Bug 792095

Summary: AUDIT-0: fprintd 0.4.1 (finger print dbus service)
Product: [openSUSE] openSUSE Tumbleweed Reporter: Dominique Leuenberger <dimstar>
Component: SecurityAssignee: Marcus Meissner <meissner>
Status: RESOLVED FIXED QA Contact: E-mail List <qa-bugs>
Severity: Normal    
Priority: P5 - None CC: krahmer, meissner, security-team
Version: 13.1 Milestone 1   
Target Milestone: ---   
Hardware: Other   
OS: Other   
Whiteboard:
Found By: --- Services Priority:
Business Priority: Blocker: ---
Marketing QA Status: --- IT Deployment: ---
Attachments: described fix

Description Dominique Leuenberger 2012-11-30 08:38:12 UTC
in Factory, we're still relying on pam_fprint 0.2.. which is long obsoleted by pam_fprintd (latest version 0.4.1, from 2011).

I just prepared an upgraded package, but there are polkit and dbus  rules that require a review (setBadness 100 for now in my package to get it build).

The relevant rpmlintrc outputs:

### For DBUS ###

[   13s] fprintd.x86_64: E: suse-dbus-unauthorized-service (Badness: 10000) /usr/share/dbus-1/system-services/net.reactivated.Fprint.service
[   13s] fprintd.x86_64: E: suse-dbus-unauthorized-service (Badness: 10000) /etc/dbus-1/system.d/net.reactivated.Fprint.conf

### For PolKit ###

[   13s] fprintd.x86_64: E: polkit-unauthorized-privilege (Badness: 10000) net.reactivated.fprint.device.verify (no:no:yes)
[   13s] fprintd.x86_64: E: polkit-unauthorized-privilege (Badness: 10000) net.reactivated.fprint.device.enroll (no:no:yes)
[   13s] The package allows unprivileged users to carry out privileged operations
[   13s] without authentication. This could cause security problems if not done
[   13s] carefully. If the package is intended for inclusion in any SUSE product please
[   13s] open a bug report to request review of the package by the security team
[   13s]
[   13s] fprintd.x86_64: I: polkit-cant-acquire-privilege net.reactivated.fprint.device.verify (no:no:yes)
[   13s] fprintd.x86_64: I: polkit-cant-acquire-privilege net.reactivated.fprint.device.enroll (no:no:yes)
[   13s] fprintd.x86_64: I: polkit-cant-acquire-privilege net.reactivated.fprint.device.setusername (no:no:auth_admin_keep)

The package is currently in home:dimstar:branches:hardware, but has been submitted to hardware project (with a rpmlinrc, referencing this bug).

Once approved, it should move forward to openSUSE:Factory.
Comment 1 Marcus Meissner 2012-11-30 08:50:39 UTC
putting it in the queue

how important is this for current gnome submits?
Comment 2 Dominique Leuenberger 2012-11-30 08:56:00 UTC
(In reply to comment #1)
> how important is this for current gnome submits?

Not that important in general... the 'issue' popped up as part of bug 772948 where we identified that the gdm pam config uses the new name (pam_fprintd) and we ship the old pam_fprint.

So, none of the current gnome packages is blocked by it.

The 'wish' is to have it properly integrated in Factory, which will require some more changes in yast_fingerprint and possibly some other places (I'm working on identifying them).
Comment 3 Sebastian Krahmer 2013-02-14 13:18:57 UTC
There's a conceptual bug inside pam_fprintd which allows anyone to
bypass pam_fprintd, using DBUS signals:

http://stealth.openwall.net/xSports/darklena.c
Comment 4 Sebastian Krahmer 2013-02-19 10:23:25 UTC
Depends on bnc#804392
Comment 5 Sebastian Krahmer 2013-02-20 14:11:52 UTC
Would it make sense to have net.reactivated.fprint.device.verify
as auth_admin? It should only be called from pam module
and similar privileged code anyways?
Comment 6 Sebastian Krahmer 2013-05-28 09:04:44 UTC
needinfo
Comment 7 Dominique Leuenberger 2013-05-28 09:12:54 UTC
As a start I think this makes sense... once we run across a usecase where the 'verify' privilege is really required by a user, we can re-visit this.

(I am not entirely sure if enrollment would not want to make use of this as well..)
Comment 8 Sebastian Krahmer 2013-05-28 09:56:39 UTC
ok, then lets try it this way; I think Marcus was keeping
track of the polkit rules?
Comment 9 Marcus Meissner 2013-05-28 11:25:13 UTC
yes
Comment 10 Marcus Meissner 2013-05-31 11:55:02 UTC
did you look at the DBUS services inside? are they OK too?
Comment 11 Sebastian Krahmer 2013-06-03 03:17:40 UTC
Yes, the seem OK. However I attached a fix to be on the safe side,
in case some services allow to pass weird usernames through
PAM. Please include.
Comment 12 Sebastian Krahmer 2013-06-03 03:18:40 UTC
Created attachment 542285 [details]
described fix

.
Comment 13 Marcus Meissner 2013-06-03 08:21:40 UTC
one more ...

net.reactivated.fprint.device.verify                            no:no:auth_admin_keep
net.reactivated.fprint.device.enroll                            no:no:yes
net.reactivated.fprint.device.setusername                       no:no:auth_admin_keep


enroll to "yes" for logged in and actiev desktop user?
Comment 15 Marcus Meissner 2013-06-04 03:29:57 UTC
enrolling is probably also specifically for root?

lets try out this set:

net.reactivated.fprint.device.verify                            no:no:auth_admin
net.reactivated.fprint.device.enroll                            no:no:auth_admin
net.reactivated.fprint.device.setusername                       no:no:auth_admin

and verify it covers the usecases.
Comment 16 Sebastian Krahmer 2013-06-04 03:32:52 UTC
see comment#7, I'd like to have this auth_admin.

But in any case, enrolling should ensure that user can only
enroll for their own username. the device-claim ensures that
normal users cannot override their username, so thats ok.
However, enrolling must not be called from a PAM or other
privileged context (which is not the case yet)
Comment 17 Bernhard Wiedemann 2013-06-04 04:00:10 UTC
This is an autogenerated message for OBS integration:
This bug (792095) was mentioned in
https://build.opensuse.org/request/show/177394 Factory / polkit-default-privs
Comment 18 Marcus Meissner 2013-06-20 07:58:19 UTC
is in factory, so you can go ahead with fprintd submission if neeeded still
Comment 20 Sebastian Krahmer 2013-07-22 09:53:58 UTC
finally done
Comment 21 Marcus Meissner 2014-07-04 13:55:22 UTC
bug 850807  shows that it now queries the root password everytime.

I think we need to go to no:no:yes :(
Comment 22 Sebastian Krahmer 2014-07-16 10:07:27 UTC
should be solved now, permissions are changed