'Re: Review Request 126203: Disable ptrace for kcheckpass and the greeter'

[prev in list] [next in list] [prev in thread] [next in thread] 

List: kde-panel-devel
Subject: Re: Review Request 126203: Disable ptrace for kcheckpass and the greeter
From: "Raphael Kubo da Costa" <rakuco () FreeBSD ! org>
Date: 2015-11-30 16:02:11
Message-ID: 20151130160211.9081.49691 () mimi ! kde ! org
[Download RAW message or body]

--===============3059418490385603857==
MIME-Version: 1.0
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 8bit

> On Nov. 30, 2015, 10:34 a.m., Tobias Berner wrote:
> > I think FreeBSD 10 introduced a similar interface in r277322
> > https://svnweb.freebsd.org/base?view=revision&revision=277322
> > Though it is explicitely stated to not be a "security feature".
> > 
> > According to the man page of progctl 
> > https://www.freebsd.org/cgi/man.cgi?query=procctl&apropos=0&sektion=2&manpath=FreeBSD+10.2-RELEASE&arch=default&format=html
> >  this would be PROC_TRACE_CTL with data PROC_TRACE_CTL_DISABLE.
> > 
> > 
> > I will have to ask someone more familiar with that.
> 
> Martin Gräßlin wrote:
> > how do I get kwin to output the debug output for the framebuffer backend, with qcdebug \
> > lines,
> 
> Given the notes on it, that seems fine. It's not my intention to protect against kernel or \
> root. 
> Raphael Kubo da Costa wrote:
> From a non-Linux perspective, it would be good if there was a CMake check for `prctl()` and \
> `PR_SET_DUMPABLE/PROC_TRACE_CTL` with a big warning in case none was found. The oldest \
> supported FreeBSD release (9.x) will be supported until the end of 2016 and it does not have \
> this functionality, and neither do {Net,DragonFly,Open}BSD, so adding the calls without \
> additional checks will just create additional problems for those packaging kscreenlocker for \
> those platforms, and I doubt they will be able to add a replacement for this without help \
> from their kernel (and existing releases would still be broken). 
> Martin Gräßlin wrote:
> The CMake check seems like a good idea to me - this also allows to make a nice \
> HAVE_PRCTL_DUMPABABLE flag which I would prefer over QOSLINUX or something like that. Anybody \
> know how to write such a check? I assume trying to compile and check whether it compiles?

I think so. Something like this (untested):

```
include(CheckIncludeFile)
include(CheckSymbolExists)

check_include_file("sys/prctl.h" HAVE_SYS_PRCTL_H)
check_symbol_exists(PR_SET_DUMPABLE "sys/prctl.h" HAVE_PR_SET_DUMPABLE)

check_include_file("sys/procctl.h" HAVE_SYS_PROCCTL_H)
check_symbol_exists(PROC_TRACE_CTL "sys/procctl.h" HAVE_PROC_TRACE_CTL)

if (NOT HAVE_PR_SET_DUMPABLE OR NOT HAVE_PROC_TRACE_CTL)
 message(WARNING "Support for disabling ptrace(2) and core dumps via prctl/procctl is not \
available. <scary message here>.") endif ()

configure_file(...)
```

It's unfortunate that the naming could not be standardized, as now one needs to check for those \
macros and call different functions with different arguments depending on their values.

- Raphael

-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://git.reviewboard.kde.org/r/126203/#review88939
-----------------------------------------------------------

On Nov. 30, 2015, 10:01 a.m., Martin Gräßlin wrote:
> 
> -----------------------------------------------------------
> This is an automatically generated e-mail. To reply, visit:
> https://git.reviewboard.kde.org/r/126203/
> -----------------------------------------------------------
> 
> (Updated Nov. 30, 2015, 10:01 a.m.)
> 
> 
> Review request for Plasma and Tobias Berner.
> 
> 
> Repository: kscreenlocker
> 
> 
> Description
> -------
> 
> Setting the PR_SET_DUMPABLE flag to 0 for the security relevant
> command kcheckpass and kscreenlocker_greet. If one wants to gdb into
> the running command it will result in:
> 
> ptrace: Operation not permitted.
> 
> For kscreenlocker_greet ptrace is permitted in testing mode.
> 
> As root it's still possible to attach to the process.
> 
> ---
> 
> @Tobias: I assume this is a strong linux-ism. Is there a FreeBSD compareable functionality?
> 
> I'm considering to push this explicitly without an ifdef. It's a new security feature and I \
> want to make non-Linux systems aware of the fact that it adds a new feature and that a \
> replacement should be added. 
> 
> Diffs
> -----
> 
> greeter/main.cpp e4e679e7ef40b319665428281fdba5f4e0b4eb25 
> kcheckpass/kcheckpass.c fd2d2215bf2199f159a121bb0ce08e7b2b254aaa 
> 
> Diff: https://git.reviewboard.kde.org/r/126203/diff/
> 
> 
> Testing
> -------
> 
> Tried to gdb into the processes: failed
> Tried to gdb into kscreenlocker_greet --testing: succeeded
> Tried to gdb into kscreenlocker_greet as root: succeeded
> 
> 
> Thanks,
> 
> Martin Gräßlin
> 
> 

