hasher-priv(8)

HASHER-PRIV(8)

System Administration Utilities

HASHER-PRIV(8)

NAME

hasher-priv - privileged helper for the hasher project

SYNOPSIS

hasher-priv [options] <args>

DESCRIPTION

Privileged helper for the hasher project.

Valid options are:

-<number>:

: subconfig identifier;

--version:

: print program version and exit.

-h or --help:

: print this help text and exit.

Valid args are any of:

getconf:

: print config file name;

killuid:

: kill all processes of user1 and user2;

getugid1:

: print uid:gid pair for user1;

chrootuid1 <chroot path> <program> [program args]:

: execute program in given chroot with credentials of user1;

getugid2:

: print uid:gid pair for user2;

chrootuid2 <chroot path> <program> [program args]:

: execute program in given chroot with credentials of user2;

SECURITY

Following operation modes are not security sensitive:

getugid1, getugid2: Query pseudouser identifiers.

Following operation modes have minimal security implications:

killuid: Kill all processes running by pseudousers.

Following operation modes have high security implications:

chrootuid1, chrootuid2

Execute program in build chroot with credentials of pseudouser.

This operation also unshares mount namespace and mounts all mount points that are specified by requested_mountpoints environment variable and allowed by allowed_devices or allowed_mountpoints configuration options. Note that some of file systems are more security sensitive than others. For example, proc and sysfs virtual file systems provide access to various system resources which could be abused by pseudousers, devpts virtual file system provides access to all pty device files (unless mounted with newinstance mount option) which also could be abused by pseudousers if these files have inappropriate permissions.

This operation also creates essential device files available for all users: null, zero, full, and urandom. Pseudousers may abuse urandom to cause host system randomness starvation.

If /dev/pts is mounted, this operation also creates terminal device files: tty (current tty device) and ptmx (PTY master multiplex).

All risky operation modes are not enabled by default. They could be explicitly enabled in hasher-priv configuration.

ENVIRONMENT

The following environment variables are processed by hasher-priv:

requested_mountpoints: Defines a comma-separated list of mount points which shall be mounted in chrootuid1 and chrootuid2 operation modes, if allowed by allowed_devices or allowed_mountpoints configuration options.
wlimit_time_elapsed: Define total execution time limit, in seconds. If wlimit_time_elapsed config parameter is also set, then minimal value will be used.
wlimit_time_idle: Define idle time limit, in seconds. Idle time is a period when child process produces no output. If wlimit_time_idle config parameter is also set, then minimal value will be used.
wlimit_bytes_written: Define limit of output generated by child process, in bytes. If wlimit_bytes_written config parameter is also set, then minimal value will be used.
use_pty: This boolean specifies whether stdin, stdout and stderr of child process will be redirected to controlling pseudoterminal created by hasher-priv. By default, stdin remains unchanged unless it references to terminal device, and stdout with stderr are redirected to pipe created by hasher-priv.
share_ipc: This boolean specifies whether IPC namespace inside chroot should be shared with host IPC namespace. By default, IPC namespace inside chroot is isolated from host IPC namespace if unshare(CLONE_NEWIPC) syscall is supported by kernel.
share_network: This boolean specifies whether network inside chroot should be shared with host network. By default, network inside chroot is isolated from host network if unshare(CLONE_NEWNET) syscall is supported by kernel.
share_uts: This boolean specifies whether UTS namespace inside chroot should be shared with host UTS namespace. By default, UTS namespace inside chroot is isolated from host UTS namespace if unshare(CLONE_NEWUTS) syscall is supported by kernel.
TERM: This variable will be passed to child process if use_pty is set to true.

FILES

/etc/hasher-priv/system: systemwide config file
/etc/hasher-priv/user.d/USER: per-user config files
/etc/hasher-priv/user.d/USER:NUMBER: per-user per-number subconfig files

AUTHOR

Written by Dmitry V. Levin <ldv@altlinux.org> et al.

COPYRIGHT

This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.