关键信息 Pull Request Information Title: Metadata validation and other security improvements #346 Status: Merged Merged By: ebiggers Merged On: Feb 24, 2022 Security Improvements 1. Immediate Security Changes: - Fix and bash completion script to handle maliciously-crafted mountpoint paths. - Validate size and type of all metadata files before reading them. - Reject login protectors owned by the wrong user. - Make offer a choice of world-writable mode and single-user-writable mode. 2. Additional Hardening: - When running as non-root, don't read metadata files owned by or in directories owned by another non-root user. - Create metadata files with mode 0600 instead of 0644. - Make ignore system users entirely. Discussion Points Split changes into individual commits for easier review. Potential issue with mode 0155 metadata directories; might prevent non-root users from updating policies or protectors they own. Two potential solutions: 1. Make function of not drop privileges, increasing attack surface. 2. Make updates fall back to direct overwrites if lacking permission to create files, which might not be atomic. Related Vulnerabilities CVE-2022-25326 CVE-2022-25327 CVE-2022-25328 Participants ebiggers josephlr dirkmueller mgerstner