Date: Tue, 21 Jun 2022 11:24:39 -0500 (CDT)
From: Ariadne Conill <ariadne@dereferenced.org>
To: Markus Kolb <alpinelinux+develml@tower-net.de>
cc: Alpine Linux devel ML <~alpine/devel@lists.alpinelinux.org>
Subject: Re: Security problem in how you manage users in package
 installations
In-Reply-To: <22948c2fba2f4882ac4646501fd6ef3f@tower-net.de>
Message-ID: <a0158f4d-81d0-c034-665a-853345463371@dereferenced.org>
References: <22948c2fba2f4882ac4646501fd6ef3f@tower-net.de>
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII; format=flowed

Hi,

On Sat, 18 Jun 2022, Markus Kolb wrote:

> Hello,
>
> I'm trying to maintain 2 packages I'm using with Alpine and would not like to 
> see being removed from the repositories from future releases.
> But I could see that there is some basic problem.
> Currently you are unlocking users in pre-install of packages without any 
> further checks of the existing system environment.
> There is assumed the user is not existing, there is no username clash, the 
> user has not set a password, the user is used only for this package and so 
> on.

This is a problem with adduser in busybox, then, and it should be fixed 
there.  In the past adduser was performing these checks, so something has 
changed.

> In short... this is a no-go to circumvent any administrative security related 
> restrictions by package installations.
> There is the possibility to allow an unintended (remote) login or local 
> privilege expansion by unlocking users in apk-executed scripts.
> And there is no sensitivity for this problem, because it is the recommended 
> way of providing packages. (Quote: "see the <...apk> .pre-install, which is 
> how all of them are done").
>
> I'm negatively surprised how careless the basic system permissions are used.
>
> Are you aware of this situation in Alpine and happy with it?

I am aware of this situation, but am skeptical that it is an actual 
security problem (unless new versions of busybox have actually broken 
adduser).  That awareness is why we are moving user/group management 
directly to apk-tools as part of apk 3.

Ariadne