From: Thomas Lamprecht <t.lamprecht@proxmox.com>
To: Proxmox Backup Server development discussion
<pbs-devel@lists.proxmox.com>,
Dominik Csapak <d.csapak@proxmox.com>
Subject: Re: [pbs-devel] [RFC PATCH proxmox-backup] server/rest: disallow non-protected api calls in privileged environment
Date: Wed, 3 Mar 2021 08:07:17 +0100 [thread overview]
Message-ID: <a282756e-9b05-3503-3756-32e41ef8653f@proxmox.com> (raw)
In-Reply-To: <c0c95fb1-cb93-b59e-6ca6-95081966cd85@proxmox.com>
On 02.03.21 18:02, Thomas Lamprecht wrote:
> On 02.03.21 16:31, Dominik Csapak wrote:
>> to prevent potential abuse of non-protected api calls as root
>>
>
> this breaks important CLI tools using client::connect_to_localhost
> i.e., proxmox-backup-manager and proxmox-tape and maybe others which
> connect still manually.
>
Ok, this is not true, I had in mind that we directly connect to :82, like
we did for pvesh way in the past.
>> Signed-off-by: Dominik Csapak <d.csapak@proxmox.com>
>> ---
>> this is a rather theoretical security improvement, i am not sure if we
>> want this? it would only guard against an unprotected api call that somehow
>
> no, such stuff only tends to break things while not providing any value...
> lets keep theoretical security improvements also theoretical..
>
>> allows code execution. this could then be abused to connect to the
>> daemon and reabuse the same api call, but with root permissions
>
> with magically generating a ticket and circumventing permission checks
> how exactly?
>
Security wise I find this still nonsense, its way too constructed with no
single practical possible example state, and it effectively requires to have
a free-choose binary path or control of $PATH from the environment of that
process (if that is given you have other problems) plus local access to the
machine and a entry in PBS user config would be required.
But, one thing this could help with is the issue that we sometimes had that
doing creating a config file as privileged user got us the wrong permissions,
making it inaccessible for the unprivileged code, which was a bug but not
always immediately found, we have all cases covered with chown+checks, IIRC,
but if a new config came in this could help detection (albeit such things
are quite visible, normally)
>>
>> also if we want this, maybe this would be good to have in pve too?
>
> no
>
>
>>
>> src/server/rest.rs | 3 +++
>> 1 file changed, 3 insertions(+)
>>
>> diff --git a/src/server/rest.rs b/src/server/rest.rs
>> index 9bf494fd..6b170b7f 100644
>> --- a/src/server/rest.rs
>> +++ b/src/server/rest.rs
>> @@ -750,6 +750,9 @@ async fn handle_request(
>>
>> let result = if api_method.protected && env_type == RpcEnvironmentType::PUBLIC {
>> proxy_protected_request(api_method, parts, body, peer).await
>> + } else if !api_method.protected && env_type == RpcEnvironmentType::PRIVILEGED {
>> + let err = http_err!(FORBIDDEN, "invalid server request");
>> + return Ok((formatter.format_error)(err));
>> } else {
>> handle_api_request(rpcenv, api_method, formatter, parts, body, uri_param).await
>> };
>>
next prev parent reply other threads:[~2021-03-03 7:07 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-03-02 15:31 Dominik Csapak
2021-03-02 17:02 ` Thomas Lamprecht
2021-03-03 7:07 ` Thomas Lamprecht [this message]
2021-03-03 7:27 ` Dominik Csapak
2021-03-03 8:22 ` Thomas Lamprecht
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=a282756e-9b05-3503-3756-32e41ef8653f@proxmox.com \
--to=t.lamprecht@proxmox.com \
--cc=d.csapak@proxmox.com \
--cc=pbs-devel@lists.proxmox.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox