The fix for running op mode commands as root in https://vyos.dev/T7901 has a really bad side effect in combination with an early setuid call — the way Linux sets the EUID of suid binaries allows it to bypass the permission check.
Description
Description
Details
Details
- Version
- -
- Is it a breaking change?
- Perfectly compatible
- Issue type
- Bug (incorrect behavior)
Related Objects
Related Objects
- Mentioned In
- rVYOSONEXf3a21109778f: Merge branch 'current' of github.com:vyos/vyos-utils into vyos-utils-merge
rVYOSONEXcced1dd8170d: Merge pull request #49 from dmbaturin/T8301-fix-root-check
rVYOSONEXffde10a863f4: vyos-op-run: T8301: improve the security of UID check and setuid logic - Mentioned Here
- T7901: Operational mode commands cannot be executed when the effective UID is already zero