[Touch-packages] [Bug 1784964] Re: Regression due to CVE-2018-1116 (processes not inheriting user ID or groups )
TJ is right, I also confirmed this issue on a freshly installed 18.04.1 x86_64 Desktop VM last night. After enabling 'proposed' and installing all pending updates, 'groups' in a terminal returned just the users primary group. I then restored a snapshot taken right after the 18.04 installation (but with 'proposed' already enabled), and installed all pending updates again, this time one by one, but could not reproduce it then. I don't have any indication that the outcome would have been any different without 'proposed'. So it remains unclear to me how to reproduce this reliably. It is clear that it is possible to reproduce this (occasionally) on a fresh 18.04.1 installation. And also on 16.04.5. So I do think it will affect many. -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to policykit-1 in Ubuntu. https://bugs.launchpad.net/bugs/1784964 Title: Regression due to CVE-2018-1116 (processes not inheriting user ID or groups ) Status in policykit-1 package in Ubuntu: Confirmed Bug description: This report is tracking a possible regression caused by the recent CVE-2018-1116 patches to policykit-1. On 18.04, since package upgrades on July 23rd, and after the first reboot since then on Aug 1st, I hit an issue with the primary (sudo, adm, etc...) user getting Permission Denied trying to do: tail -f /var/log/syslog when that file is owned by syslog:adm and is g=r. I then found that "groups" reports only the $USER and not the entire list, but "groups $USER" reports all the groups correctly. The user shell is set to /usr/bin/tmux and /etc/tmux.conf has "set -g default-shell /bin/bash" After changing the user's shell back to /bin/bash and logging in on tty1 the list of groups shows correctly for the /bin/bash process running on tty1. I investigated and found that for the affected processes, such as the tmux process, /proc/$PID/loginuid = 4294967295 whereas the /bin/bash process on tty1 correctly reported 1000. The same with the respective gid_map and uid_map. 4294967295 == -1 == 0x The recent CVE patch to policykit has several functions where it does "uid = -1" which seems to tie in to my findings so far. I also noticed Ubuntu is still based on version 0.105 which was released in 2012 - upstream released 0.115 with the CVE patch. I suspect the backporting has missed something. The Ubuntu backport patch is: https://git.launchpad.net/ubuntu/+source/policykit-1/commit/?h=applied/ubuntu /bionic-devel=840c50182f5ab1ba28c1d20cce4c207364852935 To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/policykit-1/+bug/1784964/+subscriptions -- Mailing list: https://launchpad.net/~touch-packages Post to : touch-packages@lists.launchpad.net Unsubscribe : https://launchpad.net/~touch-packages More help : https://help.launchpad.net/ListHelp
[Touch-packages] [Bug 1784964] Re: Regression due to CVE-2018-1116 (processes not inheriting user ID or groups )
I've awk-ed a list of the packages Upgraded or Installed on July 28th on
the affected PC (previous upgrade was on July 8th). I've put a ? in
front of those that could be suspect. That list is short:
grep '^?' Hacking/bug-groups-packages-updated.log
? gir1.2-polkit-1.0:amd64 (0.105-20, 0.105-20ubuntu0.18.04.1),
? libpam-systemd:amd64 (237-3ubuntu10, 237-3ubuntu10.3),
? libpolkit-agent-1-0:amd64 (0.105-20, 0.105-20ubuntu0.18.04.1),
? libpolkit-backend-1-0:amd64 (0.105-20, 0.105-20ubuntu0.18.04.1),
? libpolkit-gobject-1-0:amd64 (0.105-20, 0.105-20ubuntu0.18.04.1),
? libsystemd0:amd64 (237-3ubuntu10, 237-3ubuntu10.3),
? libsystemd0:i386 (237-3ubuntu10, 237-3ubuntu10.3),
? policykit-1:amd64 (0.105-20, 0.105-20ubuntu0.18.04.1),
? systemd:amd64 (237-3ubuntu10, 237-3ubuntu10.3),
The entire list is attached in case I've missed something.
The command used to generate it was:
zcat history.log.1.gz | awk '/^Start-Date:.*2018-07-28/{FOUND=1; print
-bash} FOUND && /^(Install|Upgrade): / { LIST=gensub( /), /, "),\n",
"g", -bash) } { if(LIST != "") {gsub(/^(Install|Upgrade): /, "", LIST);
print "---"; print LIST | "sort"; print "---"; LIST=""}}' > ~/Hacking
/bug-groups-packages-updated.log
** Attachment added: "List of packages upgraded July 28th"
https://bugs.launchpad.net/ubuntu/+source/policykit-1/+bug/1784964/+attachment/5170768/+files/bug-groups-packages-updated.log
--
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to policykit-1 in Ubuntu.
https://bugs.launchpad.net/bugs/1784964
Title:
Regression due to CVE-2018-1116 (processes not inheriting user ID or
groups )
Status in policykit-1 package in Ubuntu:
Confirmed
Bug description:
This report is tracking a possible regression caused by the recent
CVE-2018-1116 patches to policykit-1.
On 18.04, since package upgrades on July 23rd, and after the first
reboot since then on Aug 1st, I hit an issue with the primary (sudo,
adm, etc...) user getting Permission Denied trying to do:
tail -f /var/log/syslog
when that file is owned by syslog:adm and is g=r.
I then found that "groups" reports only the $USER and not the entire
list, but "groups $USER" reports all the groups correctly.
