Mehmet INCEandClaude Opus 5
13f18b2cb7
Backport of the FIDO2 authfile fix (PR #7904 by @mdisec, merged to quattro as
23dab9ec) onto the v4-0-1 release branch.
pamu2fcfg wrote to /tmp/fido2 and the registration was then moved into place
with sudo mv. Any other local user can pre-create /tmp/fido2, and rename(2) does
not dereference the final component, so the privileged move installed the
attacker's symlink itself as pam_u2f's global authfile -- a file consulted by
sufficient lines in /etc/pam.d/sudo and /etc/pam.d/polkit-1.
The same move also carried the staged file's ownership into /etc, so on every
install to date /etc/fido2/fido2 is owned by the invoking user at mode 0644.
That needs no attacker, no race and no second account: anything running as that
uid can append its own credential and satisfy the machine's sudo prompt without
knowing the password.
The setup now creates a unique staging file as root beside the final authfile
and pipes pamu2fcfg into it, so root never reopens a caller-owned pathname,
rejects failed or empty enrollment output, publishes with an atomic mv -Tf,
cleans the exact staging file after every failure, refuses non-regular authfile
states, and installs root:root 0644. A migration repairs machines set up by
earlier versions by replacing the inode rather than chowning in place: a process
that already holds a writable descriptor on the legacy user-owned mapping keeps
it, so the repair has to leave that inode behind where PAM no longer reads it.
Clean cherry-pick: all six files are byte-identical to quattro, so merging
v4-0-1 into quattro resolves without a conflict. The migration's timestamp
(1787494718) is older than others already on this branch, which is harmless:
omarchy-migrate marks each migration by filename rather than tracking a
watermark, so this one runs on every machine that has not run this exact file.
test/shell passes: 195 files, including the three this adds -- the setup's
staging and failure paths, the migration's repair and unrepairable states, and
the removal's symlink handling. test/cli passes.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018DEMYa9UWtroz93DhMTtcV
117 lines
4.5 KiB
Bash
117 lines
4.5 KiB
Bash
echo "Take ownership of the FIDO2 authfile so it cannot be rewritten without root"
|
|
|
|
authfile="/etc/fido2/fido2"
|
|
|
|
# omarchy-migrate records this migration as complete whenever it exits zero, so
|
|
# a line printed here scrolls past once in the update terminal and is never
|
|
# shown again. The states below cannot be repaired without deciding what to do
|
|
# with a file we do not own, and they are exactly the ones where the authfile
|
|
# may already be under someone else's control, so say so where it outlives the
|
|
# scrollback as well.
|
|
report_unrepairable() {
|
|
echo " $1"
|
|
echo " $2"
|
|
omarchy-notification-send -u critical -g "FIDO2 authfile needs attention" "$1 $2" || true
|
|
}
|
|
|
|
# Nothing to repair on any machine that never set FIDO2 up, which is almost all
|
|
# of them. Checked before any sudo so those machines never see a password
|
|
# prompt. -L as well as -e: a dangling symlink is invisible to -e.
|
|
if [[ ! -L $authfile && ! -e $authfile ]]; then
|
|
# Absence and "cannot look" are the same answer to the tests above. The old
|
|
# setup created /etc/fido2 with `sudo mkdir -p`, which took the union of the
|
|
# caller's umask and sudoers' 0022, so anyone registering under `umask 077`
|
|
# left it mode 0700 with the user-owned authfile still inside. Escalate for
|
|
# that case alone -- a machine that never set FIDO2 up has no directory here
|
|
# and still reaches exit 0 without a password prompt. Not through a symlink:
|
|
# chmod would act on whatever it points at.
|
|
authdir=${authfile%/*}
|
|
|
|
if [[ -L $authdir || ! -d $authdir || -x $authdir ]]; then
|
|
exit 0
|
|
fi
|
|
|
|
# Ask root whether a registration is behind it before touching the directory
|
|
# itself. An aborted setup that left an empty 0700 directory, or one an
|
|
# administrator deliberately keeps private, must not have its mode widened
|
|
# and its group and special bits discarded for a repair it does not need.
|
|
if ! sudo test -e "$authfile" && ! sudo test -L "$authfile"; then
|
|
exit 0
|
|
fi
|
|
|
|
sudo chmod 755 "$authdir"
|
|
fi
|
|
|
|
# The old privileged move could install a symlink here if its fixed staging path
|
|
# was redirected. Reported, not repaired: chown follows symlinks and would take
|
|
# ownership of the target instead, and removing it would strip sudo and polkit
|
|
# from anyone whose only credential is the token.
|
|
if [[ -L $authfile ]]; then
|
|
report_unrepairable "$authfile is a symlink, not a regular file." \
|
|
"Leaving it alone. If you did not create it, remove it and re-run Setup > Security > Fido2."
|
|
exit 0
|
|
fi
|
|
|
|
# A directory or a device here is no more ours to rewrite than a symlink is,
|
|
# and changing a directory's mode would alter an object we do not own.
|
|
if [[ ! -f $authfile ]]; then
|
|
report_unrepairable "$authfile is not a regular file." \
|
|
"Leaving it alone. Remove it and re-run Setup > Security > Fido2."
|
|
exit 0
|
|
fi
|
|
|
|
# Migration state is per-user, so every account re-runs this. The file's own
|
|
# ownership is the state check: the second account finds the repair already
|
|
# done and exits without escalating.
|
|
owner=$(stat -c %U "$authfile" 2>/dev/null) || owner=""
|
|
group=$(stat -c %G "$authfile" 2>/dev/null) || group=""
|
|
mode=$(stat -c %a "$authfile" 2>/dev/null) || mode=""
|
|
if [[ $owner == "root" && $group == "root" && $mode == "644" ]]; then
|
|
exit 0
|
|
fi
|
|
|
|
# Setup used to `mv` this in from /tmp, which carried the invoking user's
|
|
# ownership into /etc. Root ownership stops that user from rewriting their own
|
|
# PAM credential without root. Mode 644 keeps the public credential mapping
|
|
# readable when pam_u2f opens an absolute authfile as the authenticating user.
|
|
#
|
|
# Rename a fresh copy over the path rather than chowning in place. A descriptor
|
|
# opened while the file was still the user's own stays writable on that inode
|
|
# through any later chmod or chown, since permission is checked at open(2), and
|
|
# pam_u2f resolving the path would keep landing on it. Replacing the inode
|
|
# leaves that descriptor writing to a file nothing reads.
|
|
stage=""
|
|
|
|
safe_stage_path() {
|
|
local candidate=$1
|
|
local prefix="$authfile.new."
|
|
local suffix
|
|
|
|
[[ $candidate == "$prefix"* ]] || return 1
|
|
suffix=${candidate#"$prefix"}
|
|
[[ $suffix =~ ^[[:alnum:]]{6}$ ]]
|
|
}
|
|
|
|
cleanup_stage() {
|
|
local status=$?
|
|
|
|
if safe_stage_path "$stage"; then
|
|
sudo rm -f -- "$stage" || true
|
|
fi
|
|
|
|
return "$status"
|
|
}
|
|
|
|
trap cleanup_stage EXIT
|
|
stage=$(sudo mktemp "$authfile.new.XXXXXX")
|
|
|
|
if ! safe_stage_path "$stage" || [[ ! -f $stage || -L $stage ]]; then
|
|
echo " Could not create a safe staging file beside $authfile."
|
|
exit 1
|
|
fi
|
|
|
|
sudo install -T -m 644 -o root -g root "$authfile" "$stage"
|
|
sudo mv -Tf "$stage" "$authfile"
|
|
stage=""
|
|
trap - EXIT
|