Bug#633582: initramfs-tools: All files in initrd owned by root

July 11th, 2011 - 05:10 pm ET by Mandos Maintainers | Report spam

Package: initramfs-tools
Version: 0.99
Severity: normal
Tags: patch

All files in initramfs are now forcibly changed to be owned by root.
This breaks mandos-client. Patch attached.

-rw-r-- 1 root root 13M Jul 11 22:39 /boot/initrd.img-2.6.38-2-amd64
-rw-r-- 1 root root 13M Jul 11 22:38 /boot/initrd.img-2.6.39-2-amd64
BOOT_IMAGE=/vmlinuz-2.6.39-2-amd64 root=/dev/mapper/braxen-root ro quiet nosplash

RESUME=/dev/mapper/braxen-swap
ext3
ext2
fuseblk

Module Size Used by
microcode 25751 0
acpi_cpufreq 12849 1
mperf 12411 1 acpi_cpufreq
cpufreq_powersave 12454 0
cpufreq_userspace 12576 0
cpufreq_stats 12713 0
cpufreq_conservative 13147 0
parport_pc 22191 0
ppdev 12725 0
lp 17190 0
parport 31650 3 parport_pc,ppdev,lp
bnep 17424 2
rfcomm 32744 0
bluetooth 107224 10 bnep,rfcomm
crc16 12343 1 bluetooth
binfmt_misc 12914 1
uinput 17392 1
fuse 61554 1
ext2 62796 1
coretemp 12784 0
firewire_sbp2 17825 0
loop 22479 0
kvm_intel 49912 0
kvm 263518 1 kvm_intel
snd_hda_codec_si3054 12758 1
snd_hda_codec_realtek 283734 1
joydev 17138 0
arc4 12458 2
ecb 12737 2
snd_hda_intel 25946 3
snd_hda_codec 67865 3 snd_hda_codec_si3054,snd_hda_codec_realtek,snd_hda_intel
snd_hwdep 13148 1 snd_hda_codec
iwl4965 87242 0
snd_pcm_oss 40662 0
snd_mixer_oss 17905 1 snd_pcm_oss
snd_pcm 67276 4 snd_hda_codec_si3054,snd_hda_intel,snd_hda_codec,snd_pcm_oss
iwl_legacy 51958 1 iwl4965
snd_seq_midi 12848 0
snd_rawmidi 22963 1 snd_seq_midi
mac80211 181270 2 iwl4965,iwl_legacy
snd_seq_midi_event 13316 1 snd_seq_midi
snd_seq 44678 2 snd_seq_midi,snd_seq_midi_event
cfg80211 126244 3 iwl4965,iwl_legacy,mac80211
snd_timer 22658 2 snd_pcm,snd_seq
snd_seq_device 13155 3 snd_seq_midi,snd_rawmidi,snd_seq
psmouse 55199 0
serio_raw 12878 0
snd 52324 18 snd_hda_codec_si3054,snd_hda_codec_realtek,snd_hda_intel,snd_hda_codec,snd_hwdep,snd_pcm_oss,snd_mixer_oss,snd_pcm,snd_rawmidi,snd_seq,snd_timer,snd_seq_device
soundcore 13014 1 snd
snd_page_alloc 12969 2 snd_hda_intel,snd_pcm
compal_laptop 13995 0
evdev 17475 13
rfkill 19014 5 bluetooth,cfg80211,compal_laptop
i2c_i801 16870 0
ac 12624 0
battery 13109 0
processor 27431 3 acpi_cpufreq
power_supply 13475 3 compal_laptop,ac,battery
wmi 13202 0
pcspkr 12579 0
ext3 112254 1
jbd 41698 1 ext3
mbcache 12930 2 ext2,ext3
sha256_generic 16797 2
cryptd 14463 0
aes_x86_64 16796 4
aes_generic 37122 1 aes_x86_64
cbc 12747 2
dm_crypt 22257 1
dm_mirror 17514 0
dm_region_hash 13256 1 dm_mirror
dm_log 13517 2 dm_mirror,dm_region_hash
dm_mod 62468 11 dm_crypt,dm_mirror,dm_log
sg 25769 0
sd_mod 35644 3
sr_mod 21824 0
cdrom 35134 1 sr_mod
crc_t10dif 12348 1 sd_mod
ata_generic 12479 0
uhci_hcd 26290 0
i915 329754 2
sdhci_pci 13184 0
drm_kms_helper 26950 1 i915
ata_piix 25319 2
drm 166500 3 i915,drm_kms_helper
sdhci 21685 1 sdhci_pci
tg3 109263 0
libata 151572 2 ata_generic,ata_piix
ehci_hcd 39487 0
firewire_ohci 35027 0
mmc_core 58824 1 sdhci
i2c_algo_bit 12834 1 i915
i2c_core 23766 5 i2c_i801,i915,drm_kms_helper,drm,i2c_algo_bit
firewire_core 47790 2 firewire_sbp2,firewire_ohci
video 17553 1 i915
scsi_mod 161557 5 firewire_sbp2,sg,sd_mod,sr_mod,libata
crc_itu_t 12347 1 firewire_core
button 12895 1 i915
usbcore 127203 3 uhci_hcd,ehci_hcd
thermal_sys 17939 2 processor,video
libphy 18759 1 tg3

