chage: let a user read their own aging line - #310
Merged
Merged
Conversation
`chage -l` is the one mode a user may run, on their own account, and it did not work for them: `make install` put chage at 0755, which cannot read /etc/shadow, and the multicall binary dropped its privilege before running it. The Makefile's own comment placed chage in bin "for chage -l, the one mode a user may run on their own account". The packaged binaries settle the contract: Debian ships chage 2755 root:shadow, the same as expiry; Fedora and Arch have no shadow group and ship it 4755 root. chage now follows expiry -- setgid shadow, or setuid root where the group is absent, and an applet that keeps euid 0 in the multicall binary. chage decides what the caller may do from the real uid, and --root is refused before the chroot on the same basis, so the privilege buys a user their own line and nothing else. Verified with the per-tool binaries installed in the debian image under both layouts; as an unprivileged user under each, chage -l on the own account answers, chage -l root, chage -M 5 and chage --root are refused, and the shadow field is unchanged afterwards. The deployment suite gains those four assertions for the multicall layout.
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
chage -lis the one mode a user may run, on their own account, and it did not work for them:make installputchageat0755, which cannot read/etc/shadow, and the multicall binary dropped its privilege before running it. The Makefile's own comment saidchagesat inbin"forchage -l, the one mode a user may run on their own account".Contract, probed on the packaged binaries. Debian ships
chage2755 root:shadow, the same asexpiry. Fedora and Arch have noshadowgroup and ship it 4755 root.Change.
chagefollowsexpiry: setgidshadow, or setuid root where the group is absent (#309's mechanism), and an applet that keeps euid 0 in the multicall binary.chagedecides what the caller may do from the real uid (caller_is_rootisgetuid), and--rootis refused before the chroot on the same basis, so the privilege buys a user their own line and nothing else.Verified. Per-tool binaries installed in the debian image under both layouts (2755 root:shadow, and 4755 root with
SHADOW_GROUPset to a group that does not exist); as an unprivileged user under each:chage -lon the own account answers,chage -l root,chage -M 5 <self>andchage --root / -l <self>are refused, and the shadow field is unchanged afterwards. The deployment suite gains those four assertions for the multicall layout;make checkin the container.Docs: README tool table and install notes, the chage man page, changelog under Fixed.