Debian Bug report logs - #317329
initscripts: should /dev/shm have restricted permissions?

version graph

Package: initscripts; Maintainer for initscripts is Debian sysvinit maintainers <pkg-sysvinit-devel@lists.alioth.debian.org>; Source for initscripts is src:sysvinit.

Reported by: Vagrant Cascadian <vagrant+bugs@freegeek.org>

Date: Thu, 7 Jul 2005 17:48:05 UTC

Severity: normal

Tags: wontfix

Found in version 2.86.ds1-1

Fixed in version 2.88dsf-13.3

Done: Roger Leigh <rleigh@codelibre.net>

Bug is archived. No further changes may be made.

Toggle useless messages

View this report as an mbox folder, status mbox, maintainer mbox


Report forwarded to debian-bugs-dist@lists.debian.org, Miquel van Smoorenburg <miquels@cistron.nl>:
Bug#317329; Package initscripts. Full text and rfc822 format available.

Acknowledgement sent to Vagrant Cascadian <vagrant+bugs@freegeek.org>:
New Bug report received and forwarded. Copy sent to Miquel van Smoorenburg <miquels@cistron.nl>. Full text and rfc822 format available.

Message #5 received at submit@bugs.debian.org (full text, mbox):

From: Vagrant Cascadian <vagrant+bugs@freegeek.org>
To: Debian Bug Tracking System <submit@bugs.debian.org>
Subject: initscripts: should /dev/shm have restricted permissions?
Date: Thu, 7 Jul 2005 11:34:41 -0600
[Message part 1 (text/plain, inline)]
Package: initscripts
Version: 2.86.ds1-1
Severity: normal
Tags: patch

on my system, /dev/shm is mounted with the same defaults as /tmp:

ls -ld /tmp/ /dev/shm/
drwxrwxrwt  3 root root  60 2005-07-07 11:11 /dev/shm/
drwxrwxrwt  7 root root 384 2005-07-07 11:25 /tmp/

is it a security risk to allow any and all users permission to write to
/dev/shm?

a patch is attached to restrict the permissions in
/etc/init.d/mountvirtfs, if it is deemed necessary.

live well,
  vagrant

-- System Information:
Debian Release: 3.1
Architecture: i386 (i586)
Kernel: Linux 2.6.8-2-386
Locale: LANG=en_US, LC_CTYPE=en_US (charmap=ISO-8859-1)

Versions of packages initscripts depends on:
ii  coreutils                   5.2.1-2      The GNU core utilities
ii  dpkg                        1.10.28      Package maintenance system for Deb
ii  e2fsprogs                   1.37-2sarge1 ext2 file system utilities and lib
ii  libc6                       2.3.2.ds1-22 GNU C Library: Shared libraries an
ii  mount                       2.12p-4      Tools for mounting and manipulatin
ii  util-linux                  2.12p-4      Miscellaneous system utilities

-- no debconf information
[mountvirtfs.tmpfs_permissions.diff (text/plain, attachment)]
[signature.asc (application/pgp-signature, inline)]

Message sent on to Vagrant Cascadian <vagrant+bugs@freegeek.org>:
Bug#317329. Full text and rfc822 format available.

Message #8 received at 317329-submitter@bugs.debian.org (full text, mbox):

From: Petter Reinholdtsen <pere@hungry.com>
To: 317329-submitter@bugs.debian.org
Subject: Re: initscripts: should /dev/shm have restricted permissions?
Date: Sat, 03 Sep 2005 18:17:50 +0200
[Vagrant Cascadian]
> is it a security risk to allow any and all users permission to write
> to /dev/shm?

Perhaps, but I believe it is required for shm_open() to work for
non-privileged users.  And POSIX shared memory operations should work
for all users, not only for root.



Tags added: wontfix Request was from Thomas Hood <jdthood@yahoo.co.uk> to control@bugs.debian.org. Full text and rfc822 format available.

Tags removed: patch Request was from Thomas Hood <jdthood@yahoo.co.uk> to control@bugs.debian.org. Full text and rfc822 format available.

Reply sent to Javier Fernandez-Sanguino Pen~a <jfs@debian.org>:
You have taken responsibility. (Sat, 26 Feb 2011 01:15:18 GMT) Full text and rfc822 format available.