The user shell is set to /usr/bin/tmux and /etc/tmux.conf has "set -g
default-shell /bin/bash"
After changing the user's shell back to /bin/bash and logging in on
tty1 the list of groups shows correctly for the /bin/bash process
running on tty1.
I investigated and found that for the affected processes, such as the
tmux process, /proc/$PID/loginuid = 4294967295 whereas the /bin/bash
process on tty1 correctly reported 1000. The same with the respective
gid_map and uid_map.
4294967295 == -1 == 0x
The recent CVE patch to policykit has several functions where it does
"uid = -1" which seems to tie in to my findings so far.
I also noticed Ubuntu is still based on version 0.105 which was
released in 2012 - upstream released 0.115 with the CVE patch.
I suspect the backporting has missed something.
The Ubuntu backport patch is:
https://git.launchpad.net/ubuntu/+source/policykit-1/commit/?h=applied/ubuntu
/bionic-devel=840c50182f5ab1ba28c1d20cce4c207364852935
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/policykit-1/+bug/1784964/+subscriptions
--
Mailing list: https://launchpad.net/~touch-packages
Post to : touch-packages@lists.launchpad.net
Unsubscribe : https://launchpad.net/~touch-packages
More help : https://help.launchpad.net/ListHelp
[Touch-packages] [Bug 1784964] Re: Regression due to CVE-2018-1116 (processes not inheriting user ID or groups )
Tom tried those things in a VM last night and could reproduce it. On a suggestion by Robbie Basak but the downgrade didn't solve it, which made me suggest something in the configuration is being permanently changed. I'm not going to downgrade the package because I am debugging it and don't want to disturb the system. As Tom reproduced in a VM and on 16.04.5 I wonder if this is a timing issue that the _racy_ detection is truly detecting. The common thread is Tom and myself are both using Xubuntu/XFCE. -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to policykit-1 in Ubuntu. https://bugs.launchpad.net/bugs/1784964 Title: Regression due to CVE-2018-1116 (processes not inheriting user ID or groups ) Status in policykit-1 package in Ubuntu: Confirmed Bug description: This report is tracking a possible regression caused by the recent CVE-2018-1116 patches to policykit-1. On 18.04, since package upgrades on July 23rd, and after the first reboot since then on Aug 1st, I hit an issue with the primary (sudo, adm, etc...) user getting Permission Denied trying to do: tail -f /var/log/syslog when that file is owned by syslog:adm and is g=r. I then found that "groups" reports only the $USER and not the entire list, but "groups $USER" reports all the groups correctly. The user shell is set to /usr/bin/tmux and /etc/tmux.conf has "set -g default-shell /bin/bash" After changing the user's shell back to /bin/bash and logging in on tty1 the list of groups shows correctly for the /bin/bash process running on tty1. I investigated and found that for the affected processes, such as the tmux process, /proc/$PID/loginuid = 4294967295 whereas the /bin/bash process on tty1 correctly reported 1000. The same with the respective gid_map and uid_map. 4294967295 == -1 == 0x The recent CVE patch to policykit has several functions where it does "uid = -1" which seems to tie in to my findings so far. I also noticed Ubuntu is still based on version 0.105 which was released in 2012 - upstream released 0.115 with the CVE patch. I suspect the backporting has missed something. The Ubuntu backport patch is: https://git.launchpad.net/ubuntu/+source/policykit-1/commit/?h=applied/ubuntu /bionic-devel=840c50182f5ab1ba28c1d20cce4c207364852935 To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/policykit-1/+bug/1784964/+subscriptions -- Mailing list: https://launchpad.net/~touch-packages Post to : touch-packages@lists.launchpad.net Unsubscribe : https://launchpad.net/~touch-packages More help : https://help.launchpad.net/ListHelp
[Touch-packages] [Bug 1784964] Re: Regression due to CVE-2018-1116 (processes not inheriting user ID or groups )
I've tried replicating your setup in a fresh bionic VM (ie. using tmux as default shell which then launches bash) and I can't replicate this: amurray@sec-bionic-amd64:~$ grep amurray /etc/passwd amurray:x:1000:1000:Ubuntu,,,:/home/amurray:/usr/bin/tmux amurray@sec-bionic-amd64:~$ echo $SHELL /bin/bash amurray@sec-bionic-amd64:~$ cat /etc/tmux.conf set -g default-shell /bin/bash amurray@sec-bionic-amd64:~$ groups amurray adm cdrom sudo dip plugdev lpadmin sambashare This is all from within a graphic gnome-terminal launched after logging into the desktop (see picture which I will attach separately). Can you perhaps try and provide more details on how I could try and replicate this? A couple things to try 1. I've rebuilt polkit-1 with some extra debugging to try and flag when UIDs mismatch - this should end up in the following PPA https://launchpad.net/~alexmurray/+archive/ubuntu/lp1784964 which you could try installing from and seeing if journalctl shows anything? 