Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

qrexec stderr pipes in /tmp are unsafe if there are low-privileged users #9097

Closed
DemiMarie opened this issue Apr 7, 2024 · 0 comments · Fixed by QubesOS/qubes-core-qrexec#139
Closed

qrexec stderr pipes in /tmp are unsafe if there are low-privileged users #9097

DemiMarie opened this issue Apr 7, 2024 · 0 comments · Fixed by QubesOS/qubes-core-qrexec#139
Assignees
@DemiMarie
Labels
affects-4.1 This issue affects Qubes OS 4.1. affects-4.2 This issue affects Qubes OS 4.2. C: core diagnosed Technical diagnosis has been performed (see issue comments). P: default Priority: default. Default priority for new issues, to be replaced given sufficient information. pr submitted A pull request has been submitted for this issue.

Comments

@DemiMarie
Copy link

How to file a helpful issue

Qubes OS release

R4.2 but this problem predates R4.1

Brief summary

qrexec creates pipes in /tmp, but that isn’t safe because the names are predictable.

Steps to reproduce

Inspect /tmp on a running system.

Expected behavior

No named pipes with predictable names.

Actual behavior

Named pipes with predictable names.
@DemiMarie DemiMarie added T: bug C: core P: default Priority: default. Default priority for new issues, to be replaced given sufficient information. diagnosed Technical diagnosis has been performed (see issue comments). pr submitted A pull request has been submitted for this issue. affects-4.1 This issue affects Qubes OS 4.1. affects-4.2 This issue affects Qubes OS 4.2. labels Apr 7, 2024
@DemiMarie DemiMarie self-assigned this Apr 7, 2024
DemiMarie added a commit to DemiMarie/qubes-core-qrexec that referenced this issue Apr 7, 2024
@DemiMarie
Avoid using /tmp for qrexec return pipes
9b0691c 
This avoids a privilege escalation from unprivileged users (not in the
"qubes" group).

Fixes: QubesOS/qubes-issues#9097
DemiMarie added a commit to DemiMarie/qubes-core-qrexec that referenced this issue Apr 7, 2024
@DemiMarie
Avoid using /tmp for qrexec return pipes
985a3ae 
This avoids a privilege escalation from unprivileged users (not in the
"qubes" group).

Fixes: QubesOS/qubes-issues#9097
@DemiMarie DemiMarie mentioned this issue Apr 7, 2024
Merged
DemiMarie added a commit to DemiMarie/qubes-core-qrexec that referenced this issue Apr 8, 2024
@DemiMarie
Avoid using /tmp for qrexec return pipes
6787a57 
This avoids a privilege escalation from unprivileged users (not in the
"qubes" group).

Fixes: QubesOS/qubes-issues#9097
DemiMarie added a commit to DemiMarie/qubes-core-qrexec that referenced this issue Apr 9, 2024
@DemiMarie
Avoid using /tmp for qrexec return pipes
aaba8dc 
This avoids a privilege escalation from unprivileged users (not in the
"qubes" group).

Fixes: QubesOS/qubes-issues#9097
DemiMarie added a commit to DemiMarie/qubes-core-qrexec that referenced this issue Apr 9, 2024
@DemiMarie
Avoid using /tmp for qrexec return pipes
ac9c9a4 
This avoids a privilege escalation from unprivileged users (not in the
"qubes" group).

Fixes: QubesOS/qubes-issues#9097
DemiMarie added a commit to DemiMarie/qubes-core-qrexec that referenced this issue Apr 9, 2024
@DemiMarie
Avoid using /tmp for qrexec return pipes
47978ac 
This avoids a privilege escalation from unprivileged users (not in the
"qubes" group).

Fixes: QubesOS/qubes-issues#9097
This was referenced May 9, 2024
Closed
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@DemiMarie DemiMarie

Labels
affects-4.1 This issue affects Qubes OS 4.1. affects-4.2 This issue affects Qubes OS 4.2. C: core diagnosed Technical diagnosis has been performed (see issue comments). P: default Priority: default. Default priority for new issues, to be replaced given sufficient information. pr submitted A pull request has been submitted for this issue.
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Various bugfixes DemiMarie/qubes-core-qrexec
1 participant
@DemiMarie