Notification sent to Vagrant Cascadian <vagrant+bugs@freegeek.org>:
Bug acknowledged by developer. (Sat, 26 Feb 2011 01:15:18 GMT) Full text and rfc822 format available.

Message #17 received at 317329-close@bugs.debian.org (full text, mbox):

From: Javier Fernandez-Sanguino Pen~a <jfs@debian.org>
To: 317329-close@bugs.debian.org
Subject: Bug#317329: fixed in tiger 1:3.2.3-7
Date: Sat, 26 Feb 2011 01:02:11 +0000
Source: tiger
Source-Version: 1:3.2.3-7

We believe that the bug you reported is fixed in the latest version of
tiger, which is due to be installed in the Debian FTP archive:

tiger-otheros_3.2.3-7_i386.deb
  to main/t/tiger/tiger-otheros_3.2.3-7_i386.deb
tiger_3.2.3-7.diff.gz
  to main/t/tiger/tiger_3.2.3-7.diff.gz
tiger_3.2.3-7.dsc
  to main/t/tiger/tiger_3.2.3-7.dsc
tiger_3.2.3-7_i386.deb
  to main/t/tiger/tiger_3.2.3-7_i386.deb



A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 317329@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Javier Fernandez-Sanguino Pen~a <jfs@debian.org> (supplier of updated tiger package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.8
Date: Sat, 26 Feb 2011 01:45:50 +0100
Source: tiger
Binary: tiger tiger-otheros
Architecture: source i386
Version: 1:3.2.3-7
Distribution: unstable
Urgency: low
Maintainer: Javier Fernandez-Sanguino Pen~a <jfs@debian.org>
Changed-By: Javier Fernandez-Sanguino Pen~a <jfs@debian.org>
Description: 
 tiger      - Report system security vulnerabilities
 tiger-otheros - Scripts to run Tiger in other operating systems
Closes: 317329 581266 603338 609203 615052
Changes: 
 tiger (1:3.2.3-7) unstable; urgency=low
 .
   * debian/control:
       - Add Recommends to tripwire | aide
       - Review package description
   * Update to latest CVS:
     - [multiple files] Fix spelling (Closes: #609203)
     - systems/Linux/2/config: Add /dev/shm and /lib/init/rw to the writable
     filesystems (common tmpfs) (Closes: #317329, #603338)
     - systems/Linux/2/gen_mounts: Added xenfs as a valid filesystem
       (Closes: #615052)
     - Apply patch by Timo Lindfors to add support for SHA-512 passwords
      (This is the default used in Debian GNU/Linux squeeze and later releases)
      (Closes: #581266)
Checksums-Sha1: 
 76a7547dbec8222679857e37cf0fa55c2a20266b 1111 tiger_3.2.3-7.dsc
 40e48e2880ea11592cf66d5a57fec124c9d40101 65332 tiger_3.2.3-7.diff.gz
 8918e9d65ff3054681b4d5d130ef473466b33af2 657960 tiger_3.2.3-7_i386.deb
 c2aa7c4ddb9e80762af387a53b2c418ad31201da 484506 tiger-otheros_3.2.3-7_i386.deb
Checksums-Sha256: 
 4e645a8c1124f532cbd71c1008cfea2826d9c0eb2d74c1a2f8c466ab8473c44b 1111 tiger_3.2.3-7.dsc
 b2baa78bb1d79353cf720305e8a30b0ac39556be5a43340677c8f2be3338a77d 65332 tiger_3.2.3-7.diff.gz
 526ede3b62cc785704a2ed514da39598157757cc5bf8416460c0f698a20c5895 657960 tiger_3.2.3-7_i386.deb
 ff63dba2312da1b91056b7ad3a929bf10aa20004db6d9c3c7bd23764c0d6b0e0 484506 tiger-otheros_3.2.3-7_i386.deb
Files: 
 3e8bd2571852942a4960be8d3d6db7d6 1111 admin optional tiger_3.2.3-7.dsc
 38e6a6951a4b7858e7850784971e3c7e 65332 admin optional tiger_3.2.3-7.diff.gz
 369d1d0d78594b5b620d27eed792c0ce 657960 admin optional tiger_3.2.3-7_i386.deb
 a775da7c184aedb513c267474d7ff719 484506 admin optional tiger-otheros_3.2.3-7_i386.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)

iD8DBQFNaFAZsandgtyBSwkRAs7IAJ95r0LSyWgvXvW4YXQJUKYqIAMjtgCeJv6D
z3rO478T3dTLMykt9mdMXJY=
=fWpU
-----END PGP SIGNATURE-----