2. Can you try downgrading polkit-1 and see if that resolves the issue? -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to policykit-1 in Ubuntu. https://bugs.launchpad.net/bugs/1784964 Title: Regression due to CVE-2018-1116 (processes not inheriting user ID or groups ) Status in policykit-1 package in Ubuntu: Confirmed Bug description: This report is tracking a possible regression caused by the recent CVE-2018-1116 patches to policykit-1. On 18.04, since package upgrades on July 23rd, and after the first reboot since then on Aug 1st, I hit an issue with the primary (sudo, adm, etc...) user getting Permission Denied trying to do: tail -f /var/log/syslog when that file is owned by syslog:adm and is g=r. I then found that "groups" reports only the $USER and not the entire list, but "groups $USER" reports all the groups correctly. The user shell is set to /usr/bin/tmux and /etc/tmux.conf has "set -g default-shell /bin/bash" After changing the user's shell back to /bin/bash and logging in on tty1 the list of groups shows correctly for the /bin/bash process running on tty1. I investigated and found that for the affected processes, such as the tmux process, /proc/$PID/loginuid = 4294967295 whereas the /bin/bash process on tty1 correctly reported 1000. The same with the respective gid_map and uid_map. 4294967295 == -1 == 0x The recent CVE patch to policykit has several functions where it does "uid = -1" which seems to tie in to my findings so far. I also noticed Ubuntu is still based on version 0.105 which was released in 2012 - upstream released 0.115 with the CVE patch. I suspect the backporting has missed something. The Ubuntu backport patch is: https://git.launchpad.net/ubuntu/+source/policykit-1/commit/?h=applied/ubuntu /bionic-devel=840c50182f5ab1ba28c1d20cce4c207364852935 To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/policykit-1/+bug/1784964/+subscriptions -- Mailing list: https://launchpad.net/~touch-packages Post to : touch-packages@lists.launchpad.net Unsubscribe : https://launchpad.net/~touch-packages More help : https://help.launchpad.net/ListHelp
[Touch-packages] [Bug 1784964] Re: Regression due to CVE-2018-1116 (processes not inheriting user ID or groups )
** Attachment added: "Screenshot from 2018-08-02 14-11-37.png" https://bugs.launchpad.net/ubuntu/+source/policykit-1/+bug/1784964/+attachment/5170643/+files/Screenshot%20from%202018-08-02%2014-11-37.png -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to policykit-1 in Ubuntu. https://bugs.launchpad.net/bugs/1784964 Title: Regression due to CVE-2018-1116 (processes not inheriting user ID or groups ) Status in policykit-1 package in Ubuntu: Confirmed Bug description: This report is tracking a possible regression caused by the recent CVE-2018-1116 patches to policykit-1. On 18.04, since package upgrades on July 23rd, and after the first reboot since then on Aug 1st, I hit an issue with the primary (sudo, adm, etc...) user getting Permission Denied trying to do: tail -f /var/log/syslog when that file is owned by syslog:adm and is g=r. I then found that "groups" reports only the $USER and not the entire list, but "groups $USER" reports all the groups correctly. The user shell is set to /usr/bin/tmux and /etc/tmux.conf has "set -g default-shell /bin/bash" After changing the user's shell back to /bin/bash and logging in on tty1 the list of groups shows correctly for the /bin/bash process running on tty1. I investigated and found that for the affected processes, such as the tmux process, /proc/$PID/loginuid = 4294967295 whereas the /bin/bash process on tty1 correctly reported 1000. The same with the respective gid_map and uid_map. 4294967295 == -1 == 0x The recent CVE patch to policykit has several functions where it does "uid = -1" which seems to tie in to my findings so far. I also noticed Ubuntu is still based on version 0.105 which was released in 2012 - upstream released 0.115 with the CVE patch. I suspect the backporting has missed something. The Ubuntu backport patch is: https://git.launchpad.net/ubuntu/+source/policykit-1/commit/?h=applied/ubuntu /bionic-devel=840c50182f5ab1ba28c1d20cce4c207364852935 To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/policykit-1/+bug/1784964/+subscriptions -- Mailing list: https://launchpad.net/~touch-packages Post to : touch-packages@lists.launchpad.net Unsubscribe : https://launchpad.net/~touch-packages More help : https://help.launchpad.net/ListHelp
[Touch-packages] [Bug 1784964] Re: Regression due to CVE-2018-1116 (processes not inheriting user ID or groups )
It seems that /var/run/ConsoleKit directory and its database is only created by console tty log-ins but not the GUI. There was no directory after GUI Terminal shell started; only after switching to TTY1. So it would seem this isn't the cause since PCs without ConsoleKit work fine. -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to policykit-1 in Ubuntu. https://bugs.launchpad.net/bugs/1784964 Title: Regression due to CVE-2018-1116 (processes not inheriting user ID or groups ) Status in policykit-1 package in Ubuntu: Confirmed Bug description: This report is tracking a possible regression caused by the recent CVE-2018-1116 patches to policykit-1. On 18.04, since package upgrades on July 23rd, and after the first reboot since then on Aug 1st, I hit an issue with the primary (sudo, adm, etc...) user getting Permission Denied trying to do: tail -f /var/log/syslog when that file is owned by syslog:adm and is g=r. I then found that "groups" reports only the $USER and not the entire list, but "groups $USER" reports all the groups correctly. The user shell is set to /usr/bin/tmux and /etc/tmux.conf has "set -g default-shell /bin/bash" After changing the user's shell back to /bin/bash and logging in on tty1 the list of groups shows correctly for the /bin/bash process running on tty1. I investigated and found that for the affected processes, such as the tmux process, /proc/$PID/loginuid = 4294967295 whereas the /bin/bash process on tty1 correctly reported 1000. The same with the respective gid_map and uid_map. 4294967295 == -1 == 0x The recent CVE patch to policykit has several functions where it does "uid = -1" which seems to tie in to my findings so far. I also noticed Ubuntu is still based on version 0.105 which was released in 2012 - upstream released 0.115 with the CVE patch. I suspect the backporting has missed something. The Ubuntu backport patch is: https://git.launchpad.net/ubuntu/+source/policykit-1/commit/?h=applied/ubuntu /bionic-devel=840c50182f5ab1ba28c1d20cce4c207364852935 To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/policykit-1/+bug/1784964/+subscriptions -- Mailing list: https://launchpad.net/~touch-packages Post to : touch-packages@lists.launchpad.net Unsubscribe : https://launchpad.net/~touch-packages More help : https://help.launchpad.net/ListHelp
