Go to file
Aleksa Sarai fb28c99b8a
newgidmap: enforce setgroups=deny if self-mapping a group
This is necessary to match the kernel-side policy of "self-mapping in a
user namespace is fine, but you cannot drop groups" -- a policy that was
created in order to stop user namespaces from allowing trivial privilege
escalation by dropping supplementary groups that were "blacklisted" from
certain paths.

This is the simplest fix for the underlying issue, and effectively makes
it so that unless a user has a valid mapping set in /etc/subgid (which
only administrators can modify) -- and they are currently trying to use
that mapping -- then /proc/$pid/setgroups will be set to deny. This
workaround is only partial, because ideally it should be possible to set
an "allow_setgroups" or "deny_setgroups" flag in /etc/subgid to allow
administrators to further restrict newgidmap(1).

We also don't write anything in the "allow" case because "allow" is the
default, and users may have already written "deny" even if they
technically are allowed to use setgroups. And we don't write anything if
the setgroups policy is already "deny".

Ref: https://bugs.launchpad.net/ubuntu/+source/shadow/+bug/1729357
Fixes: CVE-2018-7169
Reported-by: Craig Furman <craig.furman89@gmail.com>
Signed-off-by: Aleksa Sarai <asarai@suse.de>
2018-02-16 17:56:35 +11:00
contrib Make language less binary 2017-09-20 17:00:29 +01:00
doc Removed DONE entry. 2009-04-10 22:35:19 +00:00
etc Make language less binary 2017-09-20 17:00:29 +01:00
lib Make the sp_lstchg shadow field reproducible. 2017-04-10 22:29:21 +01:00
libmisc Make the sp_lstchg shadow field reproducible. 2017-04-10 22:29:21 +01:00
man Add note to passwd(1) that --maxdays -1 disables the setting. 2018-01-03 18:36:40 +01:00
po Make language less binary 2017-09-20 17:00:29 +01:00
src newgidmap: enforce setgroups=deny if self-mapping a group 2018-02-16 17:56:35 +11:00
tests Make language less binary 2017-09-20 17:00:29 +01:00
.gitignore ignore config.cache & dist files 2016-12-05 15:48:10 -05:00
.travis.yml run travis 2016-12-06 01:09:17 +02:00
acinclude.m4 [svn-upgrade] Integrating new upstream version, shadow (4.0.13) 2007-10-07 11:47:01 +00:00
autogen.sh * autogen.sh: Restore original autoreconf (see 2010-08-29's change 2011-02-12 14:57:37 +00:00
ChangeLog Import new Dutch translations. 2017-07-16 16:46:21 -05:00
configure.ac Add error when turning off man switch 2017-09-29 11:01:39 +02:00
COPYING Added the subversion svn:keywords property (Id) for proper identification. 2007-11-10 23:46:11 +00:00
Makefile.am switch bz2 dist to xz 2016-12-05 15:57:34 -05:00
NEWS Add NEWS entries. 2013-08-04 23:29:06 +02:00
README Update README with current maintainer 2016-11-02 09:30:05 +01:00
shadow.spec.in * shadow.spec.in: Fix the source (new FTP). 2008-08-31 17:30:45 +00:00
TODO New entry for vipw. 2012-01-15 21:26:56 +00:00

Shadow SITES
============

Homepage
	http://pkg-shadow.alioth.debian.org/

FTP site
	ftp://pkg-shadow.alioth.debian.org/pub/pkg-shadow

SVN repository
	anonymous read only access: svn://svn.debian.org/pkg-shadow/upstream

SVN web interface
	http://svn.debian.org/wsvn/pkg-shadow/upstream
	or
	http://svn.debian.org/viewsvn/pkg-shadow/upstream

Mailing lists
	for general discuss: pkg-shadow-devel@lists.alioth.debian.org
	commit list: pkg-shadow-commits@lists.alioth.debian.org

Mailing lists subscription
	http://lists.alioth.debian.org/mailman/listinfo/pkg-shadow-devel
	http://lists.alioth.debian.org/mailman/listinfo/pkg-shadow-commits

Mailing lists archives:
	http://lists.alioth.debian.org/pipermail/pkg-shadow-devel/
	http://lists.alioth.debian.org/pipermail/pkg-shadow-commits/

S/Key support:
	Shadow can be built with S/Key support using the S/Key package from:

	http://cvsweb.netbsd.org/bsdweb.cgi/src/lib/libskey/
	or
	http://gentoo.osuosl.org/distfiles/skey-1.1.5.tar.bz2

Authors and contributors
========================

Thanks to at least the following people for sending patches, bug
reports and various comments.  This list may be incomplete, I received
a lot of mail...


