Message-ID: <9d3863ce-7299-db69-35ab-09d6bc24ce59@ptrcnull.me>
Date: Tue, 21 Jun 2022 11:20:20 +0200
MIME-Version: 1.0
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101
 Thunderbird/91.10.0
Content-Language: en-US
To: Markus Kolb <alpinelinux+develml@tower-net.de>
References: <22948c2fba2f4882ac4646501fd6ef3f@tower-net.de>
 <cf311040-21f2-ad8b-4b9c-363f7ad0c9f5@jirutka.cz>
 <b1c1278d4461aaf940aea2d24c0e05d6@tower-net.de>
From: Patrycja Rosa <patrycja@ptrcnull.me>
Subject: Re: Security problem in how you manage users in package installations
Cc: ~alpine/devel@lists.alpinelinux.org
In-Reply-To: <b1c1278d4461aaf940aea2d24c0e05d6@tower-net.de>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit

On 21/06/2022 10:59, Markus Kolb wrote:
> Am 19.06.2022 19:23, schrieb Jakub Jirutka:
>>> There is the possibility to allow an unintended (remote) login or 
>>> local privilege expansion by unlocking users in apk-executed scripts.
>>
>> No, if the user already exists, then adduser(8) does nothing.
>>
> 
> But passwd does. Unlocking is happening with passwd and not adduser.
> Not sure why you all point to adduser?!
Because except for Gogs and Gitea, nothing uses passwd in post-install, 
just adduser - and in these two cases it's a desired behaviour, because 
otherwise using Git over system SSH wouldn't work.

> Can you all try to understand the problem and not try to avoid the 
> explanations and saying all is fine like it is?!
> It is not, you have a package in your repository, where you can get for 
> sure a CVE entry for because of how it is installed by apk.
Do you mind explaining how unlocking a user with no password, no shell 
and SSH keys managed by Gitea/Gogs specifically to run their handlers 
(in case of Gitea, "gitea serv key-name") is worthy of a CVE?