Information forwarded to debian-bugs-dist@lists.debian.org, Debian sysvinit maintainers <pkg-sysvinit-devel@lists.alioth.debian.org>:
Bug#317329; Package initscripts. (Sun, 27 Feb 2011 10:21:02 GMT) Full text and rfc822 format available.

Acknowledgement sent to Javier Fernández-Sanguino Peña <jfs@computer.org>:
Extra info received and forwarded to list. Copy sent to Debian sysvinit maintainers <pkg-sysvinit-devel@lists.alioth.debian.org>. (Sun, 27 Feb 2011 10:21:02 GMT) Full text and rfc822 format available.

Message #22 received at 317329@bugs.debian.org (full text, mbox):

From: Javier Fernández-Sanguino Peña <jfs@computer.org>
To: control@bugs.debian.org, 317329@bugs.debian.org
Subject: Reopen wrong bug
Date: Sun, 27 Feb 2011 11:18:15 +0100
[Message part 1 (text/plain, inline)]
reopen 317329
thanks

Sorry, I closed the wrong bug with my upload of the Tiger package.

Regards

Javier
[signature.asc (application/pgp-signature, inline)]

Bug No longer marked as fixed in versions tiger/1:3.2.3-7 and reopened. Request was from Debbugs Internal Request <owner@bugs.debian.org> to internal_control@bugs.debian.org. (Sun, 27 Feb 2011 10:21:04 GMT) Full text and rfc822 format available.

Reply sent to Roger Leigh <rleigh@codelibre.net>:
You have taken responsibility. (Wed, 11 Jan 2012 11:36:15 GMT) Full text and rfc822 format available.

Notification sent to Vagrant Cascadian <vagrant+bugs@freegeek.org>:
Bug acknowledged by developer. (Wed, 11 Jan 2012 11:36:32 GMT) Full text and rfc822 format available.

Message #29 received at 317329-done@bugs.debian.org (full text, mbox):

From: Roger Leigh <rleigh@codelibre.net>
To: Petter Reinholdtsen <pere@hungry.com>, 317329-done@bugs.debian.org
Cc: Vagrant Cascadian <vagrant+bugs@freegeek.org>
Subject: Re: Bug#317329: initscripts: should /dev/shm have restricted permissions?
Date: Wed, 11 Jan 2012 11:34:50 +0000
Version: 2.88dsf-13.3

On Sat, Sep 03, 2005 at 06:17:50PM +0200, Petter Reinholdtsen wrote:
> 
> [Vagrant Cascadian]
> > is it a security risk to allow any and all users permission to write
> > to /dev/shm?
> 
> Perhaps, but I believe it is required for shm_open() to work for
> non-privileged users.  And POSIX shared memory operations should work
> for all users, not only for root.

Yes.  WRT to the original concerns, initscripts now permits
configuration of the size limits for all the tmpfs mounts, including
/dev/shm (/run/shm), and the defaults are tighter than the tmpfs
kernel defaults, though /run/shm does default to 50%.  And hopefully
in the next few months these will be exposed directly as fstab
entries rather than in /etc/default/tmpfs.


Regards,
Roger

-- 
  .''`.  Roger Leigh
 : :' :  Debian GNU/Linux             http://people.debian.org/~rleigh/
 `. `'   Printing on GNU/Linux?       http://gutenprint.sourceforge.net/
   `-    GPG Public Key: 0x25BFB848   Please GPG sign your mail.




Bug archived. Request was from Debbugs Internal Request <owner@bugs.debian.org> to internal_control@bugs.debian.org. (Thu, 09 Feb 2012 07:36:13 GMT) Full text and rfc822 format available.

Send a report that this bug log contains spam.


Debian bug tracking system administrator <owner@bugs.debian.org>. Last modified: Sat Apr 19 23:46:03 2014; Machine Name: beach.debian.org

Debian Bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.