SUID Disabler and Permission Hardener

Development
,
35

set-user-id set-group-id found - file_name: ‘/usr/lib/xorg/Xorg.wrap’

Needed?

At first sight looks important. But Debian / systemd might not use / need it.

Not yet tested. Can’t find anything online what these are used for. Testing this can be future work.

security-misc isn’t just used by Whonix. I don’t want to break VirtualBox (hosts) for those who install security-misc or Kicksecure.

Will add.

1 Like
36

No, Debian and many other linux distros use Xorg rootless by default so there’s no need for the suid wrapper unless the user themselves has configured X to run as root for whatever reason (which is a security risk due to X’s large attack surface).

1 Like
37

We can use this to remove capabilities of some unneeded binaries too by using the none capability rule.

getcap -r / 2>/dev/null

/usr/lib/x86_64-linux-gnu/gstreamer1.0/grstreamer-1.0/gst-ptp-helper = cap_net_bind_service,cap_net_admin+ep
/bin/ping = cap_net_raw+ep

I think we should remove the capabilities of /bin/ping since it doesn’t work with Tor anyway.

1 Like
38

We can add Whonix specific things such as ping capability removal to anon-apps-config package as a drop- snippet.

Pull requests welcome.

1 Like
39
1 Like
40

This is now in the developers repository. Enabling it will be easy.

sudo systemctl enable permission-hardening.service

It might be enabled by default one day (similar to Restrict Hardware Information to Root - Testers Wanted!) but it needs a fair amount of testing as I am running into many issues here.

We’ll also need some way to record changes and to undo these.

Breaks whonix-firewall.

Dec 21 06:43:54 host enable-firewall[351]: iptables/1.8.2 Failed to initialize nft: Protocol not supported

1 Like
41

dpkg-statoverride --list has only limited usefulness for this since Debian itself uses these. There is no way to distinguish which were added by Debian and which by permission hardening.

This is done. security-misc: Enhance Miscellaneous Security Settings documents how to enable this feature, how to view what was changed and how to undo and disable this feature.

1 Like
42

It didn’t break those when I tested it and I have no idea why it would break those. Are you sure this isn’t something else?

AppArmor and whonix-firewall run as root anyway.

1 Like
43 
sudo setcap -r /bin/ping ; echo $?

Failed to set capabilities on file `/bin/ping’ (No data available)
The value of the capability argument is not permitted for a file. Or the file is not a regular (non-symlink) file
1

1 Like
44

Weird. It works fine for me.

The only way I can reproduce this is by making /bin/ping suid first. Is your /bin/ping suid?

1 Like
45

No.

sudo stat -c "%n %a %U %G" /bin/ping

/bin/ping 755 root root

sudo setcap -r /bin/ping ; echo $?

Failed to set capabilities on file `/bin/ping’ (No data available)
The value of the capability argument is not permitted for a file. Or the file is not a regular (non-symlink) file
1

But capabilities (was there before) are removed.

sudo getcap /bin/ping ; echo $?

0

The problem is the error message and non-zero exit code. Output could be redirected to /dev/null and non-zero exit could code be ignored but that would break error checking.

1 Like
46

Any reason to whitelist /lib/dbus-1.0/dbus-daemon-launch-helper?

existing mode:

root messagebus 4754 /lib/dbus-1.0/dbus-daemon-launch-helper

47

We don’t want to break dbus.

1 Like
48

I’ve documented SUID / SGID that we will be breaking by default when permission hardening gets enabled:

security-misc: Enhance Miscellaneous Security Settings

1 Like
49
1 Like
50
1 Like
51

madaidan via Whonix Forum:

What’s the point of reading binaries if it can’t even be executed? Maybe just give a mode of 700.

Making the minimal change required for security. Keeping things simple.
Making it easier for users to restore to defaults.

1 Like
52

madaidan via Whonix Forum:

We can use this to remove capabilities of some unneeded binaries too by using the none capability rule.

getcap -r / 2>/dev/null

/usr/lib/x86_64-linux-gnu/gstreamer1.0/grstreamer-1.0/gst-ptp-helper = cap_net_bind_service,cap_net_admin+ep
/bin/ping = cap_net_raw+ep

I think we should remove the capabilities of /bin/ping since it doesn’t work with Tor anyway.

Good idea. We already support:

/usr/bin/ nosuid

Should we add another feature

/ nocap

?

Or should we just
/usr/lib/x86_64-linux-gnu/gstreamer1.0/grstreamer-1.0/gst-ptp-helper
set to nocap and consider that good enough?

Capability removal only works until package upgrade since
dpkg-statoverwrite does not support capabilities. Feature request:

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=502580

1 Like
53

Only 2 things have capabilities by default anyway so that’s not really needed.

1 Like
54
1 Like