1998-10-17 00:00:00 +00:00
|
|
|
SECURITY ISSUES RELATED TO MTR
|
|
|
|
|
|
2016-12-22 15:28:29 +00:00
|
|
|
mtr invokes a sub-process, mtr-packet, which requires extra privileges
|
|
|
|
|
to send custom packets, and there are security implications from
|
|
|
|
|
granting this.
|
2015-10-01 17:28:10 +00:00
|
|
|
|
|
|
|
|
There are several different ways to provide the privileges:
|
|
|
|
|
|
|
|
|
|
1. Add limited privileges on systems that support this. (Preferred.)
|
|
|
|
|
2. Run mtr as the root user.
|
2016-12-22 15:28:29 +00:00
|
|
|
3. Make mtr-packet a setuid-root binary.
|
2015-10-01 17:28:10 +00:00
|
|
|
|
|
|
|
|
Details:
|
|
|
|
|
|
|
|
|
|
1. Add limited privileges on systems that support this.
|
|
|
|
|
|
|
|
|
|
Some operating systems allow binaries to be run with only the subset
|
|
|
|
|
of security privileges that are actually needed.
|
|
|
|
|
|
|
|
|
|
Linux:
|
|
|
|
|
On Linux, privileges are known as capabilities. The only additional
|
2016-12-22 15:28:29 +00:00
|
|
|
capability that mtr-packet needs is cap_net_raw. To give this
|
|
|
|
|
capability to the mtr-packet binary, run the following command as root:
|
2015-10-01 17:28:10 +00:00
|
|
|
|
2016-12-22 15:28:29 +00:00
|
|
|
# setcap cap_net_raw+ep mtr-packet
|
2015-10-01 17:28:10 +00:00
|
|
|
|
|
|
|
|
|
|
|
|
|
2. Run mtr as the root user.
|
|
|
|
|
|
1998-10-28 00:00:00 +00:00
|
|
|
You can limit mtr usage to the root user by not putting a setuid bit
|
2016-12-22 15:28:29 +00:00
|
|
|
on the mtr-packet binary. In that case, the security implications are
|
2015-10-01 17:28:10 +00:00
|
|
|
minimal.
|
1998-10-28 00:00:00 +00:00
|
|
|
|
|
|
|
|
|
2016-12-22 15:28:29 +00:00
|
|
|
3. Make mtr-packet a setuid-root binary.
|
2015-10-01 17:28:10 +00:00
|
|
|
|
2016-12-22 15:28:29 +00:00
|
|
|
The mtr-packet binary can be made setuid-root, which is what "make install"
|
2021-04-03 08:25:41 +00:00
|
|
|
does only if using setcap (above) fails. Using setcap is tried first.
|
2015-10-01 17:28:10 +00:00
|
|
|
|
2016-12-22 15:28:29 +00:00
|
|
|
When mtr-packet is installed as suid-root, some concern over security is
|
|
|
|
|
justified. mtr-packet does the following two things after it is launched:
|
1998-10-17 00:00:00 +00:00
|
|
|
|
2016-12-22 15:28:29 +00:00
|
|
|
* mtr-packet open sockets for sending raw packets and for receiving
|
|
|
|
|
ICMP packets.
|
|
|
|
|
* mtr-packet drops root privileges by setting the effective uid to
|
|
|
|
|
match uid or the user calling mtr.
|
2017-02-27 22:52:08 +00:00
|
|
|
* If capabilities support is available, mtr-packet drops all privileged
|
2016-12-25 17:26:34 +00:00
|
|
|
capabilities.
|
1998-10-17 00:00:00 +00:00
|
|
|
|
2016-12-22 15:28:29 +00:00
|
|
|
See main() in packet.c and init_net_state_privileged() in probe_unix.c
|
|
|
|
|
for the details of this process.
|
1998-10-17 00:00:00 +00:00
|
|
|
|
2016-12-22 15:28:29 +00:00
|
|
|
This should limit the possibilities of using mtr to breach system security.
|
|
|
|
|
The worst case scenario is as follows:
|
1998-10-17 00:00:00 +00:00
|
|
|
|
2016-12-22 15:28:29 +00:00
|
|
|
Due to some oversight in the mtr-packet code, a malicious user is able to
|
|
|
|
|
overrun one of mtr-packets's internal buffers with binary code that is
|
1998-10-17 00:00:00 +00:00
|
|
|
eventually executed. The malicious user is still not able to read
|
2016-12-22 15:28:29 +00:00
|
|
|
from or write to any system files other than those normally accessible
|
|
|
|
|
by the user running mtr. The only privileges gained are access to the raw
|
|
|
|
|
socket, which would allow the malicious user to listen to all ICMP packets
|
|
|
|
|
arriving at the system, and to send forged packets with arbitrary contents.
|
2013-02-05 15:56:38 +00:00
|
|
|
|
2015-10-01 17:28:10 +00:00
|
|
|
|
1998-10-17 00:00:00 +00:00
|
|
|
If you have further questions or comments about security issues,
|
2015-10-01 17:28:10 +00:00
|
|
|
please see the README file for details on how to submit them.
|
