| From 4f9ab4957682e19bcee3806d3ed4bee7f46fab1f Mon Sep 17 00:00:00 2001 |
| From: Mattias Nissler <mnissler@chromium.org> |
| Date: Mon, 15 Jun 2020 14:53:35 +0200 |
| Subject: [PATCH] 50-udev-default.rules: Disable REMOVE_CMD support |
| |
| There is a default udev rule that executes commands from the REMOVE_CMD |
| environment variable if present. This is risky since an attacker with a root |
| file write primtive can mess with udev state in /run/udev/data to inject a |
| REMOVE_CMD. The attacker will then get command execution as root when the |
| respective device gets removed. Chrome OS doesn't use that rule (it previously |
| did in 2 places, but these have been changed), disable REMOVE_CMD |
| functionality. |
| |
| --- |
| rules/50-udev-default.rules | 3 ++- |
| 1 file changed, 2 insertions(+), 1 deletion(-) |
| |
| --- a/rules/50-udev-default.rules |
| +++ b/rules/50-udev-default.rules |
| @@ -1,7 +1,8 @@ |
| # do not edit this file, it will be overwritten on update |
| |
| # run a command on remove events |
| -ACTION=="remove", ENV{REMOVE_CMD}!="", RUN+="$env{REMOVE_CMD}" |
| +# Disabled on Chrome OS due to privilege escalation risk (see crbug/1072486) |
| +# ACTION=="remove", ENV{REMOVE_CMD}!="", RUN+="$env{REMOVE_CMD}" |
| ACTION=="remove", GOTO="default_end" |
| |
| SUBSYSTEM=="virtio-ports", KERNEL=="vport*", ATTR{name}=="?*", SYMLINK+="virtio-ports/$attr{name}" |
| -- |
| 2.26.2 |
| |