[Touch-packages] [Bug 1784964] Re: Regression due to CVE-2018-1116 (processes not inheriting user ID or groups )
Looking at the diff between upstream 0.105 and Ubuntu's I happened to notice the CKDB_PATH (ConsoleKit database path) /var/run/ConsoleKit/database which seems to be consulted on some occasions. On the affected PC which was d-r-u-ed from 16.04 ConsoleKit 0.4.6-5 is still installed and that database is present. On another PC that has a clean 18.04 install that doesn't exist because consolekit is purely virtual now. I'm not sure if this is relevant or not but worth reporting. The database contains (for the *good* session) : [Seat /org/freedesktop/ConsoleKit/Seat1] kind=0 sessions=/org/freedesktop/ConsoleKit/Session1 devices= [Session /org/freedesktop/ConsoleKit/Session1] uid=1000 seat=/org/freedesktop/ConsoleKit/Seat1 login_session_id=3 display_device=/dev/tty1 remote_host_name= is_active=false is_local=true creation_time=2018-08-02T01:18:34.707417Z [SessionLeader /org/freedesktop/ConsoleKit/Session1] session=/org/freedesktop/ConsoleKit/Session1 uid=0 pid=2494 service_name=:1.73 Note it references "display_device=/dev/tty1" That is, I think, a reference to the TTY1 console login I did first. I'm going to restart after writing this and check what is in the file if I open the GUI Terminal shell first. -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to policykit-1 in Ubuntu. https://bugs.launchpad.net/bugs/1784964 Title: Regression due to CVE-2018-1116 (processes not inheriting user ID or groups ) Status in policykit-1 package in Ubuntu: Confirmed Bug description: This report is tracking a possible regression caused by the recent CVE-2018-1116 patches to policykit-1. On 18.04, since package upgrades on July 23rd, and after the first reboot since then on Aug 1st, I hit an issue with the primary (sudo, adm, etc...) user getting Permission Denied trying to do: tail -f /var/log/syslog when that file is owned by syslog:adm and is g=r. I then found that "groups" reports only the $USER and not the entire list, but "groups $USER" reports all the groups correctly. The user shell is set to /usr/bin/tmux and /etc/tmux.conf has "set -g default-shell /bin/bash" After changing the user's shell back to /bin/bash and logging in on tty1 the list of groups shows correctly for the /bin/bash process running on tty1. I investigated and found that for the affected processes, such as the tmux process, /proc/$PID/loginuid = 4294967295 whereas the /bin/bash process on tty1 correctly reported 1000. The same with the respective gid_map and uid_map. 4294967295 == -1 == 0x The recent CVE patch to policykit has several functions where it does "uid = -1" which seems to tie in to my findings so far. I also noticed Ubuntu is still based on version 0.105 which was released in 2012 - upstream released 0.115 with the CVE patch. I suspect the backporting has missed something. The Ubuntu backport patch is: https://git.launchpad.net/ubuntu/+source/policykit-1/commit/?h=applied/ubuntu /bionic-devel=840c50182f5ab1ba28c1d20cce4c207364852935 To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/policykit-1/+bug/1784964/+subscriptions -- Mailing list: https://launchpad.net/~touch-packages Post to : touch-packages@lists.launchpad.net Unsubscribe : https://launchpad.net/~touch-packages More help : https://help.launchpad.net/ListHelp
[Touch-packages] [Bug 1784964] Re: Regression due to CVE-2018-1116 (processes not inheriting user ID or groups )
@TJ re comment:6 that fix is already in for both xenial and bionic as far as I can see. -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to policykit-1 in Ubuntu. https://bugs.launchpad.net/bugs/1784964 Title: Regression due to CVE-2018-1116 (processes not inheriting user ID or groups ) Status in policykit-1 package in Ubuntu: Confirmed Bug description: This report is tracking a possible regression caused by the recent CVE-2018-1116 patches to policykit-1. On 18.04, since package upgrades on July 23rd, and after the first reboot since then on Aug 1st, I hit an issue with the primary (sudo, adm, etc...) user getting Permission Denied trying to do: tail -f /var/log/syslog when that file is owned by syslog:adm and is g=r. I then found that "groups" reports only the $USER and not the entire list, but "groups $USER" reports all the groups correctly. The user shell is set to /usr/bin/tmux and /etc/tmux.conf has "set -g default-shell /bin/bash" After changing the user's shell back to /bin/bash and logging in on tty1 the list of groups shows correctly for the /bin/bash process running on tty1. I investigated and found that for the affected processes, such as the tmux process, /proc/$PID/loginuid = 4294967295 whereas the /bin/bash process on tty1 correctly reported 1000. The same with the respective gid_map and uid_map. 4294967295 == -1 == 0x The recent CVE patch to policykit has several functions where it does "uid = -1" which seems to tie in to my findings so far. I also noticed Ubuntu is still based on version 0.105 which was released in 2012 - upstream released 0.115 with the CVE patch. I suspect the backporting has missed something. The Ubuntu backport patch is: https://git.launchpad.net/ubuntu/+source/policykit-1/commit/?h=applied/ubuntu /bionic-devel=840c50182f5ab1ba28c1d20cce4c207364852935 To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/policykit-1/+bug/1784964/+subscriptions -- Mailing list: https://launchpad.net/~touch-packages Post to : touch-packages@lists.launchpad.net Unsubscribe : https://launchpad.net/~touch-packages More help : https://help.launchpad.net/ListHelp
