z5t1 (???) wrote:
> Hi, I'd like to add my two cents to this.
>
> I have reproduced this on Centos 6 and Cucumber Linux 1.0. We have
> established that the umask plays no role in the permissions on swap files;
> Vim creates its swap files with the same permissions as the file being edited.
>
> However, there is another problem with the swap file permissions that has not
> yet been discussed: when Vim creates swap files, the .swp file is created
> with the owner and group set to the user who is editing the file (hereafter
> referred to as the "editor") and the editor's primary group respectively. The
> permission bits on the swap file are the same as the original file.
>
> This is a problem, as the editor's primary group may be different from the
> group of the file being edited. Take /etc/shadow for example. That file is
> supposed to have the permissions 640 with owner: root, group: shadow as a
> quick `ls -l` shows:
>
> -rw-r----- 1 root shadow 1195 Sep 16 20:09 /etc/shadow
>
> However, shadow is not the root user's primary group; on this system it
> happens to be 'users', which every other user on the system is also a member
> of. Now if root goes to edit the file, a swap file is created in
> /etc/.shadow.swp with the following permissions:
>
> -rw-r----- 1 root users 4096 Nov 2 13:52 /etc/.shadow.swp
>
> This swap file is now readable by every user on the system. Keep in mind the
> /etc/shadow file contains hashes of every user's password, so now the
> password for every single user on the system may have been compromised.
Eh, why is root's primary group one that all users on the system are a
member of? That is asking for trouble. Every file that root creates
will be readable by everybody by default.
> --- Solution ---
>
> I have found this problem can be mitigated by changing the swap directory
> with the 'set directory' directive as Hanno originally suggested. I have
> added the following lines to my '/etc/vimrc':
>
> " Move the swap file location to protect against CVE-2017-1000382
> silent !install -d -m 700 ~/.vim/swap/ 2>&1 > /dev/null
> set directory=~/.vim/swap/
>
> This safely sets the swap file directory to a directory that should not cause
> any security problems. For added security, the directory is created so that
> only the owner has access to it, regardless of how the system's umask or .swp
> file permissions are set.
>
> Additionally, the swap file collision (if you edit both ~/foo/file and
> ~/bar/file at the same time) is not a major issue; Vim detects this and gives
> the second swap file a different file extension. When you go to restore from
> the swap file, you get a prompt asking which swap file you want to use (if
> there are two swap files with the same basename), which doesn't strike me as
> being terribly problematic. While this approach may have some minor
> issues/quirks, for me it seems far preferable to being vulnerable to this
> vulnerability.
>
> I have already applied this fix on Cucumber Linux and thought you may want to
> consider applying a similar fix upstream.
--
Kisses may last for as much as, but no more than, five minutes.
[real standing law in Iowa, United States of America]
/// Bram Moolenaar -- [email protected] -- http://www.Moolenaar.net \\\
/// sponsor Vim, vote for features -- http://www.Vim.org/sponsor/ \\\
\\\ an exciting new programming language -- http://www.Zimbu.org ///
\\\ help me help AIDS victims -- http://ICCF-Holland.org ///
--
--
You received this message from the "vim_dev" maillist.
Do not top-post! Type your reply below the text you are replying to.
For more information, visit http://www.vim.org/maillist.php
---
You received this message because you are subscribed to the Google Groups
"vim_dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
