<br><tt><font size=2>Toni Asensi Esteve <asmond@orange.es> wrote
on 28/07/2010 08:53:12:<br>
<br>
> > Of course the real issue is *NIX's rudimentary authorization
levels, root <br>
> > or not root. <br>
</font></tt>
<br><tt><font size=2>Yup, I agree with myself.</font></tt>
<br>
<br><tt><font size=2>After 19 years of Linux we are still trying to let
users mount their own share</font></tt>
<br><tt><font size=2>in thier own home drives without letting them compromise
the system,</font></tt>
<br><tt><font size=2>even though terminal servers and virtualized desktops
are the way ahead.</font></tt>
<br>
<br>
<br><tt><font size=2>> <br>
> > sudo still runs the broken mount.cifs as root<br>
</font></tt>
<br><tt><font size=2>Yup. Arguing ??</font></tt>
<br>
<br><tt><font size=2>> <br>
> For the sake of clarity, I just wanted to comment that "sudo"
runs <br>
> commands as <br>
> your user, not as root. With sudo your user gets more privileges temporaly,
<br>
> and in every "log" file, "ps" command, etc. it's
your user which <br>
> appears there <br>
> doing this action, not a non-concrete "root".<br>
</font></tt>
<br><tt><font size=2>Right, in the logs, but the job runs as if root was
running it.</font></tt>
<br>
<br><tt><font size=2>You can check for real-uid and effective-euid, but
you have to do that</font></tt>
<br><tt><font size=2>yourself in your program code.</font></tt>
<br>
<br><tt><font size=2>[SNIP]</font></tt>
<br><tt><font size=2><br>
> <br>
> P.S. If it may be useful for anyone: in my /etc/sudoers, I have this
line:<br>
> MY_PARTICULAR_USER ALL=(root) NOPASSWD : /bin/mount,
/bin/umount, <br>
> /sbin/mount.cifs, /sbin/umount.cifs<br>
> and so for exemple I execute<br>
> sudo mount [...]<br>
> to mount something, I don't mind if it's samba or not. There's an
example <br>
> searching " /sbin/mount.cifs" in <br>
> </font></tt><a href=https://help.ubuntu.com/community/SettingUpSamba><tt><font size=2>https://help.ubuntu.com/community/SettingUpSamba</font></tt></a><tt><font size=2><br>
</font></tt>
<br><tt><font size=2>mount.cifs checks euid to see if euid has write access
to the mount point.</font></tt>
<br>
<br><tt><font size=2>If it does, then it asks for the password, helpfully
(to crooks) waiting</font></tt>
<br><tt><font size=2>whilst you replace the mount point with a link to
wherever you want. </font></tt>
<br>
<br><tt><font size=2>It then doesn't check again, but mounts your share
over wherever the</font></tt>
<br><tt><font size=2>target is now, as root.</font></tt>
<br>
<br>
<br><tt><font size=2>You have it in your sudoers, so your particular user,
or if its the NX user's</font></tt>
<br><tt><font size=2>group all of them can mount whatever thay want more
or less wherever</font></tt>
<br><tt><font size=2>they want without an ruid being looked at.</font></tt>
<br>
<br><tt><font size=2>Even if you put forced parameters in sudoers, ordinary
users can get</font></tt>
<br><tt><font size=2>round a fixed mount point.</font></tt>
<br>
<br><tt><font size=2>Try it. I just posted an example.</font></tt>
<br>
<br><tt><font size=2>The sudo bodge for the broken mount.cifs is not much
better than suid,</font></tt>
<br><tt><font size=2>unless you have a smaller subset of users needing
to mount their shares.</font></tt>
<br>
<br><tt><font size=2>Even then it makes it easier to make a typo mistake
with the mount point</font></tt>
<br><tt><font size=2>and mount over something unfortunate.</font></tt>
<br>
<br><tt><font size=2>A better bodge would be a version of mount.cifs just
for NX which</font></tt>
<br><tt><font size=2>doesn't prompt for password and so is safer for suid.</font></tt>
<br>
<br><tt><font size=2>This would reduce the time window for interupting
it to milliseconds.</font></tt>
<br>
<br><tt><font size=2>Still not good, but it would defeat the script kiddies.</font></tt>
<br>
<br><tt><font size=2>> <br>
> Greetings:<br>
> Toni <br>
> ________________________________________________________________<br>
> Were you helped on this list with your FreeNX
problem?<br>
> Then please write up the solution in the FreeNX Wiki/FAQ:<br>
> <br>
> </font></tt><a href="http://openfacts2.berlios.de/wikien/index.php/BerliosProject:FreeNX_-_FAQ"><tt><font size=2>http://openfacts2.berlios.de/wikien/index.php/BerliosProject:FreeNX_-_FAQ</font></tt></a><tt><font size=2><br>
> <br>
> Don't forget to check the NX Knowledge
Base:<br>
> </font></tt><a href=http://www.nomachine.com/kb/><tt><font size=2>http://www.nomachine.com/kb/</font></tt></a><tt><font size=2>
<br>
> <br>
> ________________________________________________________________<br>
> FreeNX-kNX mailing list --- FreeNX-kNX@kde.org<br>
> </font></tt><a href="https://mail.kde.org/mailman/listinfo/freenx-knx"><tt><font size=2>https://mail.kde.org/mailman/listinfo/freenx-knx</font></tt></a><tt><font size=2><br>
> ________________________________________________________________</font></tt>