[Touch-packages] [Bug 1784964] Re: Regression due to CVE-2018-1116 (processes not inheriting user ID or groups )
Looking at the diff between Ubuntu and upstream I noticed Ubuntu 0.105 code isn't adapted for "systemd --user" as described in https://bugs.freedesktop.org/show_bug.cgi?id=76358 and in the source for the function: polkit_backend_session_monitor_is_session_active() ** Bug watch added: freedesktop.org Bugzilla #76358 https://bugs.freedesktop.org/show_bug.cgi?id=76358 -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to policykit-1 in Ubuntu. https://bugs.launchpad.net/bugs/1784964 Title: Regression due to CVE-2018-1116 (processes not inheriting user ID or groups ) Status in policykit-1 package in Ubuntu: Confirmed Bug description: This report is tracking a possible regression caused by the recent CVE-2018-1116 patches to policykit-1. On 18.04, since package upgrades on July 23rd, and after the first reboot since then on Aug 1st, I hit an issue with the primary (sudo, adm, etc...) user getting Permission Denied trying to do: tail -f /var/log/syslog when that file is owned by syslog:adm and is g=r. I then found that "groups" reports only the $USER and not the entire list, but "groups $USER" reports all the groups correctly. The user shell is set to /usr/bin/tmux and /etc/tmux.conf has "set -g default-shell /bin/bash" After changing the user's shell back to /bin/bash and logging in on tty1 the list of groups shows correctly for the /bin/bash process running on tty1. I investigated and found that for the affected processes, such as the tmux process, /proc/$PID/loginuid = 4294967295 whereas the /bin/bash process on tty1 correctly reported 1000. The same with the respective gid_map and uid_map. 4294967295 == -1 == 0x The recent CVE patch to policykit has several functions where it does "uid = -1" which seems to tie in to my findings so far. I also noticed Ubuntu is still based on version 0.105 which was released in 2012 - upstream released 0.115 with the CVE patch. I suspect the backporting has missed something. The Ubuntu backport patch is: https://git.launchpad.net/ubuntu/+source/policykit-1/commit/?h=applied/ubuntu /bionic-devel=840c50182f5ab1ba28c1d20cce4c207364852935 To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/policykit-1/+bug/1784964/+subscriptions -- Mailing list: https://launchpad.net/~touch-packages Post to : touch-packages@lists.launchpad.net Unsubscribe : https://launchpad.net/~touch-packages More help : https://help.launchpad.net/ListHelp
[Touch-packages] [Bug 1784964] Re: Regression due to CVE-2018-1116 (processes not inheriting user ID or groups )
I can't reproduce this myself but I am using the default shell (bash provided by dash) and gnome-terminal. My understanding of the change to policykit-1 https://git.launchpad.net/ubuntu/+source/policykit-1/commit/?h=applied/ubuntu /bionic-devel=840c50182f5ab1ba28c1d20cce4c207364852935 is that previously the UID was supplied by the caller and used without validation - instead now policykit tries to validate the supplied UID against the actual UID of the subject - however this could change over time and is racy - so there are a bunch of failure modes which this change to policykit introduces which would previously have worked. -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to policykit-1 in Ubuntu. https://bugs.launchpad.net/bugs/1784964 Title: Regression due to CVE-2018-1116 (processes not inheriting user ID or groups ) Status in policykit-1 package in Ubuntu: Confirmed Bug description: This report is tracking a possible regression caused by the recent CVE-2018-1116 patches to policykit-1. On 18.04, since package upgrades on July 23rd, and after the first reboot since then on Aug 1st, I hit an issue with the primary (sudo, adm, etc...) user getting Permission Denied trying to do: tail -f /var/log/syslog when that file is owned by syslog:adm and is g=r. I then found that "groups" reports only the $USER and not the entire list, but "groups $USER" reports all the groups correctly. The user shell is set to /usr/bin/tmux and /etc/tmux.conf has "set -g default-shell /bin/bash" After changing the user's shell back to /bin/bash and logging in on tty1 the list of groups shows correctly for the /bin/bash process running on tty1. I investigated and found that for the affected processes, such as the tmux process, /proc/$PID/loginuid = 4294967295 whereas the /bin/bash process on tty1 correctly reported 1000. The same with the respective gid_map and uid_map. 4294967295 == -1 == 0x The recent CVE patch to policykit has several functions where it does "uid = -1" which seems to tie in to my findings so far. I also noticed Ubuntu is still based on version 0.105 which was released in 2012 - upstream released 0.115 with the CVE patch. I suspect the backporting has missed something. The Ubuntu backport patch is: https://git.launchpad.net/ubuntu/+source/policykit-1/commit/?h=applied/ubuntu /bionic-devel=840c50182f5ab1ba28c1d20cce4c207364852935 To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/policykit-1/+bug/1784964/+subscriptions -- Mailing list: https://launchpad.net/~touch-packages Post to : touch-packages@lists.launchpad.net Unsubscribe : https://launchpad.net/~touch-packages More help : https://help.launchpad.net/ListHelp
