...
This noncompliant code example is configured as setuid-superuser. It calls bind() and later forks out a child to perform the bookkeeping tasks. The program continues to run with superuser privileges even after the bind() operation has been carried out.
| Code Block | ||
|---|---|---|
| ||
int establish(void) {
struct sockaddr_in sa; /* listening socket's address */
int s; /* listening socket */
/* Fill up the structure with address and port number */
sa.sin_port = htons(portnum);
/* Other system calls like socket() */
if (bind(s, (struct sockaddr *)&sa,
sizeof(struct sockaddr_in)) < 0) {
/* Perform cleanup */
}
/* Return */
}
int main(void) {
int s = establish();
/* Block with accept() until a client connects */
switch (fork()) {
case -1 : /* Error, clean up and quit */
case 0 : /* This is the child, handle the client */
default : /* This is the parent, continue blocking */
}
}
|
...
The program must follow the principle of least privilege while carefully separating the binding and bookkeeping tasks. To minimize the chance of a flaw in the program from compromising the superuser-level account, it should drop superuser privileges as soon as the privileged operations are completed. In the code shown below, privileges are permanently dropped as soon as the bind() operation is carried out. The code also ensures privileges may not be regained after being permanently dropped, as per POS37-C. Ensure that privilege relinquishment is successful.
| Code Block | ||
|---|---|---|
| ||
/* Code with elevated privileges */
int establish(void) {
struct sockaddr_in sa; /* listening socket's address */
int s; /* listening socket */
/* Fill up the structure with address and port number */
sa.sin_port = htons(portnum);
/* Other system calls like socket() */
if (bind(s, (struct sockaddr *)&sa,
sizeof(struct sockaddr_in)) < 0) {
/* Perform cleanup */
}
/* Return */
}
int main(void) {
int s = establish();
/* Drop privileges permanently */
if (setuid(getuid()) == -1) {
/* Handle the error */
}
if (setuid(0) != -1) {
/* Privileges can be restored, handle error */
}
/* Block with accept() until a client connects */
switch (fork()) {
case -1: /* Error, clean up and quit */
case 0: /* Close all open file descriptors
* This is the child, handle the client
*/
default: /* This is the parent, continue blocking */
}
}
|
...
Recommendation | Severity | Likelihood | Remediation Cost | Priority | Level |
|---|---|---|---|---|---|
POS02-C | high | likely | high | P9 | L2 |
Related Vulnerabilities
| Wiki Markup |
|---|
[CVE-2009-2031|http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-2031] results from a violation of this recommendation. OpenSolaris in smbfs snv_84 through snv_110 sets permissions based on mount point options, and not actual user information (obtained from the {{getuid()}} and {{getgid()}} functions). An attacker can exploit this to achieve higher permissions. Also, in a certain initialization mode the code grants read, write, and execute permissions to users other than the owner, which can be exploited to make files world readable \[[xorl 2009|AA. C References#xorl 2009-2031]\]. |
Search for vulnerabilities resulting from the violation of this rule on the CERT website.
...
| Wiki Markup |
|---|
\[[DHS 06|AA. C References#DHS 06]\] [Least Privilege | https://buildsecurityin.us-cert.gov/daisy/bsi/articles/knowledge/principles/351.html] \[[ISO/IEC PDTR 24772|AA. C References#ISO/IEC PDTR 24772]\] "XYN Privilege Management" \[[MITRE 07|AA. C References#MITRE 07]\] [CWE ID 250|http://cwe.mitre.org/data/definitions/250.html], "Execution with Unnecessary Privileges," [CWE ID 272|http://cwe.mitre.org/data/definitions/272.html], "Least Privilege Violation" \[[Saltzer 74|AA. C References#Saltzer 74]\] \[[Saltzer 75|AA. C References#Saltzer 75]\] \[[Wheeler 03|AA. C References#Wheeler 03]\] [Section 7.4, "Minimize Privileges"| http://www.dwheeler.com/secure-programs/Secure-Programs-HOWTO/minimize-privileges.html] \[[xorl 2009|AA. C References#xorl 2009-2031]\] |
...
50. POSIX (POS) POS03-C. Do not use volatile as a synchronization primitive