ $rc = 0 ] || result=1
-      ;;
     1)
       # This can be a non-ELF binary or no binary at all.
       nonelf "$file" || {
@@ -185,7 +173,7 @@ warning: you do not have execution permission for" "\`$file'" >&2
 	result=1
       }
       ;;
-    2)
+    0|2)
       try_trace "$RTLD" "$file" || result=1
       ;;
     *)

Re: [PATCH] ldd: never run file directly

[Carlos O'Donell]

On 08/16/2017 09:48 AM, Florian Weimer wrote:
> We have this old patch in our packages.  I think most distributions use
> something similar, as a guard against surprises.
> 
> Can we finally apply this upstream?

Yes please.

This is ridiculous behaviour on the part of upstream, you have no idea
what interpreter is encoded into the binary you are about to run, and
therefore should never run it directly for security reason.

The goal of ldd is always to print information about the program without
having to run it. We don't yet have a finished eu-ldd :-)
 
> From 83e5edd390eabe8f8e8e0d051f929b77a30c0767 Mon Sep 17 00:00:00 2001
> From: Andreas Schwab <schwab@redhat.com>
> Date: Fri, 18 Mar 2011 16:22:52 +0100
> Subject: [PATCH] ldd: never run file directly
> 
> * elf/ldd.bash.in: Never run file directly.
> 
> ---
>  ChangeLog       |    4 ++++
>  elf/ldd.bash.in |   14 +-------------
>  2 files changed, 5 insertions(+), 13 deletions(-)
> 
> --- a/elf/ldd.bash.in
> +++ b/elf/ldd.bash.in
> @@ -166,18 +166,6 @@ warning: you do not have execution permission for" "\`$file'" >&2
>        fi
>      done
>      case $ret in
> -    0)
> -      # If the program exits with exit code 5, it means the process has been
> -      # invoked with __libc_enable_secure.  Fall back to running it through
> -      # the dynamic linker.
> -      try_trace "$file"
> -      rc=$?
> -      if [ $rc = 5 ]; then
> -	try_trace "$RTLD" "$file"
> -	rc=$?
> -      fi
> -      [ $rc = 0 ] || result=1
> -      ;;

OK. This code is dangerous and depending on PT_INTERP can run anything
that might not honour the LD_DEBUG tracing options and therefore
execute a program you didn't intend to run as your user.

>      1)
>        # This can be a non-ELF binary or no binary at all.
>        nonelf "$file" || {
> @@ -185,7 +173,7 @@ warning: you do not have execution permission for" "\`$file'" >&2
>  	result=1
>        }
>        ;;
> -    2)
> +    0|2)
>        try_trace "$RTLD" "$file" || result=1
>        ;;
>      *)

OK.

-- 
Cheers,
Carlos.

Re: [PATCH] ldd: never run file directly

[Andreas Schwab]

On Aug 16 2017, Florian Weimer <fweimer@redhat.com> wrote:

> We have this old patch in our packages.  I think most distributions use
> something similar, as a guard against surprises.
>
> Can we finally apply this upstream?
>
> Thanks,
> Florian
>
> From 83e5edd390eabe8f8e8e0d051f929b77a30c0767 Mon Sep 17 00:00:00 2001
> From: Andreas Schwab <schwab@redhat.com>
> Date: Fri, 18 Mar 2011 16:22:52 +0100
> Subject: [PATCH] ldd: never run file directly
>
> * elf/ldd.bash.in: Never run file directly.

This is BZ #16750, CVE-2009-5064.

Andreas.

-- 
Andreas Schwab, SUSE Labs, schwab@suse.de
GPG Key fingerprint = 0196 BAD8 1CE9 1970 F4BE  1748 E4D4 88E3 0EEA B9D7
"And now for something completely different."

Re: [PATCH] ldd: never run file directly

[Dmitry V. Levin]

[-- Attachment #1: Type: text/plain, Size: 310 bytes --]

On Wed, Aug 16, 2017 at 03:48:18PM +0200, Florian Weimer wrote:
> We have this old patch in our packages.  I think most distributions use
> something similar, as a guard against surprises.

We patch ldd this way for 15 years already.

> Can we finally apply this upstream?

Yes, please.


-- 
ldv

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 801 bytes --]

Re: [PATCH] ldd: never run file directly

[Florian Weimer]

On 08/16/2017 04:11 PM, Andreas Schwab wrote:
> On Aug 16 2017, Florian Weimer <fweimer@redhat.com> wrote:
> 
>> We have this old patch in our packages.  I think most distributions use
>> something similar, as a guard against surprises.
>>
>> Can we finally apply this upstream?
>>
>> Thanks,
>> Florian
>>
>> From 83e5edd390eabe8f8e8e0d051f929b77a30c0767 Mon Sep 17 00:00:00 2001
>> From: Andreas Schwab <schwab@redhat.com>
>> Date: Fri, 18 Mar 2011 16:22:52 +0100
>> Subject: [PATCH] ldd: never run file directly
>>
>> * elf/ldd.bash.in: Never run file directly.
> 
> This is BZ #16750, CVE-2009-5064.

Thanks.  What about this NEWS entry for it?

+  CVE-2009-5064: The ldd script would sometimes run the program under
+  examination directly, without preventing code execution through the
+  dynamic linker.  (The glibc project disputes that this is a security
+  vulnerability; only trusted binaries must be examined using the ldd
+  script.)

Thanks,
Florian

Re: [PATCH] ldd: never run file directly

[Andreas Schwab]

On Aug 16 2017, Florian Weimer <fweimer@redhat.com> wrote:

> Thanks.  What about this NEWS entry for it?
>
> +  CVE-2009-5064: The ldd script would sometimes run the program under
> +  examination directly, without preventing code execution through the
> +  dynamic linker.  (The glibc project disputes that this is a security
> +  vulnerability; only trusted binaries must be examined using the ldd
> +  script.)

Looks ok.

Andreas.

-- 
Andreas Schwab, SUSE Labs, schwab@suse.de
GPG Key fingerprint = 0196 BAD8 1CE9 1970 F4BE  1748 E4D4 88E3 0EEA B9D7
"And now for something completely different."