NetBSD Problem Report #5967

Received: (qmail 25700 invoked from network); 14 Aug 1998 16:03:13 -0000
Message-Id: <199808141600.MAA17461@duhnet.net>
Date: Fri, 14 Aug 1998 12:00:39 -0400 (EDT)
From: tv@pobox.com
To: gnats-bugs@gnats.netbsd.org
Subject: "ps -ae" shows environment of other users
X-Send-Pr-Version: 3.95

>Number:         5967
>Category:       security
>Synopsis:       "ps -ae" shows environment of other users
>Confidential:   no
>Severity:       serious
>Priority:       high
>Responsible:    tv
>State:          closed
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Fri Aug 14 09:05:00 +0000 1998
>Closed-Date:    Fri Dec 03 02:15:11 +0000 1999
>Last-Modified:  Fri Dec 03 02:19:48 +0000 1999
>Originator:     Todd Vierling
>Release:        -current August 14
>Organization:
	DuhNet: Pointing out the obvious since 1994.

>Environment:
blah

>Description:

The ps "-e" option shows the environment of commands, even those for
processes owned by users other than the caller.

>How-To-Repeat:

ps -axeww

"Yikes!"

>Fix:

Don't show environment of non-user-owned processes if the user is not
root.

I'll do it later today.  This PR is a reminder to myself.
>Release-Note:
>Audit-Trail:
Responsible-Changed-From-To: gnats-admin->tv 
Responsible-Changed-By: fair 
Responsible-Changed-When: Sun Dec 13 00:23:52 PST 1998 
Responsible-Changed-Why:  
Todd said this was his... 

Date: Sat, 24 Apr 1999 23:02:14 +1000
From: Simon Burge <simonb@NetBSD.ORG>
To: tv@pobox.com
Cc: gnats-bugs@gnats.netbsd.org, Simon Burge <simonb@NetBSD.ORG>
Subject: Re: "ps -ae" shows environment of other users

Hi there,

I know you marked this "I'll do it later", but the prompting
on developers led me to this:

Index: extern.h
===================================================================
RCS file: /cvsroot/src/bin/ps/extern.h,v
retrieving revision 1.13
diff -u -r1.13 extern.h
--- extern.h	1999/03/26 22:36:02	1.13
+++ extern.h	1999/04/24 13:01:22
@@ -43,6 +43,7 @@
 extern fixpt_t ccpu;
 extern int eval, fscale, mempages, nlistread, rawcpu;
 extern int sumrusage, termwidth, totwidth;
+extern uid_t myuid;
 extern VAR var[];
 extern VARENT *vhead;

Index: print.c
===================================================================
RCS file: /cvsroot/src/bin/ps/print.c,v
retrieving revision 1.40
diff -u -r1.40 print.c
--- print.c	1999/04/16 13:34:32	1.40
+++ print.c	1999/04/24 13:01:22
@@ -156,7 +156,7 @@
 			left = v->width;
 	} else
 		left = -1;
-	if (needenv) {
+	if (needenv && (myuid == 0 || KI_EPROC(ki)->e_ucred.cr_uid == myuid)) {
 		argv = kvm_getenvv(kd, ki->ki_p, termwidth);
 		if ((p = argv) != NULL) {
 			while (*p) {
Index: ps.1
===================================================================
RCS file: /cvsroot/src/bin/ps/ps.1,v
retrieving revision 1.31
diff -u -r1.31 ps.1
--- ps.1	1999/03/27 21:38:08	1.31
+++ ps.1	1999/04/24 13:01:22
@@ -100,7 +100,8 @@
 cpu calculation that ignores ``resident'' time (this normally has
 no effect).
 .It Fl e
-Display the environment as well.
+Display the environment as well.  The environment for other
+users' processes can only be displayed by the super-user.
 .It Fl h
 Repeat the information header as often as necessary to guarantee one
 header per page of information.
Index: ps.c
===================================================================
RCS file: /cvsroot/src/bin/ps/ps.c,v
retrieving revision 1.28
diff -u -r1.28 ps.c
--- ps.c	1999/03/27 21:38:08	1.28
+++ ps.c	1999/04/24 13:01:22
@@ -87,6 +87,7 @@
 int	totwidth;		/* calculated width of requested variables */

 int	needuser, needcomm, needenv, commandonly;
+uid_t	myuid;

 enum sort { DEFAULT, SORTMEM, SORTCPU } sortby = DEFAULT;

@@ -135,7 +136,7 @@

 	fmt = prtheader = wflag = xflg = 0;
 	what = KERN_PROC_UID;
-	flag = getuid();
+	flag = myuid = getuid();
 	memf = nlistf = swapf = NULL;
 	while ((ch = getopt(argc, argv,
 	    "acCeghjKLlM:mN:O:o:p:rSTt:U:uvW:wx")) != -1)

Are you happy for me to commit it and close the PR?

