Petri Kaukasoina |
05-21-2024 05:30 AM |
Quote:
Originally Posted by opty
(Post 6433681)
Own directory in /tmp for distribution SlackBuilds, e.g. /tmp/Swc based on /tmp/SBo but that doesn't look very nice so rather /tmp/slackware?
|
Quote:
Originally Posted by bigbadaboum
(Post 6502784)
TEMP/SLACKware would be good.
|
Quote:
Originally Posted by opty
(Post 6502886)
|
Securitywise it would be a good idea to build the distro under /tmp/slackware if a root-owned /tmp/slackware were automatically created in rc.S like /tmp/.X11-unix is. Or under some other directory other than /tmp which wouldn't be writable to all. The situation now is that there are many binaries with RPATH or RUNPATH in the elf header pointing to a directory under /tmp. For example
Code:
$ objdump -p /usr/lib64/ruby/3.3.0/x86_64-linux/enc/iso_8859_1.so|grep R.*PATH
RPATH /tmp/ruby-3.3.1
because ruby was built in /tmp/ruby-3.3.1.
A non-root perpetrator can create a directory /tmp/ruby-3.3.1 and plant a malicious library there, containing a modified function which /usr/lib64/ruby/3.3.0/x86_64-linux/enc/iso_8859_1.so wants to load.
If the ruby package had been built in /tmp/slackware/ruby-3.3.1, it would be RPATH=/tmp/slackware/ruby-3.3.1 and the perpetrator could not plant the malicious library there if there were /tmp/slackware with no write access.
Even better would be to use another build directory, not writable for non-root, not placed under /tmp, so it would not depend on a /tmp/slackware place holder directory to exist.
I wrote a script to search for dangerous RPATH/RUNPATH: https://www.linuxquestions.org/quest...ml#post6472015
|