Re: [Security-Discuss] Xine accessing /etc/passwd ????

* Tuxiq <tuxiq2304-FFYn/[email protected]> [2006-05-21 09:36:05 -0400]:

> 	OK guys this is my first post so I apologize in advance for any mistakes...
> 
> I noticed my latest XINE, when started from a konsole and provided with a 
> filename on the command line, suddenly started giving me the following 
> message when exiting ....
> 
> 	mkdir(/spook) failed: Permission denied
> 
> where "spook" is my normal user name. So I was curious and did an STRACE of 
> xine which revealed that something in the process was accessing 
> the /etc/passwd file and looking up the <root> entry !!?????
> 
> IS THIS NORMAL BEHAVIOUR???????
> 
> 
> In any case I am attaching the strace output.
> 
> OH and while I'm at it, 
> 	while preparing the attachment I managed to delete a file belonging to 
> root:root with only READ access writes to group members or others, and this 
> is not the first time the system allowed me to do this. The only  possible 
> mitigating factor is that it happened in my home directory and my user has 
> full sudo rights but I had not even invoked sudo in that session so there was 
> no possibility of "RESIDUAL" rights from a prior invocation. 

No idea about xine, but if there is a root:root owned file in your
homedir which is owned user:user, user will *always* be able to delete
it, regardless of permissions because it has rwx access to the
directory:

vdanen@odin:~/ >% sudo su
Password:
odin:/Users/vdanen root# touch rootme
odin:/Users/vdanen root# ls -l rootme
-rw-r--r--    1 root     vdanen          0 May 21 14:06 rootme
odin:/Users/vdanen root# chown root:admin rootme
odin:/Users/vdanen root# chmod 600 rootme
odin:/Users/vdanen root# ls -l rootme
-rw-------    1 root     admin           0 May 21 14:06 rootme
odin:/Users/vdanen root# 
odin:/Users/vdanen root# exit
exit
vdanen@odin:~/ >% ls -l rootme
-rw-------    1 root     admin           0 May 21 14:06 rootme
vdanen@odin:~/ >% cat rootme
cat: rootme: Permission denied
vdanen@odin:~/ >% rm rootme
remove rootme? y
vdanen@odin:~/ >% ls -l rootme
ls: rootme: No such file or directory
vdanen@odin:~/ >% 

The above is on my OS X box, but the principle is the same.

-- 
"lynx -source http://linsec.ca/vdanen.asc | gpg --import"
{FEE30AD4 : 7F6C A60C 06C2 4811 FA1C  A2BC 2EBC 5E32 FEE3 0AD4}
Wasting time like it was free...

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.3 (Darwin)

iD8DBQFEcMimLrxeMv7jCtQRAhNtAKCF8fsX4qscXnk5ULfeE9l1dbWM3ACbBypm
yQLquzz4DYvHpXc2iOQIUqU=
=lFZg
-----END PGP SIGNATURE-----