--===============3059418490385603857==
MIME-Version: 1.0
Content-Type: text/html; charset="utf-8"
Content-Transfer-Encoding: 8bit

<html>
 <body>
  <div style="font-family: Verdana, Arial, Helvetica, Sans-Serif;">
   <table bgcolor="#f9f3c9" width="100%" cellpadding="12" style="border: 1px #c9c399 solid; \
border-radius: 6px; -moz-border-radius: 6px; -webkit-border-radius: 6px;">  <tr>
     <td>
      This is an automatically generated e-mail. To reply, visit:
      <a href="https://git.reviewboard.kde.org/r/126203/">https://git.reviewboard.kde.org/r/126203/</a>
  </td>
    </tr>
   </table>
   <br />

<blockquote style="margin-left: 1em; border-left: 2px solid #d0d0d0; padding-left: 10px;">
 On November 30th, 2015, 10:34 a.m. EET, Tobias Berner \
wrote: <blockquote style="margin-left: 1em; border-left: 2px solid #d0d0d0; padding-left: \
10px;"> <pre style="white-space: pre-wrap; white-space: -moz-pre-wrap; white-space: -pre-wrap; \
white-space: -o-pre-wrap; word-wrap: break-word;">I think FreeBSD 10 introduced a \
similar interface in r277322 https://svnweb.freebsd.org/base?view=revision&amp;revision=277322
Though it is explicitely stated to not be a "security feature".
According to the man page of progctl \
https://www.freebsd.org/cgi/man.cgi?query=procctl&amp;apropos=0&amp;sektion=2&amp;manpath=FreeBSD+10.2-RELEASE&amp;arch=default&amp;format=html
 this would be PROC_TRACE_CTL with data PROC_TRACE_CTL_DISABLE.
I will have to ask someone more familiar with that.</pre> </blockquote>

On November 30th, 2015, 10:43 a.m. EET, Martin Gräßlin wrote:
 <blockquote style="margin-left: 1em; border-left: 2px solid #d0d0d0; padding-left: 10px;">
 <pre style="white-space: pre-wrap; white-space: -moz-pre-wrap; white-space: -pre-wrap; \
white-space: -o-pre-wrap; word-wrap: break-word;"><blockquote style="text-rendering: \
inherit;padding: 0 0 0 1em;border-left: 1px solid #bbb;white-space: normal;margin: 0 0 0 \
0.5em;line-height: inherit;"> how do I get kwin to output the debug output for \
the framebuffer backend, with qcdebug lines, </blockquote>
Given the notes on it, that seems fine. It's not my intention to protect against \
kernel or root.</pre> </blockquote>

On November 30th, 2015, 12:22 p.m. EET, Raphael Kubo da Costa wrote:
 <blockquote style="margin-left: 1em; border-left: 2px solid #d0d0d0; padding-left: 10px;">
 <pre style="white-space: pre-wrap; white-space: -moz-pre-wrap; white-space: -pre-wrap; \
white-space: -o-pre-wrap; word-wrap: break-word;">From a non-Linux perspective, it \
would be good if there was a CMake check for <code style="text-rendering: inherit;color: \
#4444cc;padding: 0;white-space: normal;margin: 0;line-height: inherit;">prctl()</code> and \
<code style="text-rendering: inherit;color: #4444cc;padding: 0;white-space: normal;margin: \
0;line-height: inherit;">PR_SET_DUMPABLE/PROC_TRACE_CTL</code> with a big warning in case none \
was found. The oldest supported FreeBSD release (9.x) will be supported until the end of 2016 \
and it does not have this functionality, and neither do {Net,DragonFly,Open}BSD, so adding the \
calls without additional checks will just create additional problems for those packaging \
kscreenlocker for those platforms, and I doubt they will be able to add a replaceme nt for \
this without help from their kernel (and existing releases would still be broken).</pre> \
</blockquote>

On November 30th, 2015, 5:41 p.m. EET, Martin Gräßlin wrote:
 <blockquote style="margin-left: 1em; border-left: 2px solid #d0d0d0; padding-left: 10px;">
 <pre style="white-space: pre-wrap; white-space: -moz-pre-wrap; white-space: -pre-wrap; \
white-space: -o-pre-wrap; word-wrap: break-word;">The CMake check seems like a good \
idea to me - this also allows to make a nice HAVE_PRCTL_DUMPABABLE flag which I would prefer \
over QOSLINUX or something like that. Anybody know how to write such a check? I assume trying \
to compile and check whether it compiles?</pre> </blockquote>

