[Bug translator/30321] New: apply privilege separation for passes 2/3/4, esp. if invoked as root

["fche at redhat dot com" <sourceware-bugzilla@sourceware.org>]

https://sourceware.org/bugzilla/show_bug.cgi?id=30321

            Bug ID: 30321
           Summary: apply privilege separation for passes 2/3/4, esp. if
                    invoked as root
           Product: systemtap
           Version: unspecified
            Status: NEW
          Severity: normal
          Priority: P2
         Component: translator
          Assignee: systemtap at sourceware dot org
          Reporter: fche at redhat dot com
  Target Milestone: ---

systemtap's pass 2 (and a bit of pass 3 - the -d option) involves processing
elf/dwarf files via elfutils.  While these files tend to be trusted &
trustworthy, it may be comforting from a security perspective if systemtap
attempts to shed privileges while dealing with them.  Similarly, invoking the
subordinate compilers should be done with a reduced privilege if possible.

Some complications:

- pass 2 may well involve elfutils-triggered debuginfod downloads,
  ergo client cache writes

- pass 3 may want to read /proc/kallsyms, which the kernel may obfuscate
  unless read as root

- filesystem permissions for the target binaries may require root to open
  (but not to process)

- pass 5 will generally require full privileges, so simply dropping privs
  early altogether is not possible


The smallest practical step that may give some incremental protection
could be to add some setreuid(2) calls to temporarily swap between root
and an unprivileged uid around certain processing steps.

-- 
You are receiving this mail because:
You are the assignee for the bug.