|
Bugzilla – Full Text Bug Listing |
| Summary: | AUDIT-0: wireshark - setuid installation | ||
|---|---|---|---|
| Product: | [openSUSE] openSUSE 11.2 | Reporter: | Pavol Rusnak <prusnak> |
| Component: | Security | Assignee: | Security Team bot <security-team> |
| Status: | RESOLVED FIXED | QA Contact: | E-mail List <qa-bugs> |
| Severity: | Normal | ||
| Priority: | P4 - Low | CC: | ace6zip, casualprogrammer, forgotten_yF3D3fVkQI, jc, krahmer |
| Version: | Final | ||
| Target Milestone: | --- | ||
| Hardware: | Other | ||
| OS: | Other | ||
| Whiteboard: | |||
| Found By: | Development | Services Priority: | |
| Business Priority: | Blocker: | --- | |
| Marketing QA Status: | --- | IT Deployment: | --- |
|
Description
Pavol Rusnak
2007-12-19 13:56:27 UTC
I dont think we want to have wireshark or its helper binaries setuid. They link to a lot of libraries; users shouldnt be able to sniff traffic anyways. Wireshark is probably a good candidate for something like a chroot. -> no setuid for wireshark due to bad record. just use wireshark as root Gentoo has following flags for wireshark binaries: -r-sr-s--- 1 root wireshark 46848 2008-03-16 19:21 /usr/bin/dumpcap -rwxr-xr-x 1 root root 67552 2008-03-16 19:21 /usr/bin/rawshark -r-sr-s--- 1 root wireshark 162200 2008-03-16 19:21 /usr/bin/tshark -rwxr-xr-x 1 root root 1318388 2008-03-16 19:21 /usr/bin/wireshark So user has to be in group wireshark in order to sniff traffic. What about this solution? PS: Wireshark now prints message box "Running as user 'root' and group 'root. This could be dangerous' when running as root. Fortunately this dialog also contains checkbox "Don't show this message again." :)) it sounds plain stupid to me making network sniffers setuid root. Theres a reason to drop privileges to nobody after opening packet socket etc, but only root should invoke such tools, e.g. theres no need for a s bit. Well, it does make sense to run the gui (which does the error prone packet disassembly) as non-root. That goal is reached by the s-bit. With that bit however there is no authentication of the privileged operation anymore. I am not convinced by the group approach either. Although we have a similar case already, mtr. It's setuid root for group dialout. What about patching the gui to run xdg-su -c '/usr/bin/rawshark ...'? Does that work? Does wireshark communicate via stdin/stdout with the helper or does it use some external file/socket? I don't know (yes, the fact that xdg-su discards stdout/stderr could be an obstacle). OK, it's not rawshark but dumpcap and it uses (also) stdout. And it's run several times (to get the list of interfaces, to show the traffic on each interface and finally to capture), so xdg-su won't work here :-( *** Bug 387706 has been marked as a duplicate of this bug. *** As I pointed out in Bug 387706 Comment #2 there has to be a reason why wireshark ( as well as other applications ) think its inappropriate to run them as root. So forcing them to run as root is probably causing more issues than it avoids. If creating a new group for them is not wanted ( for whatever reason ) any of the existing privileged groups could be used to that end. *** Bug 391805 has been marked as a duplicate of this bug. *** Are we collecting duplicates here, or is this going to be fixed eventually ? I just tried this nice tutorial to get Wireshark to work without root: http://packetlife.net/blog/2010/mar/19/sniffing-wireshark-non-root-user/#c2439 Unfortunately, as I say within the comments, it seems not to be working for openSUSE (the tuto is based on Ubuntu). % sudo zypper install libcap-progs % sudo groupadd wireshark % sudo usermod -G wireshark jc % sudo chgrp wireshark /usr/bin/dumpcap % sudo chmod 750 /usr/bin/dumpcap % sudo setcap cap_net_raw,cap_net_admin=eip /usr/bin/dumpcap % getcap /usr/bin/dumpcap /usr/bin/dumpcap = cap_net_admin,cap_net_raw+eip % groups users wireshark %wireshark [...] dumpcap: There are no interfaces on which a capture can be done Why not ? And why isn't Wireshark packaged this way ? Updated the info : openSUSE 11.2 and I don't think such an issue should be qualified of "minor". I'm not sure fscaps are enabled by default. Try setting mode 4750 on dumpcap. It is enabled in the kernel : % uname -r 2.6.31.12-0.1-desktop % grep CONFIG_SECURITY_FILE_CAPABILITIES /boot/config-2.6.31.12-0.1-desktop CONFIG_SECURITY_FILE_CAPABILITIES=y And about setuid, of course it works, but this is not the expected behaviour. It doesn't have anything to do with posix capabilities and we are still at risk (even though it is a little better than running everything as root). you need to boot with file_caps=1 to actually enable them. Anyways, please understand that bugzilla is not a support forum. This bug serves as request for a security audit so if you have further questions wrt your setup please consult our mailinglists. I just peeked at Fedora. They create wireshark group in %pre and have this in the filelist:
%attr(0750,root,wireshark) %caps(cap_net_raw,cap_net_admin=eip) %{_bindir}/dumpcap
Is this a valid option for us? If so what else needs to be done (except from pushing the changes into Factory)?
still needs an audit Nothing happens the last year and it is not setuid on 12.1 -> closing |