i915 modeset=1

# Kernel image management overrides
# See kernel-img.conf(5) for details
do_symlinks = yes
relative_links = yes
do_bootloader = no
do_bootfloppy = no
do_initrd = yes
link_in_boot = no

MODULES=most
BUSYBOX=y
KEYMAP=n
COMPRESS=gzip
BOOT=local
DEVICE=eth0
NFSROOT=auto

update_initramfs=yes
backup_initramfs=no

# sda5_crypt /dev/sda5 none luks
sda5_crypt UUID=78b0a63f-0811-48f7-8e9a-471693e30c8f none luks

/etc/initramfs-tools/hooks/:

/usr/share/initramfs-tools/hooks:
busybox
cryptgnupg
cryptkeyctl
cryptopenct
cryptopensc
cryptpassdev
cryptroot
dmraid
dmsetup
keymap
klibc
loopaes
lvm2
mandos
mandos.~1~
mandos.~2~
plymouth
thermal
udev


Debian Release: wheezy/sid
APT prefers oldstable
APT policy: (500, 'oldstable'), (500, 'unstable'), (50, 'experimental')
Architecture: amd64 (x86_64)

Kernel: Linux 2.6.39-2-amd64 (SMP w/2 CPU cores)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/bash

Versions of packages initramfs-tools depends on:
ii cpio 2.11-7 GNU cpio -- a program to manage ar
ii findutils 4.4.2-1+b1 utilities for finding files--find,
ii klibc-utils 1.5.22-1 small utilities built with klibc f
ii module-init-tools 3.16-1 tools for managing Linux kernel mo
ii udev 171-2 /dev/ and hotplug management daemo

Versions of packages initramfs-tools recommends:
ii busybox 1:1.18.4-2 Tiny utilities for small and embed

Versions of packages initramfs-tools suggests:
ii bash-completion 1:1.3-1 programmable completion for the ba

/etc/initramfs-tools/initramfs.conf changed [not included]


/Teddy Hogeborn & Björn Pà¥hlsson

The Mandos Project
http://www.fukt.bsnet.se/mandos



diff -u /usr/sbin/mkinitramfs.~1~ /usr/sbin/mkinitramfs
/usr/sbin/mkinitramfs.~1~
+++ /usr/sbin/mkinitramfs
@@ -321,7 +321,7 @@
[ "${verbose}" = y ] && echo "Building cpio ${outfile} initramfs"
(
# work around lack of "set -o pipefail" for the following pipe:
-# cd "${DESTDIR}" && find . | cpio --quiet -R 0:0 -o -H newc | gzip >"${outfile}" || exit 1
+# cd "${DESTDIR}" && find . | cpio --quiet -o -H newc | gzip >"${outfile}" || exit 1
exec 3>&1
eval `
# http://cfaj.freeshell.org/shell/cus-faq-2.html
@@ -330,7 +330,7 @@
{
find . 4>&-; echo "ec1=$?;" >&4
} | {
- cpio --quiet -R 0:0 -o -H newc 4>&-; echo "ec2=$?;" >&4
+ cpio --quiet -o -H newc 4>&-; echo "ec2=$?;" >&4
} | ${compress} >"${outfile}"
echo "ec3=$?;" >&4
`





