[ruby-dev:26237] Re: FileUtils.rm_rf security problem

青木です。

  In mail "[ruby-dev:26234] Re: FileUtils.rm_rf security problem"
  Tanaka Akira <[e-mail]> wrote:

>   def remove_entry_secure(path, force = false)
>     fu_try_unlink path and return   # Remove non-directory files.
>     if fu_have_symlink?
>       File.lchown Process.euid, nil, path
>     else
>       File.chown Process.euid, nil, path
>     end
> 
> unlink した後、lchown する前に sudo とかへの hard link にすりかえられ
> るとまずいんじゃないでしょうか。

lchown が suid ビットをクリアすることを仮定しています。

  /tmp % ls -ld sudo
  ---s--x--x    1 aamine   users       80608 May 26 18:08 sudo
  /tmp % sudo ruby -e 'File.lchown 0,nil,"sudo"'
  /tmp % ll sudo
  ---x--x--x    1 root     users       80608 May 26 18:08 sudo

が、いま調べてみるとあまりポータブルでないことがわかったので、
「そういうプラットフォームでは root で消すの禁止」ということにします。

  #
  # This method removes a file system entry +path+.  +path+ shall be a 
  # regular file, a directory, or something.  If +path+ is a directory, 
  # remove it recursively.  This method is required to avoid TOCTTOU 
  # (time-of-check-to-time-of-use) local security vulnerability of #rm_r.
  # #rm_r causes security hole when and only when:
  #
  #   * Parent directory is world writable (including /tmp).
  #   * Removing directory tree includes world writable directory.
  # 
  # To avoid this security hole, this method applies special preprocess.
  * If +path+ is a directory, this method chown(2) and chmod(2) all
  # removing directories.  This requires the current process is the
  # owner of the removing whole directory tree.
  # 
  # When parent directory is /tmp (permission 1777), UNIX super user
  # (root) can remove directory tree safely only on systems which 
  # lchown(2) clears S_ISUID (set-user-id) bit, such as Linux.
  # Many systems do NOT clear S_ISUID bit, this method is insecure for 
  # cleaning /tmp.  Note that, if parent directory is not world writable, 
  # this method is secure for also super user.
  #
  # WARNING: You must ensure that *ALL* parent directories are not
  # world writable.  Otherwise this method does not work.
  # Only exception is /tmp, permission 1777.
  # 
  # WARNING: Only the owner of the removing directory tree, or
  # super user (root) should invoke this method.  Otherwise this
  # method does not work.
  # 
  # WARNING: This method does not work if system have symbolic link
  # but do not have lchown(2).  This method raises NotImplementedError
  # on such system. 
  # 
  # WARNING: Currently, this method does NOT work Win32 systems.
  # 
  # For details of this security vulnerability, see Perl's case:
  # 
  #   http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0448
  #   http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0452
  #   
  # For fileutils.rb, this vulnerability is reported in [ruby-dev:26100].
  # 
  def remove_entry_secure(path, force = false)

ちなみに Solaris とか AIX だと root の場合はディレクトリが空で
なくても unlink で消せるみたいなので、lchown まで到達しなそうです。
これはこれでまずいので修正します。


> あと、(私も最近失敗したんでなんですが) EISDIR は Linux 固有です。

こっちも修正しました。

--
青木峰郎