[Touch-packages] [Bug 1784964] Re: Regression due to CVE-2018-1116 (processes not inheriting user ID or groups )
The quirk is more nuanced than I reported above. This reports groups correctly: 1. GUI login 2. Switch to TTY, login 3. "groups" 4. Switch to GUI 5. Launch Terminal 6. "groups" This only reports the username: 1. GUI Login 2. Launch Terminal 3. "groups" 4. Switch to TTY, login 5. "groups" Tests done with /usr/bin/tmux as the user's shell and tmux default-shell = /bin/bash which has been my standard configuration for several years now with no problems. -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to policykit-1 in Ubuntu. https://bugs.launchpad.net/bugs/1784964 Title: Regression due to CVE-2018-1116 (processes not inheriting user ID or groups ) Status in policykit-1 package in Ubuntu: Confirmed Bug description: This report is tracking a possible regression caused by the recent CVE-2018-1116 patches to policykit-1. On 18.04, since package upgrades on July 23rd, and after the first reboot since then on Aug 1st, I hit an issue with the primary (sudo, adm, etc...) user getting Permission Denied trying to do: tail -f /var/log/syslog when that file is owned by syslog:adm and is g=r. I then found that "groups" reports only the $USER and not the entire list, but "groups $USER" reports all the groups correctly. The user shell is set to /usr/bin/tmux and /etc/tmux.conf has "set -g default-shell /bin/bash" After changing the user's shell back to /bin/bash and logging in on tty1 the list of groups shows correctly for the /bin/bash process running on tty1. I investigated and found that for the affected processes, such as the tmux process, /proc/$PID/loginuid = 4294967295 whereas the /bin/bash process on tty1 correctly reported 1000. The same with the respective gid_map and uid_map. 4294967295 == -1 == 0x The recent CVE patch to policykit has several functions where it does "uid = -1" which seems to tie in to my findings so far. I also noticed Ubuntu is still based on version 0.105 which was released in 2012 - upstream released 0.115 with the CVE patch. I suspect the backporting has missed something. The Ubuntu backport patch is: https://git.launchpad.net/ubuntu/+source/policykit-1/commit/?h=applied/ubuntu /bionic-devel=840c50182f5ab1ba28c1d20cce4c207364852935 To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/policykit-1/+bug/1784964/+subscriptions -- Mailing list: https://launchpad.net/~touch-packages Post to : touch-packages@lists.launchpad.net Unsubscribe : https://launchpad.net/~touch-packages More help : https://help.launchpad.net/ListHelp
[Touch-packages] [Bug 1784964] Re: Regression due to CVE-2018-1116 (processes not inheriting user ID or groups )
I've discovered another quirk: If my first log-in after booting is at the TTY console (not GUI) the groups show up correctly there *and* in a terminal in the Xorg GUI session afterwards. But if I first log-in to the GUI then log-in to the TTY console both show only the user group. -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to policykit-1 in Ubuntu. https://bugs.launchpad.net/bugs/1784964 Title: Regression due to CVE-2018-1116 (processes not inheriting user ID or groups ) Status in policykit-1 package in Ubuntu: Confirmed Bug description: This report is tracking a possible regression caused by the recent CVE-2018-1116 patches to policykit-1. On 18.04, since package upgrades on July 23rd, and after the first reboot since then on Aug 1st, I hit an issue with the primary (sudo, adm, etc...) user getting Permission Denied trying to do: tail -f /var/log/syslog when that file is owned by syslog:adm and is g=r. I then found that "groups" reports only the $USER and not the entire list, but "groups $USER" reports all the groups correctly. The user shell is set to /usr/bin/tmux and /etc/tmux.conf has "set -g default-shell /bin/bash" After changing the user's shell back to /bin/bash and logging in on tty1 the list of groups shows correctly for the /bin/bash process running on tty1. I investigated and found that for the affected processes, such as the tmux process, /proc/$PID/loginuid = 4294967295 whereas the /bin/bash process on tty1 correctly reported 1000. The same with the respective gid_map and uid_map. 4294967295 == -1 == 0x The recent CVE patch to policykit has several functions where it does "uid = -1" which seems to tie in to my findings so far. I also noticed Ubuntu is still based on version 0.105 which was released in 2012 - upstream released 0.115 with the CVE patch. I suspect the backporting has missed something. The Ubuntu backport patch is: https://git.launchpad.net/ubuntu/+source/policykit-1/commit/?h=applied/ubuntu /bionic-devel=840c50182f5ab1ba28c1d20cce4c207364852935 To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/policykit-1/+bug/1784964/+subscriptions -- Mailing list: https://launchpad.net/~touch-packages Post to : touch-packages@lists.launchpad.net Unsubscribe : https://launchpad.net/~touch-packages More help : https://help.launchpad.net/ListHelp
[Touch-packages] [Bug 1784964] Re: Regression due to CVE-2018-1116 (processes not inheriting user ID or groups )