To UNSUBSCRIBE, email to debian-bugs-dist-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org
email Follow the discussionReplies 3 repliesReplies Make a reply

Similar topics

Replies

#1 maximilian attems
July 11th, 2011 - 05:40 pm ET | Report spam
tags 633582 -patch +moreinfo
Thanks

No, please patch is a git patch not a patch with a radom user path,
see documentation
http://anonscm.debian.org/gitweb/?p...ml;hb=HEAD

On Mon, Jul 11, 2011 at 11:03:34PM +0200, Mandos Maintainers wrote:
Package: initramfs-tools
Version: 0.99
Severity: normal
Tags: patch



All files in initramfs are now forcibly changed to be owned by root.
This breaks mandos-client. Patch attached.



what the hack is "mandos"?
care to give a short intro and usage purpose that it may break?

i915 modeset=1



sugar, it shouldn't be necessary.

/usr/share/initramfs-tools/hooks:


..
mandos
mandos.~1~
mandos.~2~



hmm?

diff -u /usr/sbin/mkinitramfs.~1~ /usr/sbin/mkinitramfs
/usr/sbin/mkinitramfs.~1~
+++ /usr/sbin/mkinitramfs



wrong path, see explanation aboves?
@@ -321,7 +321,7 @@
[ "${verbose}" = y ] && echo "Building cpio ${outfile} initramfs"
(
# work around lack of "set -o pipefail" for the following pipe:
-# cd "${DESTDIR}" && find . | cpio --quiet -R 0:0 -o -H newc | gzip >"${outfile}" || exit 1
+# cd "${DESTDIR}" && find . | cpio --quiet -o -H newc | gzip >"${outfile}" || exit 1



similar as dracut.

exec 3>&1
eval `
# http://cfaj.freeshell.org/shell/cus-faq-2.html
@@ -330,7 +330,7 @@
{
find . 4>&-; echo "ec1=$?;" >&4
} | {
- cpio --quiet -R 0:0 -o -H newc 4>&-; echo "ec2=$?;" >&4
+ cpio --quiet -o -H newc 4>&-; echo "ec2=$?;" >&4
} | ${compress} >"${outfile}"
echo "ec3=$?;" >&4
`




thank you.

maks




To UNSUBSCRIBE, email to
with a subject of "unsubscribe". Trouble? Contact
Replies Reply to this message
#2 Mandos Maintainers
July 11th, 2011 - 06:30 pm ET | Report spam

tags 633582 +patch -moreinfo
stop

Converted patch to Git format; it is attached.

what the hack is "mandos"?



Description: do unattended reboots with an encrypted root file system
<http://packages.debian.org/en/stabl...client>

care to give a short intro and usage purpose that it may break?



It is a network-using security-related program. Best practices dictate
that it runs with lowest possible privileges at all times; i.e. not as
root. It has some files which it needs to read, but which also must be
unreadable by any other non-root process. These files are therefore
mode 0600 and owned by its own non-root user. When mkinitramfs changes
the files to be owned by root, the unprivileged process can no longer
read the files.

similar as dracut.



Does dracut also inhibit creation of non-root files in the initramfs?
Do you know the rationale for this?

/Teddy Hogeborn & Björn Pà¥hlsson

The Mandos Project
http://www.fukt.bsnet.se/mandos

filename01-Signed-off-by-Bj-rn-P-hlsson-belorn-recompile.se.patch

From a926cb036f4430b64b4c565ac3bf13831eceed54 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Björn=20Påhlsson?=
Date: Mon, 11 Jul 2011 23:53:46 +0200
Subject: [PATCH] =?UTF-8?q?Signed-off-by:=20Björn=20Påhlsson=20<be?=
MIME-Version: 1.0

Don't force file ownership to root.

