]> Cypherpunks repositories - gostls13.git/commit
runtime: implement SUID/SGID protections
authorRoland Shoemaker <bracewell@google.com>
Tue, 9 May 2023 18:47:57 +0000 (11:47 -0700)
committerDavid Chase <drchase@google.com>
Tue, 6 Jun 2023 18:49:01 +0000 (18:49 +0000)
commit2496653d0a5c6c26b879bb5bdd135e1f7504e051
tree37b7385b2f1896a098990d778c0c1f48c44ad127
parentb7fc272ca95bce716ba1bab1bc2490b2f31edcb5
runtime: implement SUID/SGID protections

On Unix platforms, the runtime previously did nothing special when a
program was run with either the SUID or SGID bits set. This can be
dangerous in certain cases, such as when dumping memory state, or
assuming the status of standard i/o file descriptors.

Taking cues from glibc, this change implements a set of protections when
a binary is run with SUID or SGID bits set (or is SUID/SGID-like). On
Linux, whether to enable these protections is determined by whether the
AT_SECURE flag is passed in the auxiliary vector. On platforms which
have the issetugid syscall (the BSDs, darwin, and Solaris/Illumos), that
is used. On the remaining platforms (currently only AIX) we check
!(getuid() == geteuid() && getgid == getegid()).

Currently when we determine a binary is "tainted" (using the glibc
terminology), we implement two specific protections:
  1. we check if the file descriptors 0, 1, and 2 are open, and if they
     are not, we open them, pointing at /dev/null (or fail).
  2. we force GOTRACKBACK=none, and generally prevent dumping of
     trackbacks and registers when a program panics/aborts.

In the future we may add additional protections.

This change requires implementing issetugid on the platforms which
support it, and implementing getuid, geteuid, getgid, and getegid on
AIX.

Thanks to Vincent Dehors from Synacktiv for reporting this issue.

Fixes #60272
Fixes CVE-2023-29403

Change-Id: I73fc93f2b7a8933c192ce3eabbf1db359db7d5fa
Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1878434
Reviewed-by: Damien Neil <dneil@google.com>
Reviewed-by: Ian Lance Taylor <iant@google.com>
Run-TryBot: Roland Shoemaker <bracewell@google.com>
Reviewed-by: Russ Cox <rsc@google.com>
Reviewed-on: https://go-review.googlesource.com/c/go/+/501223
Run-TryBot: David Chase <drchase@google.com>
Reviewed-by: Michael Knyszek <mknyszek@google.com>
TryBot-Result: Gopher Robot <gobot@golang.org>
40 files changed:
src/runtime/extern.go
src/runtime/os2_aix.go
src/runtime/os_aix.go
src/runtime/os_dragonfly.go
src/runtime/os_freebsd.go
src/runtime/os_linux.go
src/runtime/os_netbsd.go
src/runtime/os_openbsd_syscall2.go
src/runtime/os_solaris.go
src/runtime/panic.go
src/runtime/proc.go
src/runtime/security_aix.go [new file with mode: 0644]
src/runtime/security_issetugid.go [new file with mode: 0644]
src/runtime/security_linux.go [new file with mode: 0644]
src/runtime/security_nonunix.go [new file with mode: 0644]
src/runtime/security_test.go [new file with mode: 0644]
src/runtime/security_unix.go [new file with mode: 0644]
src/runtime/signal_unix.go
src/runtime/sys_darwin.go
src/runtime/sys_darwin_amd64.s
src/runtime/sys_darwin_arm64.s
src/runtime/sys_dragonfly_amd64.s
src/runtime/sys_freebsd_386.s
src/runtime/sys_freebsd_amd64.s
src/runtime/sys_freebsd_arm.s
src/runtime/sys_freebsd_arm64.s
src/runtime/sys_freebsd_riscv64.s
src/runtime/sys_netbsd_386.s
src/runtime/sys_netbsd_amd64.s
src/runtime/sys_netbsd_arm.s
src/runtime/sys_netbsd_arm64.s
src/runtime/sys_openbsd2.go
src/runtime/sys_openbsd_386.s
src/runtime/sys_openbsd_amd64.s
src/runtime/sys_openbsd_arm.s
src/runtime/sys_openbsd_arm64.s
src/runtime/sys_openbsd_mips64.s
src/runtime/syscall2_solaris.go
src/runtime/syscall_solaris.go
src/runtime/testdata/testsuid/main.go [new file with mode: 0644]