Adam Rudnicki <adam@v-lo.krakow.pl>
Alan Curry <pacman@tardis.mars.net>
Alexander O. Yuriev <alex@bach.cis.temple.edu>
Algis Rudys <arudys@rice.edu>
Andreas Jaeger <aj@arthur.rhein-neckar.de>
Aniello Del Sorbo <anidel@edu-gw.dia.unisa.it>
Anton Gluck <gluc@midway.uchicago.edu>
Arkadiusz Miskiewicz <misiek@pld.org.pl>
Ben Collins <bcollins@debian.org>
Brian R. Gaeke <brg@dgate.org>
Calle Karlsson <ckn@kash.se>
Chip Rosenthal <chip@unicom.com>
Chris Evans <lady0110@sable.ox.ac.uk>
Cristian Gafton <gafton@sorosis.ro>
Dan Walsh <dwalsh@redhat.com>
Darcy Boese <possum@chardonnay.niagara.com>
Dave Hagewood <admin@arrowweb.com>
David A. Holland <dholland@hcs.harvard.edu>
David Frey <David.Frey@lugs.ch>
Ed Carp <ecarp@netcom.com>
Floody <flood@evcom.net>
Frank Denis <j@4u.net>
George Kraft IV <gk4@us.ibm.com>
Greg Mortensen <loki@world.std.com>
Guido van Rooij
Guy Maor <maor@debian.org>
Hrvoje Dogan <hdogan@bjesomar.srce.hr>
Jakub Hrozek <jhrozek@redhat.com>
Janos Farkas <chexum@bankinf.banki.hu>
Jay Soffian <jay@lw.net>
Jesse Thilo <Jesse.Thilo@pobox.com>
Joey Hess <joey@kite.ml.org>
John Adelsberger <jja@umr.edu>
Jonathan Hankins <jhankins@mailserv.homewood.k12.al.us>
Jon Lewis <jlewis@lewis.org>
Joshua Cowan <jcowan@hermit.reslife.okstate.edu>
Judd Bourgeois <shagboy@bluesky.net>
Juergen Heinzl <unicorn@noris.net>
Juha Virtanen <jiivee@iki.fi>
Julian Pidancet <julian.pidancet@gmail.com>
Julianne Frances Haugh <jockgrrl@ix.netcom.com>
Leonard N. Zubkoff <lnz@dandelion.com>
Luca Berra <bluca@www.polimi.it>
Lukáš Kuklínek <lkukline@redhat.com>
Lutz Schwalowsky <schwalow@mineralogie.uni-hamburg.de>
Marc Ewing <marc@redhat.com>
Martin Bene <mb@sime.com>
Martin Mares <mj@gts.cz>
Michael Meskes <meskes@topsystem.de>
Michael Talbot-Wilson <mike@calypso.bns.com.au>
Mike Frysinger <vapier@gentoo.org>
Mike Pakovic <mpakovic@users.southeast.net>
Nicolas François <nicolas.francois@centraliens.net>
Nikos Mavroyanopoulos <nmav@i-net.paiko.gr>
Pavel Machek <pavel@bug.ucw.cz>
Peter Vrabec <pvrabec@redhat.com>
Phillip Street
Rafał Maszkowski <rzm@icm.edu.pl>
Rani Chouha <ranibey@smartec.com>
Sami Kerola <kerolasa@rocketmail.com>
Scott Garman <scott.a.garman@intel.com>
Sebastian Rick Rijkers <srrijkers@gmail.com>
Seraphim Mellos <mellos@ceid.upatras.gr>
Shane Watts <shane@nexus.mlckew.edu.au>
Steve M. Robbins <steve@nyongwa.montreal.qc.ca>
Thorsten Kukuk <kukuk@suse.de>
Tim Hockin <thockin@eagle.ais.net>
Timo Karjalainen <timok@iki.fi>
Ulisses Alonso Camaro <ulisses@pusa.eleinf.uv.es>
Werner Fink <werner@suse.de>

Maintainers
===========

Tomasz Kłoczko <kloczek@pld.org.pl> (2000-2007)
Nicolas François <nicolas.francois@centraliens.net> (2007-2014)
Serge E. Hallyn <serge@hallyn.com> (2014-now)