Signed-off-by: Björn Pà¥hlsson

diff --git a/mkinitramfs b/mkinitramfs
index de061d7..82c0a91 100755
a/mkinitramfs
+++ b/mkinitramfs
@@ -316,7 +316,7 @@ fi
[ "${verbose}" = y ] && echo "Building cpio ${outfile} initramfs"
(
# work around lack of "set -o pipefail" for the following pipe:
-# cd "${DESTDIR}" && find . | cpio --quiet -R 0:0 -o -H newc | gzip >"${outfile}" || exit 1
+# cd "${DESTDIR}" && find . | cpio --quiet -o -H newc | gzip >"${outfile}" || exit 1
exec 3>&1
eval `
# http://cfaj.freeshell.org/shell/cus-faq-2.html
@@ -325,7 +325,7 @@ eval `
{
find . 4>&-; echo "ec1=$?;" >&4
} | {
- cpio --quiet -R 0:0 -o -H newc 4>&-; echo "ec2=$?;" >&4
+ cpio --quiet -o -H newc 4>&-; echo "ec2=$?;" >&4
} | ${compress} >"${outfile}"
echo "ec3=$?;" >&4
`
1.7.5.4





To UNSUBSCRIBE, email to
with a subject of "unsubscribe". Trouble? Contact
Replies Reply to this message
#3 Mandos Maintainers
July 11th, 2011 - 06:30 pm ET | Report spam

tags 633582 +patch -moreinfo
stop

Converted patch to Git format; it is attached.

what the hack is "mandos"?



Description: do unattended reboots with an encrypted root file system
<http://packages.debian.org/en/stabl...client>

care to give a short intro and usage purpose that it may break?



It is a network-using security-related program. Best practices dictate
that it runs with lowest possible privileges at all times; i.e. not as
root. It has some files which it needs to read, but which also must be
unreadable by any other non-root process. These files are therefore
mode 0600 and owned by its own non-root user. When mkinitramfs changes
the files to be owned by root, the unprivileged process can no longer
read the files.

similar as dracut.



Does dracut also inhibit creation of non-root files in the initramfs?
Do you know the rationale for this?

/Teddy Hogeborn & Björn Pà¥hlsson

The Mandos Project
http://www.fukt.bsnet.se/mandos

filename01-Signed-off-by-Bj-rn-P-hlsson-belorn-recompile.se.patch

From a926cb036f4430b64b4c565ac3bf13831eceed54 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Björn=20Påhlsson?=
Date: Mon, 11 Jul 2011 23:53:46 +0200
Subject: [PATCH] =?UTF-8?q?Signed-off-by:=20Björn=20Påhlsson=20<be?=
MIME-Version: 1.0

Don't force file ownership to root.

Signed-off-by: Björn Pà¥hlsson

diff --git a/mkinitramfs b/mkinitramfs
index de061d7..82c0a91 100755
a/mkinitramfs
+++ b/mkinitramfs
@@ -316,7 +316,7 @@ fi
[ "${verbose}" = y ] && echo "Building cpio ${outfile} initramfs"
(
# work around lack of "set -o pipefail" for the following pipe:
-# cd "${DESTDIR}" && find . | cpio --quiet -R 0:0 -o -H newc | gzip >"${outfile}" || exit 1
+# cd "${DESTDIR}" && find . | cpio --quiet -o -H newc | gzip >"${outfile}" || exit 1
exec 3>&1
eval `
# http://cfaj.freeshell.org/shell/cus-faq-2.html
@@ -325,7 +325,7 @@ eval `
{
find . 4>&-; echo "ec1=$?;" >&4
} | {
- cpio --quiet -R 0:0 -o -H newc 4>&-; echo "ec2=$?;" >&4
+ cpio --quiet -o -H newc 4>&-; echo "ec2=$?;" >&4
} | ${compress} >"${outfile}"
echo "ec3=$?;" >&4
`
1.7.5.4





To UNSUBSCRIBE, email to
with a subject of "unsubscribe". Trouble? Contact
email Follow the discussion Replies Reply to this message
Help Create a new topicReplies Make a reply
Search Make your own search