DMA[2006-0514a] - 'ClamAV freshclam incorrect privilege drop'
Author: Kevin Finisterre
Vendor: http://www.clamav.net
Product: 'ClamAV freshclam'
References:
http://www.digitalmunition.com/DMA[2006-0514a].txt
http://www.markallan.co.uk/clamXav/
Description:
Tomasz Kojm of the ClamAV team describes the following code snippet from freshclam as being "for system administrators who know
what they're doing".
/* parse the config file */
if((cfgfile = getargl(opt, "config-file"))) {
copt = getcfg(cfgfile, 1);
}
...
if(setgid(user->pw_gid)) {
logg("^setgid(%d) failed.n", (int) user->pw_gid);
exit(61);
}
if(setuid(user->pw_uid)) {
logg("^setuid(%d) failed.n", (int) user->pw_uid);
exit(61);
}
Tomasz feels that since "[there are] no problem[s] in freshclam" making any changes to the above code would have "... no real
sense from a security point of view". My views on the otherhand are slightly different. The above code snippet was obviously
put in place to control the uid with which the freshclam binary runs. The freshclam manual page even makes a blatant claim
that freshclam will drop privileges.
freshclam(1) Clam AntiVirus freshclam(1)
NAME
freshclam - update virus databases
...
-u USER, --user USER
Run as USER. By default (when started by root) freshclam drops privileges and works as the 'clamav'
user.
For a program that currently has no problems the ClamAV authors have certainly went to odd lengths to make sure that freshclam
and aparantly its sister programs do not get run with root privs. Tomasz aptly pointed out to me that on page 12 of the ClamAV
documentation http://www.clamav.net/doc/0.88.2/clamdoc.pdf that users are warned to some extent:
WARNING: Never enable the SUID or SGID bits in Clam AntiVirus binaries.
Given that freshclam should aparantly never be run as root I do not exactly get the point of going through the trouble of
dropping privs. In the context of complete non privileged use there is no point for the above code at all. It seems as if it
should simply be removed.
In the event that you are either A) a user on a system with an administrator that doesn't know what he is doing, B) someone that
has gained access freshclam via sudo or C) a user on a system with clamXav installed, you may notice the following behavior:
As you can see freshclam actually does attempt to drop privs for some unknown reason.
kfinisterre@animosity:~$ sudo freshclam --on-update-execute=/usr/bin/id
ClamAV update process started at Fri Mar 17 22:41:06 2006
SECURITY WARNING: NO SUPPORT FOR DIGITAL SIGNATURES
See the FAQ at http://www.clamav.net/faq.html for an explanation.
Downloading main.cvd [99%]
main.cvd updated (version: 36, sigs: 44686, f-level: 7, builder: tkojm)
Downloading daily.cvd [100%]
daily.cvd updated (version: 1337, sigs: 1897, f-level: 7, builder: ccordes)
Database updated (46583 signatures) from database.clamav.net (IP: 67.18.105.98)
uid=1001(clamav) gid=1002(clamav) groups=1002(clamav)
Unfortunately if you read the man page and *thought* that freshclam *actually* dropped privileges you were completely wrong.
It seems that giving a user sudo access to freshclam is a bad idea if you consider the following example.
kfinisterre@animosity:~$ ls -al /etc/shadow
-rw-r----- 1 root shadow 797 2006-03-17 22:26 /etc/shadow
kfinisterre@animosity:~$ cat /etc/shadow
cat: /etc/shadow: Permission denied
Normally would not have permission to /etc/shadow however the shared config parser from freshclam helps spit the contents
to the screen in the example which is being run on a linux machine.
./shared/cfgparser.c:303: fprintf(stderr, "ERROR: Parse error at line %d: Unknown option %s.n", line, name);
kfinisterre@animosity:~$ sudo freshclam --config-file=/etc/shadow
ERROR: Parse error at line 1: Unknown option root:$1$Shootthis$shouldntbehere/:12881:0:99999:7:::.
ERROR: Can't parse the config file /etc/shadow
You can see here that the setgid(user->pw_gid) and setuid(user->pw_uid) calls occur a bit too late to be of use to the getcfg()
functione. I don't quite get why privs would be dropped when using --on-update-execute but not when --config-file is used. For
that matter I don't get why one would drop privs at all if there was never intended to be any setuid like activity involved. If
the setgid and setuid calls are to be used at all they should be placed before getcfg() is called.
As a side note to the bug iteslt, after visiting the clamav binaries webpage at http://www.clamav.net/binary.html and viewing
the following text Macintosh users may have found them selves installing clamXav:
MacOS X
* clamXav, a GUI for ClamAV running on MacOS X, is available at http://www.markallan.co.uk/clamXav (http://www.clamxav.com/).
It includes a slightly modified version of ClamAV engine as a back end. ClamAV also ships with
MacOS X 10.4 (Tiger) Server.
Although you were aptly warned if you installed either ClamXav + backend - version 1.0.1 (7.6 MB) - Released 18th July 2005
(Includes ClamAV 0.88 backend) or the ClamAV backend - version 0.88 (5.0 MB) - Released 14th January 2006 you will find that
clamXav makes the mistake of giving freshclam a setuid bit. (This was also tested with the most recent version clamXav 1.0.3h).
Even if you followed the old motto "When in doubt always compile ClamAV from sources" you may have fallen prey to the
documentation from the clamXav installer package in which you are told to "chmod u+s /usr/local/clamXav/bin/freshclam".
Welcome to Darwin!
k-fs-computer:~ kf$ ls -al /usr/local/clamXav/bin/freshclam
-rwsr-xr-x 1 root admin 224836 May 5 04:25 /usr/local/clamXav/bin/freshclam
k-fs-computer:~ kf$ cat /etc/sudoers
cat: /etc/sudoers: Permission denied
k-fs-computer:~ kf$ /usr/local/clamXav/bin/freshclam --debug --config-file=/etc/sudoers
ERROR: Parse error at line 19: Unknown option root ALL=(ALL).
ERROR: Can't parse the config file /etc/sudoers
I want to note that this issue is not critical however I wanted to highlight that one should be careful when running the various
components of ClamAV because some of them contain code that is intended to be "for system administrators who know what they're doing".
As a workaround anyone who has given non trusted users sudo access to freshclam should immediately revoke that access. Similarly
anyone with a setuid bit on the freshclam binary should immediately remove the bit by using the "chmod -s /path/to/freshclam" command.
Happy Mothers Day or something...
