MIME-Version: 1.0
Date: Sat, 18 Jun 2022 12:00:38 +0200
From: Markus Kolb <alpinelinux+develml@tower-net.de>
To: Alpine Linux devel ML <~alpine/devel@lists.alpinelinux.org>
Subject: Security problem in how you manage users in package installations
Message-ID: <22948c2fba2f4882ac4646501fd6ef3f@tower-net.de>
Content-Type: text/plain; charset=US-ASCII;
 format=flowed
Content-Transfer-Encoding: 7bit

Hello,

I'm trying to maintain 2 packages I'm using with Alpine and would not 
like to see being removed from the repositories from future releases.
But I could see that there is some basic problem.
Currently you are unlocking users in pre-install of packages without any 
further checks of the existing system environment.
There is assumed the user is not existing, there is no username clash, 
the user has not set a password, the user is used only for this package 
and so on.
In short... this is a no-go to circumvent any administrative security 
related restrictions by package installations.
There is the possibility to allow an unintended (remote) login or local 
privilege expansion by unlocking users in apk-executed scripts.
And there is no sensitivity for this problem, because it is the 
recommended way of providing packages. (Quote: "see the <...apk> 
.pre-install, which is how all of them are done").

I'm negatively surprised how careless the basic system permissions are 
used.

Are you aware of this situation in Alpine and happy with it?

Markus