[Dovecot] Permission denied

[Timo Sirainen]

On Sun, 2003-07-13 at 04:16, Matthias Andree wrote:
> > Anyway, home directory isn't required information from auth process. I
> > think I'll chdir to /tmp if it isn't given.
> 
> I wonder if core dumps (if any) of an authenticator process belong in
> /tmp -- /tmp is anarchy area and must be treated with care. umask(077)
> is the minimum to make sure no other user can harvest passwords from the
> core file.

No, I meant the auth process tells user's uid, gid, home directory
and/or mail location to master process. So home directory isn't required
information there. If it's not given, we should still chdir() to
somewhere else than where master is running, $prefix/var/run/dovecot/
which is 0700 root owned.

> >> Make sure you don't add ANY branches between the seteuid() calls, no
> >> mistakes must happen there.
> >
> > Why? I don't see how dropped privileges can cause much problems.
> 
> seteuid doesn't drop privileges, but temporarily puts them aside, while
> the real and saved user ID remain zero. seteuid(0) restores root
> permissions if you had them, and is a standard procedure in escalating
> privileges after a break-in.

Yes, so why is it worse to add any branches running with temporarily
dropped privileges than running with full privileges? Or are you
thinking that some geteuid() call then doesn't return 0 and thinks it's
not running as root?

I have anyway some checks that processes can't accidentally be started
as root:

	/* verify that we actually dropped the privileges */
	if (uid != 0 || disallow_root) {
		if (setuid(0) == 0)
			i_fatal("We couldn't drop root privileges");
	}

	if ((gid != 0 && uid != 0) || disallow_root) {
		if (getgid() == 0 || getegid() == 0 || setgid(0) == 0)
			i_fatal("We couldn't drop root group privileges");
	}

> The part above looks OK provided that i_fatal is simple.

Currently it is, but I'm can't be sure if someone some day adds more
complex logging functions.

> > 	} else {
> > 		/* We still have to change to some directory where we have
> > 		   rx-access. /tmp should exist everywhere. */
> > 		if (chdir("/tmp") < 0)
> > 			i_fatal("chdir(/tmp) failed: %m");
> > 	}
> 
> I don't like /tmp, see above. I'd feel more comfortable with a directory
> that only dovecot has access to, rather than /tmp.

Well, it has to be a directory where all users have at least +rx access.
+w isn't really needed. I guess I could create /var/run/dovecot/home or
something where they go, but I don't think it really matters.

Actually core dumps aren't either written by default since kernel thinks
it's running setuid-binary. You'd have to set mail_drop_priv_before_exec
= yes to allow that.