TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

PolicyKit: Users with UID greater than INT_MAX can execute any systemctl command

87 点作者 fridsun超过 6 年前

6 条评论

CaliforniaKarl超过 6 年前
Particularly worth noting because systemd uses polkit, so certain unprivileged users can do systemctl commands that only admins should be able to do.<p>See also <a href="https:&#x2F;&#x2F;github.com&#x2F;systemd&#x2F;systemd&#x2F;issues&#x2F;11026" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;systemd&#x2F;systemd&#x2F;issues&#x2F;11026</a><p>But this isn’t a systemd bug, this is a bug in software systemd relies on.
pjmlp超过 6 年前
Typical exploit with unsigned&#x2F;signed conversions.<p><a href="https:&#x2F;&#x2F;gitlab.freedesktop.org&#x2F;polkit&#x2F;polkit&#x2F;issues&#x2F;74" rel="nofollow">https:&#x2F;&#x2F;gitlab.freedesktop.org&#x2F;polkit&#x2F;polkit&#x2F;issues&#x2F;74</a>
emmelaich超过 6 年前
You&#x27;d have to be a privileged user to create such high uid user.<p>And it&#x27;s very unlikely to happen by accident, right? So can&#x27;t get too excited about this.<p>Bit of trivia - one some older Unixes (HP-UX) the uid -1 was special - was always unprivileged &#x27;nobody&#x27; and was equal to 65535.
评论 #18607233 未加载
评论 #18608293 未加载
评论 #18607093 未加载
评论 #18607098 未加载
zaarn超过 6 年前
It should be noted that with a UID larger than INT_MAX a lot of things will start to break, ext4 for example only supports 32bit UIDs, so you won&#x27;t be able to chown any files as this UID (atleast my own experimentation seems to find this. NFSv4 allows it if you enable squashing&#x2F;mapping of user ids).<p>Lots of other tools will likely break in similar and unpredictable ways if your UID becomes that high. Likely those ways are also a lot of fun.<p>Since you&#x27;d need to be a privileged user to begin with, this is on the same alarm level as &quot;running sed with sudo allows you to edit &#x2F;etc&#x2F;sudoers and gain full sudo privilege&quot;.
评论 #18608058 未加载
评论 #18607702 未加载
jstimpfle超过 6 年前
Why don&#x27;t we have hardware overflow traps? Most numbers should never overflow. We would need just 1 additional bit for arithmetic instructions to indicate that overflows are fine in some cases.
评论 #18609117 未加载
LinuxBender超过 6 年前
Has anyone found a clean way to remove polkit once installed without breaking systemd? On Redhat at least, you have to kickstart the machine without anything that pulls it in. It can&#x27;t be &quot;disabled&quot; without breaking things and udev will trigger it regardless of the unit file state.
评论 #18618995 未加载
评论 #18644929 未加载