D23692: kdesu: set kernel flags to prevent ptrace instead of relying on setgid

[Adriaan de Groot]

adridg closed this revision.
adridg added a comment.


  Migrated to invent, https://invent.kde.org/frameworks/kdesu/-/merge_requests/1

REPOSITORY
  R299 KDESu

REVISION DETAIL
  https://phabricator.kde.org/D23692

To: maltek, adridg, #frameworks
Cc: kde-frameworks-devel, LeGast00n, cblack, michaelh, ngraham, bruns

D23692: kdesu: set kernel flags to prevent ptrace instead of relying on setgid

[Adriaan de Groot]

adridg accepted this revision.
adridg added a comment.
This revision is now accepted and ready to land.


  LGTM on the FreeBSD side (I've checked, the procctl() code does block 
debugger access which is all we're asking to do).

REPOSITORY
  R299 KDESu

REVISION DETAIL
  https://phabricator.kde.org/D23692

To: maltek, adridg, #frameworks
Cc: kde-frameworks-devel, LeGast00n, GB_2, michaelh, ngraham, bruns

D23692: kdesu: set kernel flags to prevent ptrace instead of relying on setgid

[Fabian Vogt]

fvogt added a reviewer: Frameworks.

REPOSITORY
  R299 KDESu

REVISION DETAIL
  https://phabricator.kde.org/D23692

To: maltek, adridg, #frameworks
Cc: kde-frameworks-devel, LeGast00n, GB_2, michaelh, ngraham, bruns

D23692: kdesu: set kernel flags to prevent ptrace instead of relying on setgid

[Malte Kraus]

maltek added a reviewer: adridg.
maltek added a comment.


  I have no idea who to specify as reviewer, so I'm picking the maintainer from 
`src/README`, Adriaan de Groot.

REPOSITORY
  R299 KDESu

REVISION DETAIL
  https://phabricator.kde.org/D23692

To: maltek, adridg
Cc: kde-frameworks-devel, LeGast00n, GB_2, michaelh, ngraham, bruns

D23692: kdesu: set kernel flags to prevent ptrace instead of relying on setgid

[Malte Kraus]

maltek created this revision.
Herald added a project: Frameworks.
Herald added a subscriber: kde-frameworks-devel.
maltek requested review of this revision.

REVISION SUMMARY
  So I noticed that kdesu is setgid 'nogroup'. That group is the fallback for 
groups from a remote NFS share that do not exist on the local machine. Since 
kdesu does not deal with NFS, I wanted to get rid of this (ab)use of 'nogroup'.
  
  From all that I could gather (inline comments and a discussion on the KDE su 
handbook ), the 
goal of the setgid bit on the binary is not to access any file as 'nogroup', 
but to prevent other processes of the calling user from accessing cached 
passwords, e.g. through ptrace(), core dumps or /proc//memory. While 
setgid is one way to achieve that, both Linux and FreeBSD allow setting a 
kernel flag to directly to disable such access. So I went for that.

REPOSITORY
  R299 KDESu

REVISION DETAIL
  https://phabricator.kde.org/D23692

AFFECTED FILES
  src/client.cpp
  src/client.h
  src/kdesud/CMakeLists.txt
  src/kdesud/kdesud.cpp

To: maltek
Cc: kde-frameworks-devel, LeGast00n, GB_2, michaelh, ngraham, bruns