journalctl shows the problem with the auid and session values being 0x (-1) when calling a sudo command: Aug 02 01:18:20 hephaestion.lan.iam.tj audit[5094]: USER_AUTH pid=5094 uid=1000 auid=4294967295 ses=4294967295 msg='op=PAM:authentication acct="tj" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/1 res=success' and trying to tail syslog: tj ~ tail -f /var/log/syslog tail: cannot open '/var/log/syslog' for reading: Permission denied tail: no files remaining tj ~ ls -ld /var /var/log /var/log/syslog drwxr-xr-x 16 root root 4096 Apr 2 13:02 /var drwxrwxr-x 25 root syslog 4096 Aug 2 01:16 /var/log -rw-r- 1 syslog adm235432 Aug 2 01:31 /var/log/syslog tj ~ groups $USER tj : tj root adm disk lp dialout cdrom floppy sudo audio video plugdev users netdev lpadmin kvm libvirtd wireshark lxd libvirtd tj ~ groups tj -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to policykit-1 in Ubuntu. https://bugs.launchpad.net/bugs/1784964 Title: Regression due to CVE-2018-1116 (processes not inheriting user ID or groups ) Status in policykit-1 package in Ubuntu: Confirmed Bug description: This report is tracking a possible regression caused by the recent CVE-2018-1116 patches to policykit-1. On 18.04, since package upgrades on July 23rd, and after the first reboot since then on Aug 1st, I hit an issue with the primary (sudo, adm, etc...) user getting Permission Denied trying to do: tail -f /var/log/syslog when that file is owned by syslog:adm and is g=r. I then found that "groups" reports only the $USER and not the entire list, but "groups $USER" reports all the groups correctly. The user shell is set to /usr/bin/tmux and /etc/tmux.conf has "set -g default-shell /bin/bash" After changing the user's shell back to /bin/bash and logging in on tty1 the list of groups shows correctly for the /bin/bash process running on tty1. I investigated and found that for the affected processes, such as the tmux process, /proc/$PID/loginuid = 4294967295 whereas the /bin/bash process on tty1 correctly reported 1000. The same with the respective gid_map and uid_map. 4294967295 == -1 == 0x The recent CVE patch to policykit has several functions where it does "uid = -1" which seems to tie in to my findings so far. I also noticed Ubuntu is still based on version 0.105 which was released in 2012 - upstream released 0.115 with the CVE patch. I suspect the backporting has missed something. The Ubuntu backport patch is: https://git.launchpad.net/ubuntu/+source/policykit-1/commit/?h=applied/ubuntu /bionic-devel=840c50182f5ab1ba28c1d20cce4c207364852935 To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/policykit-1/+bug/1784964/+subscriptions -- Mailing list: https://launchpad.net/~touch-packages Post to : touch-packages@lists.launchpad.net Unsubscribe : https://launchpad.net/~touch-packages More help : https://help.launchpad.net/ListHelp
[Touch-packages] [Bug 1784964] Re: Regression due to CVE-2018-1116 (processes not inheriting user ID or groups )
Status changed to 'Confirmed' because the bug affects multiple users. ** Changed in: policykit-1 (Ubuntu) Status: New => Confirmed -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to policykit-1 in Ubuntu. https://bugs.launchpad.net/bugs/1784964 Title: Regression due to CVE-2018-1116 (processes not inheriting user ID or groups ) Status in policykit-1 package in Ubuntu: Confirmed Bug description: This report is tracking a possible regression caused by the recent CVE-2018-1116 patches to policykit-1. On 18.04, since package upgrades on July 23rd, and after the first reboot since then on Aug 1st, I hit an issue with the primary (sudo, adm, etc...) user getting Permission Denied trying to do: tail -f /var/log/syslog when that file is owned by syslog:adm and is g=r. I then found that "groups" reports only the $USER and not the entire list, but "groups $USER" reports all the groups correctly. The user shell is set to /usr/bin/tmux and /etc/tmux.conf has "set -g default-shell /bin/bash" After changing the user's shell back to /bin/bash and logging in on tty1 the list of groups shows correctly for the /bin/bash process running on tty1. I investigated and found that for the affected processes, such as the tmux process, /proc/$PID/loginuid = 4294967295 whereas the /bin/bash process on tty1 correctly reported 1000. The same with the respective gid_map and uid_map. 4294967295 == -1 == 0x The recent CVE patch to policykit has several functions where it does "uid = -1" which seems to tie in to my findings so far. I also noticed Ubuntu is still based on version 0.105 which was released in 2012 - upstream released 0.115 with the CVE patch. I suspect the backporting has missed something. The Ubuntu backport patch is: https://git.launchpad.net/ubuntu/+source/policykit-1/commit/?h=applied/ubuntu /bionic-devel=840c50182f5ab1ba28c1d20cce4c207364852935 To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/policykit-1/+bug/1784964/+subscriptions -- Mailing list: https://launchpad.net/~touch-packages Post to : touch-packages@lists.launchpad.net Unsubscribe : https://launchpad.net/~touch-packages More help : https://help.launchpad.net/ListHelp
[Touch-packages] [Bug 1784964] Re: Regression due to CVE-2018-1116 (processes not inheriting user ID or groups )
