From 03ee26168f0f32e6e0b9a172b75a5189b0ca2c05 Mon Sep 17 00:00:00 2001 From: Michal Sekletar Date: Mon, 19 Dec 2022 17:29:40 +0100 Subject: [PATCH 1/2] argv-util: do proper permission check while when changing process name Process renaming happens very seldomly so we are able to afford proper permission check, i.e. actually check for CAP_SYS_RESOURCE capability instead of euid. --- src/basic/argv-util.c | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) diff --git a/src/basic/argv-util.c b/src/basic/argv-util.c index 54649f4bda..fe152502fd 100644 --- a/src/basic/argv-util.c +++ b/src/basic/argv-util.c @@ -6,6 +6,7 @@ #include #include "argv-util.h" +#include "capability-util.h" #include "errno-util.h" #include "missing_sched.h" #include "parse-util.h" @@ -83,12 +84,9 @@ static int update_argv(const char name[], size_t l) { return 0; can_do = false; /* We'll set it to true only if the whole process works */ - /* Let's not bother with this if we don't have euid == 0. Strictly speaking we should check for the - * CAP_SYS_RESOURCE capability which is independent of the euid. In our own code the capability generally is - * present only for euid == 0, hence let's use this as quick bypass check, to avoid calling mmap() if - * PR_SET_MM_ARG_{START,END} fails with EPERM later on anyway. After all geteuid() is dead cheap to call, but - * mmap() is not. */ - if (geteuid() != 0) + /* Calling prctl() with PR_SET_MM_ARG_{START,END} requires CAP_SYS_RESOURCE so let's use this as quick bypass + * check, to avoid calling mmap() should PR_SET_MM_ARG_{START,END} fail with EPERM later on anyway. */ + if (!have_effective_cap(CAP_SYS_RESOURCE)) return log_debug_errno(SYNTHETIC_ERRNO(EPERM), "Skipping PR_SET_MM, as we don't have privileges."); From d5e5bc2fe9eaa4697c22b84007f18bda29756573 Mon Sep 17 00:00:00 2001 From: Michal Sekletar Date: Mon, 19 Dec 2022 17:58:49 +0100 Subject: [PATCH 2/2] units: allow systemd-userdbd to change process name MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit rename_process() requires CAP_SYS_RESOURCE so let's make sure it is in our permitted set after execve() by adding in to the bounding set. Previously, systemd-userdbd.service - User Database Manager Loaded: loaded (/usr/lib/systemd/system/systemd-userdbd.service; indirect; preset: disabled) Active: active (running) since Mon 2022-12-19 17:07:21 CET; 17min ago TriggeredBy: ● systemd-userdbd.socket Docs: man:systemd-userdbd.service(8) Main PID: 1880 (systemd-userdbd) Status: "Processing requests..." Tasks: 4 (limit: 2272) Memory: 5.2M CPU: 244ms CGroup: /system.slice/systemd-userdbd.service ├─1880 /usr/lib/systemd/systemd-userdbd ├─2270 systemd-userwork ├─2271 systemd-userwork └─2272 systemd-userwork Now, Loaded: loaded (/usr/lib/systemd/system/systemd-userdbd.service; indirect; preset: disabled) Active: active (running) since Mon 2022-12-19 17:27:02 CET; 15s ago TriggeredBy: ● systemd-userdbd.socket Docs: man:systemd-userdbd.service(8) Main PID: 2404 (systemd-userdbd) Status: "Processing requests..." Tasks: 4 (limit: 2272) Memory: 5.5M CPU: 89ms CGroup: /system.slice/systemd-userdbd.service ├─2404 /usr/lib/systemd/systemd-userdbd ├─2407 "systemd-userwork: waiting..." ├─2408 "systemd-userwork: waiting..." └─2409 "systemd-userwork: waiting..." --- units/systemd-userdbd.service.in | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/units/systemd-userdbd.service.in b/units/systemd-userdbd.service.in index 84dea04f55..b57661100c 100644 --- a/units/systemd-userdbd.service.in +++ b/units/systemd-userdbd.service.in @@ -16,7 +16,7 @@ Before=sysinit.target DefaultDependencies=no [Service] -CapabilityBoundingSet=CAP_DAC_READ_SEARCH +CapabilityBoundingSet=CAP_DAC_READ_SEARCH CAP_SYS_RESOURCE ExecStart={{ROOTLIBEXECDIR}}/systemd-userdbd IPAddressDeny=any LimitNOFILE={{HIGH_RLIMIT_NOFILE}}