xinetd startup script checking for writeable /etc/passwd ?

markus1982 · 10-14-2002, 08:03 AM

What's the point in doing something like?

Code:

# part of /etc/rc.d/init.d/xinetd of a RH 8.0 install

# Check that we can write to it... so non-root users stop here
[ -w /etc/passwd ] || exit 1

Why would /etc/rc.d/init.d/xinetd want to check write access to /etc/passwd? This is not really a good idea IMHO!

Xinetd version is 2.3.7

Doug_Loss · 10-14-2002, 12:57 PM

It's checking to make sure that xinetd isn't started by an account other than root (or one with root privileges). That's a *good* thing. If someone is already on your box with root privileges, this won't hurt anything since the box would already be severely compromised.

markus1982 · 10-14-2002, 01:10 PM

Quote:

Originally posted by Doug_Loss
It's checking to make sure that xinetd isn't started by an account other than root (or one with root privileges). That's a *good* thing. If someone is already on your box with root privileges, this won't hurt anything since the box would already be severely compromised.

root doesn't need to have write access to /etc/passwd, for security reasons the file could have the immutable bit set => xinetd startup will fail.

There are other ways to check for root rights (checking the uid for instance), etc!

Doug_Loss · 10-14-2002, 01:24 PM

That sounds like a good change request to make at www.xinetd.org :-). I agree with you.

unSpawn · 10-14-2002, 02:42 PM

root doesn't need to have write access to /etc/passwd, for security reasons the file could have the immutable bit set(..)

It's about being capable to access/having write access to a file vs actually writing to a file. Extended bits only posess meaning when writing to a file in this case of the immutable bit.

markus1982 · 10-14-2002, 04:22 PM

Is there any other way except:

disabling this check in the xinetd startup script
removing the immutable bit of /etc/passwd

unSpawn · 10-15-2002, 09:30 AM

Well, you could patch main.c with a joke like

Code:

 int main( int argc, char *argv[] )
{
   const char            *func = "main" ;
+
+   if (getuid() & geteuid()) {
+   terminate_program();
+   }
+
   sio_init();

after which it'll sigsegv when executed as non-root, LOL!
Seriously, Xinetd will *need* at least read-only access to /etc/passwd in case a service has to be started as non-root (man xinetd.conf) so it can find out the user, and since it doesn't do actual writes to /etc/passwd, the extended bits can be kept, AFAIC.

markus1982 · 10-15-2002, 12:02 PM

Quote:

Originally posted by unSpawn
Seriously, Xinetd will *need* at least read-only access to /etc/passwd in case a service has to be started as non-root (man xinetd.conf) so it can find out the user, and since it doesn't do actual writes to /etc/passwd, the extended bits can be kept, AFAIC.

Well if you have set the immutable bit xinetd refuses to start ...

unSpawn · 10-15-2002, 12:49 PM

Ok. That's nasty. The check ain't in 2.3.3x and it ain't in the contrib src of 2.3.9. If you run this:
#!/bin/sh
tgt=/etc/passwd
chk() { if [ -w "$tgt" ]; then echo write; else echo wont; fi; }
chattr +i "$tgt"; chk; chattr -i "$tgt"; chk
You'll see extended bit doesn't affect it, and root gets "write" every time. Ok, so I ran a strace on xinetd and it doesn't even show a open("/etc/passwd", O_RDONLY)...

Could you run a strace, scrub the output for hostnames etc and post it here?

markus1982 · 10-15-2002, 12:55 PM

Quote:

Could you run a strace, scrub the output for hostnames etc and post it here?

Yep I'll do that once I'm back at the place I can access that server ... that will be tomorrow AFAIK. Hope I have strace installed there

Remember it's in the INIT script of xinetd that has this check in it ... and OS is RH 8.0

unSpawn · 10-16-2002, 06:21 AM

Yeah, but I can't imagine why a script would break xinetd usage this way... Anyway, I downloaded the RH 8.0 xinetd-2.3.7 rpm, and exept for the passwd stuff there's nothing weird in it.
Stracing xinetd (ok, not the script) doesn't show me open\( 's for passwd.

If commenting out the passwd stuff from the initscript while leaving the immutable bit on works, let's drop the matter ok?

markus1982 · 10-16-2002, 08:15 AM

Quote:

If commenting out the passwd stuff from the initscript while leaving the immutable bit on works, let's drop the matter ok?

Yep, when you comment out that check it works flawlessly ... close the thread