I observe what is likely the same problem on XUbuntu 16.04.5, running these commands in xfce4-terminal: user1@mysystem:~$ lsb_release -ds;cat /proc/version;echo $SHELL;groups;groups $(whoami) Ubuntu 16.04.5 LTS Linux version 4.15.0-29-generic (buildd@lcy01-amd64-024) (gcc version 5.4.0 20160609 (Ubuntu 5.4.0-6ubuntu1~16.04.10)) #31~16.04.1-Ubuntu SMP Wed Jul 18 08:54:04 UTC 2018 /bin/bash user1 user1 : user1 adm disk fax cdrom sudo dip plugdev users lxd lpadmin sambashare libvirtd vboxusers user1@mysystem:~$ ps f PID TTY STAT TIME COMMAND 3544 pts/2Ss 0:00 bash 3582 pts/2R+ 0:00 \_ ps f user1@mysystem:~$ cat /proc/3544/loginuid;echo 4294967295 Everything behaves correctly on tty1 or after sudo login + login as user1 on the terminal. -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to policykit-1 in Ubuntu. https://bugs.launchpad.net/bugs/1784964 Title: Regression due to CVE-2018-1116 (processes not inheriting user ID or groups ) Status in policykit-1 package in Ubuntu: Confirmed Bug description: This report is tracking a possible regression caused by the recent CVE-2018-1116 patches to policykit-1. On 18.04, since package upgrades on July 23rd, and after the first reboot since then on Aug 1st, I hit an issue with the primary (sudo, adm, etc...) user getting Permission Denied trying to do: tail -f /var/log/syslog when that file is owned by syslog:adm and is g=r. I then found that "groups" reports only the $USER and not the entire list, but "groups $USER" reports all the groups correctly. The user shell is set to /usr/bin/tmux and /etc/tmux.conf has "set -g default-shell /bin/bash" After changing the user's shell back to /bin/bash and logging in on tty1 the list of groups shows correctly for the /bin/bash process running on tty1. I investigated and found that for the affected processes, such as the tmux process, /proc/$PID/loginuid = 4294967295 whereas the /bin/bash process on tty1 correctly reported 1000. The same with the respective gid_map and uid_map. 4294967295 == -1 == 0x The recent CVE patch to policykit has several functions where it does "uid = -1" which seems to tie in to my findings so far. I also noticed Ubuntu is still based on version 0.105 which was released in 2012 - upstream released 0.115 with the CVE patch. I suspect the backporting has missed something. The Ubuntu backport patch is: https://git.launchpad.net/ubuntu/+source/policykit-1/commit/?h=applied/ubuntu /bionic-devel=840c50182f5ab1ba28c1d20cce4c207364852935 To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/policykit-1/+bug/1784964/+subscriptions -- Mailing list: https://launchpad.net/~touch-packages Post to : touch-packages@lists.launchpad.net Unsubscribe : https://launchpad.net/~touch-packages More help : https://help.launchpad.net/ListHelp
[Touch-packages] [Bug 1784964] Re: Regression due to CVE-2018-1116 (processes not inheriting user ID or groups )
** Description changed: This report is tracking a possible regression caused by the recent CVE-2018-1116 patches to policykit-1. On 18.04, since package upgrades on July 23rd, and after the first reboot since then on Aug 1st, I hit an issue with the primary (sudo, adm, etc...) user getting Permission Denied trying to do: tail -f /var/log/syslog when that file is owned by syslog:adm and is g=r. I then found that "groups" reports only the $USER and not the entire list, but "groups $USER" reports all the groups correctly. The user shell is set to /usr/bin/tmux and /etc/tmux.conf has "set -g default-shell /bin/bash" After changing the user's shell back to /bin/bash and logging in on tty1 the list of groups shows correctly for the /bin/bash process running on tty1. I investigated and found that for the affected processes, such as the tmux process, /proc/$PID/loginuid = 4294967295 whereas the /bin/bash process on tty1 correctly reported 1000. The same with the respective gid_map and uid_map. 4294967295 == -1 == 0x The recent CVE patch to policykit has several functions where it does "uid = -1" which seems to tie in to my findings so far. + + I also noticed Ubuntu is still based on version 0.105 which was released + in 2012 - upstream released 0.115 with the CVE patch. + + I suspect the backporting has missed something. + + The Ubuntu backport patch is: + + https://git.launchpad.net/ubuntu/+source/policykit-1/commit/?h=applied/ubuntu + /bionic-devel=840c50182f5ab1ba28c1d20cce4c207364852935 -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to policykit-1 in Ubuntu. https://bugs.launchpad.net/bugs/1784964 Title: Regression due to CVE-2018-1116 (processes not inheriting user ID or groups ) Status in policykit-1 package in Ubuntu: Confirmed Bug description: This report is tracking a possible regression caused by the recent CVE-2018-1116 patches to policykit-1. On 18.04, since package upgrades on July 23rd, and after the first reboot since then on Aug 1st, I hit an issue with the primary (sudo, adm, etc...) user getting Permission Denied trying to do: tail -f /var/log/syslog when that file is owned by syslog:adm and is g=r. I then found that "groups" reports only the $USER and not the entire list, but "groups $USER" reports all the groups correctly. The user shell is set to /usr/bin/tmux and /etc/tmux.conf has "set -g default-shell /bin/bash" After changing the user's shell back to /bin/bash and logging in on tty1 the list of groups shows correctly for the /bin/bash process running on tty1. I investigated and found that for the affected processes, such as the tmux process, /proc/$PID/loginuid = 4294967295 whereas the /bin/bash process on tty1 correctly reported 1000. The same with the respective gid_map and uid_map. 4294967295 == -1 == 0x The recent CVE patch to policykit has several functions where it does "uid = -1" which seems to tie in to my findings so far. I also noticed Ubuntu is still based on version 0.105 which was released in 2012 - upstream released 0.115 with the CVE patch. I suspect the backporting has missed something. The Ubuntu backport patch is: https://git.launchpad.net/ubuntu/+source/policykit-1/commit/?h=applied/ubuntu /bionic-devel=840c50182f5ab1ba28c1d20cce4c207364852935 To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/policykit-1/+bug/1784964/+subscriptions -- Mailing list: https://launchpad.net/~touch-packages Post to : touch-packages@lists.launchpad.net Unsubscribe : https://launchpad.net/~touch-packages More help : https://help.launchpad.net/ListHelp
