Make shadow more robust in hostile environments #4
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
added 5 commits
February 27, 2015 17:01
For most operations tools have compiled-in defaults, and thus can operate without login.defs present.
When compiled with PAM certain settings are not used, however they are still defined in the stock login.defs file. Thus every command reports them as "unknown setting contact administrator". Alternative would be to parse stock login.defs and comment out/remove settings that are not applied, when compiled with PAM.
passwd, shadow, group, gshadow etc. can be managed via nss - e.g. system default accounts can be specified using nss_altfiles, rather than in /etc/. Thus despite having default accounts, these files can be missing on disk and thus should be opened with O_CREATE whenever they are attempted to be opened in O_RDWR modes.
|
Sorry, I lost track of this, I thought you were discussing it with someone else. Should we merge this at this point? |
hallyn
added a commit
that referenced
this pull request
Nov 13, 2015
Make shadow more robust in hostile environments
cgzones
added a commit
to cgzones/shadow
that referenced
this pull request
Apr 1, 2023
Free the actual struct of the removed entry.
Example userdel report:
Direct leak of 40 byte(s) in 1 object(s) allocated from:
#0 0x55b230efe857 in reallocarray (./src/userdel+0xda857)
shadow-maint#1 0x55b230f6041f in mallocarray ./lib/./alloc.h:97:9
shadow-maint#2 0x55b230f6041f in commonio_open ./lib/commonio.c:563:7
shadow-maint#3 0x55b230f39098 in open_files ./src/userdel.c:555:6
shadow-maint#4 0x55b230f39098 in main ./src/userdel.c:1189:2
shadow-maint#5 0x7f9b48c64189 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
hallyn
pushed a commit
that referenced
this pull request
Apr 26, 2023
Free the actual struct of the removed entry.
Example userdel report:
Direct leak of 40 byte(s) in 1 object(s) allocated from:
#0 0x55b230efe857 in reallocarray (./src/userdel+0xda857)
#1 0x55b230f6041f in mallocarray ./lib/./alloc.h:97:9
#2 0x55b230f6041f in commonio_open ./lib/commonio.c:563:7
#3 0x55b230f39098 in open_files ./src/userdel.c:555:6
#4 0x55b230f39098 in main ./src/userdel.c:1189:2
#5 0x7f9b48c64189 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
I'm patching shadow to be more robust when operating in a-typical environments, but these improvements are general enough, that I believe warrant inclusion upstream by default.
Specifically there are deployments that use nss-altfiles / nss-extrausers and thus ship alternative group/passwd/shadow/gshadow files elsewhere on the filesystem (e.g. /var/lib/passwd). In such configurations admin modifiable files /etc/passwd, /etc/group and so on may not exist. Furthermore if one is bootstrapping a new distribution from scratch, it would be nice to point shadow utilities at an empty /etc and start creating default system accounts with useradd/usermod/groupadd/etc utilities without writing initial files by hand. Hence these changes:
Overall my goal is to have fully usable system with empty /etc and with these initial patches this is achievable. At the moment I'm also working on adding full usermod support, when operating with nss-altfiles.
Please review and consider including these patches.