Simon.

Date: Sat, 24 Apr 1999 09:57:49 -0400 (EDT)
From: Todd Vierling <tv@pobox.com>
To: Simon Burge <simonb@NetBSD.ORG>
Cc: gnats-bugs@gnats.netbsd.org
Subject: Re: "ps -ae" shows environment of other users

On Sat, 24 Apr 1999, Simon Burge wrote:

: I know you marked this "I'll do it later",

: Are you happy for me to commit it and close the PR?

Only if there's agreement on tech-userlevel that it is OK.  There was a
brief debate shortly after I opened the PR about the appropriateness of
doing something like this.

-- 
-- Todd Vierling (Personal tv@pobox.com; Bus. todd_vierling@xn.xerox.com)


Date: Sun, 25 Apr 1999 00:32:43 +1000
From: Simon Burge <simonb@NetBSD.ORG>
To: Todd Vierling <tv@pobox.com>
Cc: Simon Burge <simonb@NetBSD.ORG>, gnats-bugs@gnats.netbsd.org
Subject: Re: "ps -ae" shows environment of other users 

Todd Vierling wrote:

> On Sat, 24 Apr 1999, Simon Burge wrote:
> 
> : I know you marked this "I'll do it later",
> 
> : Are you happy for me to commit it and close the PR?
> 
> Only if there's agreement on tech-userlevel that it is OK.  There was a
> brief debate shortly after I opened the PR about the appropriateness of
> doing something like this.

I just did an el-hugo find | xargs grep -l 'ps -ae' and couldn't find
anything in any mailling list.  I guess I'll just go to tech-userlevel
then if you're happy (being a confidential PR 'n' all, I believe).

Simon.

State-Changed-From-To: open->analyzed 
State-Changed-By: fair 
State-Changed-When: Mon Apr 26 03:17:33 PDT 1999 
State-Changed-Why:  
The ways of GNATS are inscrutable. Feedback/analysis from three separate, 
bogus PRs created by a message thread have now been manually added to this 
PR, and the state change is mostly to give everyone a heads-up that this 
has happened. Plus, "analyzed" is even the right state, since Simon has 
done an analysis and posted a patch! 

From: Erik Fair <security-officer@NetBSD.ORG>
To: tv@NetBSD.ORG, simonb@NetBSD.ORG
Cc: gnats-bugs@NetBSD.ORG
Subject: security/5967
Date: Wed, 17 Nov 1999 03:13:05 -0800

 Gentlemen,
 	Is there any resolution on

 http://www.NetBSD.org/cgi-bin/query-pr-single.pl?number=5967

 Which is about ps's ability to display user's environment variables?

 	inquiring minds want to know,

 	Erik <fair@netbsd.org>

From: Simon Burge <simonb@NetBSD.ORG>
To: Erik Fair <security-officer@NetBSD.ORG>
Cc: tv@NetBSD.ORG, simonb@NetBSD.ORG, gnats-bugs@NetBSD.ORG
Subject: Re: security/5967 
Date: Wed, 17 Nov 1999 23:56:18 +1100

 Erik Fair wrote:

 > Gentlemen,
 > 	Is there any resolution on
 > 
 > http://www.NetBSD.org/cgi-bin/query-pr-single.pl?number=5967
 > 
 > Which is about ps's ability to display user's environment variables?
 > 
 > 	inquiring minds want to know,

 There was a thread that started on developers and moved to tech-security
 called "confidential PRs that should be resolved before 1.4 ships".
 I've just reread the thread, and to my knowledge there were no problems
 with this particular patch - the thread degenerated into viewing others'
 processes and the knobs needed to twiddle this.

 Personally, I'd say commit this and open a change request to do with
 viewing other users process information - that would apply to w(1),
 top(1), sysstat(1), etc.  Sound good?

 Simon.

From: Erik Fair <security-officer@NetBSD.ORG>
To: Simon Burge <simonb@NetBSD.ORG>
Cc: Erik Fair <security-officer@NetBSD.ORG>, tv@NetBSD.ORG, simonb@NetBSD.ORG,
        gnats-bugs@NetBSD.ORG
Subject: Re: security/5967
Date: Wed, 17 Nov 1999 11:03:14 -0800

 Yes, sounds good.

 	Erik <fair@clock.org>
State-Changed-From-To: analyzed->closed 
State-Changed-By: simonb 
State-Changed-When: Thu Dec 2 18:15:11 PST 1999 
State-Changed-Why:  
Fixed as suggested by my patch. 
>Unformatted:

Home	PR Database Search