Date: Tue, 21 Jun 2022 12:17:44 +0200
From: Natanael Copa <ncopa@alpinelinux.org>
To: Markus Kolb <alpinelinux+develml@tower-net.de>
Cc: Alpine Linux devel ML <~alpine/devel@lists.alpinelinux.org>
Subject: Re: Security problem in how you manage users in package
 installations
Message-ID: <20220621121744.01de0b33@ncopa-desktop.lan>
In-Reply-To: <22948c2fba2f4882ac4646501fd6ef3f@tower-net.de>
References: <22948c2fba2f4882ac4646501fd6ef3f@tower-net.de>
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit

On Sat, 18 Jun 2022 12:00:38 +0200
Markus Kolb <alpinelinux+develml@tower-net.de> wrote:

> Hello,
> 
> I'm trying to maintain 2 packages I'm using with Alpine and would not 
> like to see being removed from the repositories from future releases.
> But I could see that there is some basic problem.
> Currently you are unlocking users in pre-install of packages without any 
> further checks of the existing system environment.

Where are users unlocked in pre-install?

...

> There is the possibility to allow an unintended (remote) login or local 
> privilege expansion by unlocking users in apk-executed scripts.

Can you please explain with an example how that would work?

I as an admin create a user called 'foo' and then a package with a
service tries to create the same user 'foo'? Using adduser? or using
passwd?

> And there is no sensitivity for this problem, because it is the 
> recommended way of providing packages. (Quote: "see the <...apk> 
> .pre-install, which is how all of them are done").
> 
> I'm negatively surprised how careless the basic system permissions are 
> used.
> 
> Are you aware of this situation in Alpine and happy with it?

Apparently I was not aware of the severity of the situation. no.

Can you please give me an example of how this could be exploited by an
attacker?

> Markus