oss-sec mailing list archives
Re: nfsd-ganesha allows anyone to call into DBUS?
From: Siddharth Sharma <siddharth () redhat com>
Date: Sun, 6 Nov 2016 17:52:31 -0500 (EST)
Hi, Which version of nfs-ganesha did you use ? Can you be more specific I tried to reproduce this quite a lot of times in my testing environment But I always get ~]$ dbus-send --print-reply --system --dest=org.ganesha.nfsd /org/ganesha/nfsd/ExportMgr org.ganesha.nfsd.exportmgr.AddExport string:$GANESHA_DIR/exports/export.$VOL.conf string:"EXPORT(Path=/$SERV_MALICIOUS_CONTENT)" Error org.freedesktop.DBus.Error.AccessDenied: Rejected send message, 1 matched rules; type="method_call", sender=":1.159" (uid=1000 pid=3852 comm="dbus-send --print-reply --system --dest=org.ganesh") anything you did differently ? ----------------------------------------------------------------- Siddharth Sharma / Red Hat Product Security / Key ID : 0xD9F6489A Fingerprint : 6F04 C684 A49C E4CE 8148 E841 CD6F 8E55 D9F6 489A ----- Original Message ----- From: "Sebastian Krahmer" <krahmer () suse com> To: oss-security () lists openwall com Cc: matt () linuxbox com, "philippe deniel" <philippe.deniel () cea fr> Sent: Monday, September 12, 2016 3:23:53 PM Subject: [oss-security] nfsd-ganesha allows anyone to call into DBUS? Hi The nfs-ganesha (userspace nfsd) offers a dbus API to control/admin the nfsd via cmdline tools and some qt+python code. The default dbus config seems to allow anyone to connect to it and invoke methods. The code at least does not check any polkit authorizations or dbus sender (at a first look). Am I missing something? If I dont, the DBUS API should be declared experimental and disabled by default, since there are some methods which would allow users to gain root. https://github.com/nfs-ganesha/nfs-ganesha/ https://github.com/nfs-ganesha/nfs-ganesha/wiki/Dbusinterface Sebastian -- ~ perl self.pl ~ $_='print"\$_=\47$_\47;eval"';eval ~ krahmer () suse com - SuSE Security Team
Current thread:
- Re: nfsd-ganesha allows anyone to call into DBUS? Siddharth Sharma (Nov 06)