TE
TechEcho
Home24h TopNewestBestAskShowJobs
GitHubTwitter
Home

TechEcho

A tech news platform built with Next.js, providing global tech news and discussions.

GitHubTwitter

Home

HomeNewestBestAskShowJobs

Resources

HackerNews APIOriginal HackerNewsNext.js

© 2025 TechEcho. All rights reserved.

PolicyKit: Users with UID greater than INT_MAX can execute any systemctl command

87 pointsby fridsunover 6 years ago

6 comments

CaliforniaKarlover 6 years ago
Particularly worth noting because systemd uses polkit, so certain unprivileged users can do systemctl commands that only admins should be able to do.<p>See also <a href="https:&#x2F;&#x2F;github.com&#x2F;systemd&#x2F;systemd&#x2F;issues&#x2F;11026" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;systemd&#x2F;systemd&#x2F;issues&#x2F;11026</a><p>But this isn’t a systemd bug, this is a bug in software systemd relies on.
pjmlpover 6 years ago
Typical exploit with unsigned&#x2F;signed conversions.<p><a href="https:&#x2F;&#x2F;gitlab.freedesktop.org&#x2F;polkit&#x2F;polkit&#x2F;issues&#x2F;74" rel="nofollow">https:&#x2F;&#x2F;gitlab.freedesktop.org&#x2F;polkit&#x2F;polkit&#x2F;issues&#x2F;74</a>
emmelaichover 6 years ago
You&#x27;d have to be a privileged user to create such high uid user.<p>And it&#x27;s very unlikely to happen by accident, right? So can&#x27;t get too excited about this.<p>Bit of trivia - one some older Unixes (HP-UX) the uid -1 was special - was always unprivileged &#x27;nobody&#x27; and was equal to 65535.
评论 #18607233 未加载
评论 #18608293 未加载
评论 #18607093 未加载
评论 #18607098 未加载
zaarnover 6 years ago
It should be noted that with a UID larger than INT_MAX a lot of things will start to break, ext4 for example only supports 32bit UIDs, so you won&#x27;t be able to chown any files as this UID (atleast my own experimentation seems to find this. NFSv4 allows it if you enable squashing&#x2F;mapping of user ids).<p>Lots of other tools will likely break in similar and unpredictable ways if your UID becomes that high. Likely those ways are also a lot of fun.<p>Since you&#x27;d need to be a privileged user to begin with, this is on the same alarm level as &quot;running sed with sudo allows you to edit &#x2F;etc&#x2F;sudoers and gain full sudo privilege&quot;.
评论 #18608058 未加载
评论 #18607702 未加载
jstimpfleover 6 years ago
Why don&#x27;t we have hardware overflow traps? Most numbers should never overflow. We would need just 1 additional bit for arithmetic instructions to indicate that overflows are fine in some cases.
评论 #18609117 未加载
LinuxBenderover 6 years ago
Has anyone found a clean way to remove polkit once installed without breaking systemd? On Redhat at least, you have to kickstart the machine without anything that pulls it in. It can&#x27;t be &quot;disabled&quot; without breaking things and udev will trigger it regardless of the unit file state.
评论 #18618995 未加载
评论 #18644929 未加载