Repository navigation
fix(security): read --bridge-file with the caller's privileges (GHSA-wc5v-93m5-3vc6) - #107
Merged
Merged
Conversation
…wc5v-93m5-3vc6) `ttp start` runs as root and opened --bridge-file as root. Two ways a caller could read a root-only file through it, which matters wherever sudo is granted for `ttp` alone: - a rejected line was printed verbatim in the error; - a line whose first token merely contained ':' was accepted as a bridge - every line of /etc/shadow is - and written into the torrc. Now: - Under sudo or pkexec (SUDO_UID/PKEXEC_UID), the file is read by a child running `cat` as the caller, with the caller's primary and supplementary groups, so the kernel applies the caller's permissions and root never opens the path. A non-numeric caller id is refused rather than read as root. Root with no caller behind it (a root shell, systemd) reads directly: there is no lower identity to use. Files over 1 MiB or not UTF-8 are refused. - A bridge address must be <IPv4>:<port> or [<IPv6>]:<port> with a port in 1-65535, which is all Tor accepts in a Bridge line. - Errors name the line number, never the line. Verified for real in a container as root with SUDO_UID set: a 0600 root-only file is refused with the caller's "Permission denied", and the caller's own file is read. 22 new tests; coverage 99.86%. Affected: 0.4.5 to 0.4.10. Co-Authored-By: Claude Opus 5.5 <[email protected]> Signed-off-by: onyks-os <[email protected]>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes GHSA-wc5v-93m5-3vc6 (affects 0.4.5-0.4.10). The fix was prepared in the advisory's private fork; it lands here as a normal PR so it runs the full CI. The advisory will be published without a CVE once 0.4.11 is released.
The problem
ttp startruns as root and opened--bridge-fileas root. Two consequences::- every line of/etc/shadow- was accepted as a bridge and written into the torrc.Where sudo is granted for
ttpalone, that let the caller read root-only files.The fix
SUDO_UID/PKEXEC_UID, with the caller's groups), size-capped at 1 MiB and decoded as UTF-8. The kernel applies the caller's permissions; root never opens the path.ipaddress-validated, IPv6 in brackets).Verification
tests/test_bridge_file.py: shadow-style lines refused, malformed addresses refused, the read runs as the invoking user, errors carry no content.SUDO_UIDset: a root-only file is refused (Permission denied); the caller's own file is read.make lintclean, 1083 passed, coverage 99.83%.🤖 Generated with Claude Code