6 May
2019
6 May
'19
2:10 a.m.
Module: check_mk
Branch: master
Commit: cfbe8ba1b6e4a7749db55f777c213c866a54b9f3
URL:
http://git.mathias-kettner.de/git/?p=check_mk.git;a=commit;h=cfbe8ba1b6e4a7…
Author: Lars Michelsen <lm(a)mathias-kettner.de>
Date: Fri May 3 08:15:27 2019 +0200
7344 SEC Changing all setuid root binaries to use linux capabilities
In Linux there is the option to give a binary a SETUID bit. This bit gives the
processes created by the binary all privileges of the binary file owner. There
is also a more advanced concept called "linux capabilities" which makes it
possible to give these processes only a specific set of permissions.
In past versions Check_MK used SETUID root binaries in several places for
different reasons.
<ul>
<li>check_dhcp / check_icmp: Active check plugins which need this permission to
be able to open their raw sockets for sending and receiving their packets.</li>
<li>bin/mkeventd_open514: Open SNMP trap or sylog ports for receiving
messages.</li>
<li>lib/cmc/icmpsender / lib/cmc/icmpreceiver: CEE/CME only: Open raw sockets
for sending and receiving packets.</li>
</ul>
SETUID root binaries are problematic in terms of security, because they could
be used for getting root privileges in case an attacker finds an attackable
security flaw in them. Once exploited the attacker would gain full root access
on the Check_MK system.
Because all of these binaries need the privilege for a very specific known
reason, we have now removed the SETUID bit from these binaries and are now
setting individual linux capabilities to them.
The capabilities have the advantage that they don't give full root access to
the processes created with the binary. Instead they give only a defined set of
permissions.
Change-Id: Idde9bdfb6e0446d655a85d616f563902fc290364
---
.werks/7344 | 38 ++++++++++++++++++++++++
bin/.f12 | 3 +-
omd/Makefile | 8 +++--
omd/debian/postinst.in | 38 ++++++++++++------------
omd/distros/CENTOS_5.mk | 1 +
omd/distros/CENTOS_6.mk | 1 +
omd/distros/CENTOS_7.mk | 1 +
omd/distros/DEBIAN_5.mk | 1 +
omd/distros/DEBIAN_6.mk | 1 +
omd/distros/DEBIAN_7.mk | 1 +
omd/distros/DEBIAN_8.mk | 1 +
omd/distros/DEBIAN_9.mk | 1 +
omd/distros/SLES_11SP1.mk | 1 +
omd/distros/SLES_11SP2.mk | 1 +
omd/distros/SLES_11SP3.mk | 1 +
omd/distros/SLES_11SP4.mk | 1 +
omd/distros/SLES_12.mk | 1 +
omd/distros/SLES_12SP1.mk | 1 +
omd/distros/SLES_12SP2.mk | 1 +
omd/distros/SLES_12SP3.mk | 1 +
omd/distros/SLES_12SP4.mk | 1 +
omd/distros/SLES_15.mk | 1 +
omd/distros/UBUNTU_12.04.mk | 1 +
omd/distros/UBUNTU_13.04.mk | 1 +
omd/distros/UBUNTU_14.04.mk | 1 +
omd/distros/UBUNTU_15.04.mk | 1 +
omd/distros/UBUNTU_16.04.mk | 1 +
omd/distros/UBUNTU_16.10.mk | 1 +
omd/distros/UBUNTU_17.04.mk | 1 +
omd/distros/UBUNTU_17.10.mk | 1 +
omd/distros/UBUNTU_18.04.mk | 1 +
omd/distros/UBUNTU_18.10.mk | 1 +
omd/omd.spec.in | 15 ++++++----
omd/packages/cma/post-install | 26 +++++++++++++++--
scripts/setup.sh | 3 +-
tests/integration/omd/test_setuid_binaries.py | 42 +++++++++++++++++----------
36 files changed, 155 insertions(+), 46 deletions(-)
Diff:
http://git.mathias-kettner.de/git/?p=check_mk.git;a=commitdiff;h=cfbe8ba1b6…