Security issue CVE-2024-2905: World-readable /etc/shadow & /etc/gshadow on Fedora CoreOS, IoT, Atomic Desktops (including Silverblue & Kinoite) (discussion.fedoraproject.org)
from joojmachine@lemmy.ml to linux@lemmy.ml on 10 Apr 2024 17:03
https://lemmy.ml/post/14295584

Just a heads-up for the newer Fedora Atomic users out there, and a focus on this part for the longer-term users:

This only impacts new installations and not updated systems thus systems installed from artifacts before those releases are not impacted (Fedora 38 or earlier).

#linux

threaded - newest

barbara@lemmy.ml on 10 Apr 2024 17:20 collapse

Isn’t selinux enabled by default? Hence, most won’t be affected.

On systems with SELinux enabled and in enforcing mode, access to those files is limited to unconfined (usually interactive) users, unconfined systemd services and privileged containers. Confined daemons, users and containers are not able to access them.

dsemy@lemm.ee on 10 Apr 2024 17:46 next collapse

I’m not sure you’re right, I can’t find information regarding whether users are confined by default on Fedora (Red Hat docs seem to indicate the users are unconfined by default).

Edit: They are not, see docs.fedoraproject.org/…/selinux-getting-started/…, specifically:

SELinux can confine Linux users. A number of confined SELinux users exist in SELinux policy. Linux users can be mapped to confined SELinux users to take advantage of the security rules and mechanisms applied to them. For example, mapping a Linux user to the SELinux user_u user, results in a Linux user that is not able to run (unless configured otherwise) set user ID (setuid) applications, such as sudo and su, as well as preventing them from executing files and applications in their home directory. If configured, this prevents users from executing malicious files from their home directories.

Bitrot@lemmy.sdf.org on 10 Apr 2024 22:51 collapse

ls -Z in any user home will show they are unconfined_u (so will id -Z).