</blockquote>

<pre style="white-space: pre-wrap; white-space: -moz-pre-wrap; white-space: -pre-wrap; \
white-space: -o-pre-wrap; word-wrap: break-word;">I think so. Something like this \
(untested): <div class="codehilite" style="background: #f8f8f8"><pre \
style="line-height: 125%">include(CheckIncludeFile) include(CheckSymbolExists)

check_include_file(&quot;sys/prctl.h&quot; HAVE_SYS_PRCTL_H)
check_symbol_exists(PR_SET_DUMPABLE &quot;sys/prctl.h&quot; HAVE_PR_SET_DUMPABLE)

check_include_file(&quot;sys/procctl.h&quot; HAVE_SYS_PROCCTL_H)
check_symbol_exists(PROC_TRACE_CTL &quot;sys/procctl.h&quot; HAVE_PROC_TRACE_CTL)

if (NOT HAVE_PR_SET_DUMPABLE OR NOT HAVE_PROC_TRACE_CTL)
  message(WARNING &quot;Support for disabling ptrace(2) and core dumps via prctl/procctl is not \
available. &lt;scary message here&gt;.&quot;) endif ()

configure_file(...)
</pre></div>
</p>
<p style="padding: 0;text-rendering: inherit;margin: 0;line-height: inherit;white-space: \
inherit;">It's unfortunate that the naming could not be standardized, as now one needs to check \
for those macros and call different functions with different arguments depending on their \
values.</p></pre> <br />

<p>- Raphael</p>

<br />
<p>On November 30th, 2015, 10:01 a.m. EET, Martin Gräßlin wrote:</p>

<table bgcolor="#fefadf" width="100%" cellspacing="0" cellpadding="12" style="border: 1px \
#888a85 solid; border-radius: 6px; -moz-border-radius: 6px; -webkit-border-radius: 6px;">  <tr>
  <td>

<div>Review request for Plasma and Tobias Berner.</div>
<div>By Martin Gräßlin.</div>

<p style="color: grey;"><i>Updated Nov. 30, 2015, 10:01 a.m.</i></p>

<div style="margin-top: 1.5em;">
 <b style="color: #575012; font-size: 10pt;">Repository: </b>
kscreenlocker
</div>

<h1 style="color: #575012; font-size: 10pt; margin-top: 1.5em;">Description </h1>
 <table width="100%" bgcolor="#ffffff" cellspacing="0" cellpadding="10" style="border: 1px \
solid #b8b5a0"> <tr>
 <td>
 <pre style="margin: 0; padding: 0; white-space: pre-wrap; white-space: -moz-pre-wrap; \
white-space: -pre-wrap; white-space: -o-pre-wrap; word-wrap: break-word;">Setting the \
PR_SET_DUMPABLE flag to 0 for the security relevant command kcheckpass and kscreenlocker_greet. \
If one wants to gdb into the running command it will result in:
ptrace: Operation not permitted. For kscreenlocker_greet ptrace is \
permitted in testing mode. As root it's still possible to attach to the \
process. <hr style="text-rendering: inherit;margin: 0;padding: 0;white-space: \
normal;border: 1px solid #ddd;line-height: inherit;" /> @Tobias: I assume this is a \
strong linux-ism. Is there a FreeBSD compareable functionality? I'm considering \
to push this explicitly without an ifdef. It's a new security feature and I want to make \
non-Linux systems aware of the fact that it adds a new feature and that a replacement should be \
added.</pre> </td>
 </tr>
</table>

<h1 style="color: #575012; font-size: 10pt; margin-top: 1.5em;">Testing </h1>
<table width="100%" bgcolor="#ffffff" cellspacing="0" cellpadding="10" style="border: 1px solid \
#b8b5a0">  <tr>
  <td>
   <pre style="margin: 0; padding: 0; white-space: pre-wrap; white-space: -moz-pre-wrap; \
white-space: -pre-wrap; white-space: -o-pre-wrap; word-wrap: break-word;"><p style="padding: \
0;text-rendering: inherit;margin: 0;line-height: inherit;white-space: inherit;">Tried to gdb \
into the processes: failed Tried to gdb into kscreenlocker_greet --testing: succeeded
Tried to gdb into kscreenlocker_greet as root: succeeded</p></pre>
  </td>
 </tr>
</table>

<h1 style="color: #575012; font-size: 10pt; margin-top: 1.5em;">Diffs</b> </h1>
<ul style="margin-left: 3em; padding-left: 0;">

 <li>greeter/main.cpp <span style="color: \
grey">(e4e679e7ef40b319665428281fdba5f4e0b4eb25)</span></li>

 <li>kcheckpass/kcheckpass.c <span style="color: \
grey">(fd2d2215bf2199f159a121bb0ce08e7b2b254aaa)</span></li>

</ul>

<p><a href="https://git.reviewboard.kde.org/r/126203/diff/" style="margin-left: 3em;">View \
Diff</a></p>

  </td>
 </tr>
</table>

  </div>
 </body>
</html>

--===============3059418490385603857==--

[Attachment #3 (text/plain)]

_______________________________________________
Plasma-devel mailing list
Plasma-devel@kde.org
https://mail.kde.org/mailman/listinfo/plasma-devel

[prev in list] [next in list] [prev in thread] [next in thread] 