Bug 107436 - regression in CVE-2018-1116 fix: brltty gets "process with PID xxx has been replaced"
Summary: regression in CVE-2018-1116 fix: brltty gets "process with PID xxx has been r...
Status: RESOLVED INVALID
Alias: None
Product: PolicyKit
Classification: Unclassified
Component: daemon (show other bugs)
Version: unspecified
Hardware: Other All
: medium normal
Assignee: David Zeuthen (not reading bugmail)
QA Contact: David Zeuthen (not reading bugmail)
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2018-07-31 09:00 UTC by Simon McVittie
Modified: 2018-08-01 16:37 UTC (History)
1 user (show)

See Also:
i915 platform:
i915 features:


Attachments

Description Simon McVittie 2018-07-31 09:00:58 UTC
https://bugs.launchpad.net/ubuntu/+source/policykit-1/+bug/1782320
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=905058

Steps to reproduce:

Install an Ubuntu 18.04 or Debian unstable system and start brltty by hand as root with:

  sudo brltty -b no

then try to connect to it as normal logged-in user through brlapi:

  python3
  >>> import brlapi
  >>> b = brlapi.Connection()

Expected result: No exception

Actual result: Authorization fails

Logs can be seen in /var/log/syslog (unfortunately the current package source code only prints errno instead of the GError). Printing the GError (possibly with a modified brltty, I'm not sure how the reporter did this) shows an error like:

GDBus.Error:org.freedesktop.PolicyKit1.Error.Failed: process with PID 12570 has been replaced
Comment 1 Samuel Thibault 2018-07-31 09:05:01 UTC
Yes, I had to modify brltty to get the GError printed (now also commited in upstream's git clone https://github.com/brltty/brltty.git, as 34ac4edc69)
Comment 2 Miloslav Trmac 2018-07-31 10:00:27 UTC
Thanks for your report.

Is the client this code? https://github.com/brltty/brltty/blob/34ac4edc698da1507453b4e3c87ed1713daec304/Programs/auth.c#L513-L525
>     PolkitSubject *subject = polkit_unix_process_new_for_owner(cred.pid, -1, cred.uid);

The second parameter of polkit_unix_process_new_for_owner is documented to interpret 0 as "look it up in /proc"; -1 is interpreted as an actual startup time, and obviously does not match.

Can you try replacing the -1 with 0, please?
Comment 3 Samuel Thibault 2018-07-31 10:38:44 UTC
That seems to be fixing it, I'll check in more details.
Comment 4 Samuel Thibault 2018-08-01 16:11:22 UTC
Ok, that fixes it. I wonder how -1 got in there.
Comment 5 Samuel Thibault 2018-08-01 16:11:40 UTC
Thanks for the hint!
Comment 6 Miloslav Trmac 2018-08-01 16:37:17 UTC
(In reply to Samuel Thibault from comment #4)
> Ok, that fixes it. I wonder how -1 got in there.

The _other_ parameter uses -1 to say “unknown”, so the API is admittedly pretty easy to misuse.


Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.