Do you have SELinux enabled on your Web Server? Lots of people are asking me about SELinux and the Bash Exploit.
I did a quick analysis on one reported remote Apache exploit:
http://www.reddit.com/r/netsec/comments/2hbxtc/cve20146271_remote_code_execution_through_bash/
Shows an example of the bash exploit on an apache server. It even shows that SELinux was enforcing when the exploit happened.
SELinux does not block the exploit but it would prevent escallation of confined domains.
Why didn't SELinux block it?
SELinux controls processes based on their types, if the process is doing what it was designed to do then SELinux will not block it.
In the defined exploit the apache server is running as httpd_t and it is executing a cgi script which would be labeled httpd_sys_script_exec_t.
When httpd_t executes a script labeled httpd_sys_script_exec_t SELinux will transition the new process to httpd_sys_script_t.
SELinux policy allowd processes running as httpd_sys_script_t is to write to /tmp, so it was successfull in creating /tmp/aa.
If you did this and looked at the content in /tmp it would be labeled httpd_tmp_t
httpd_tmp_t.
Lets look at which files httpd_sys_script_t is allowed to write to on my Rawhide box.
# sesearch -A -s httpd_sys_script_t -c file -p write -C | grep open | grep -v ^D
allow httpd_sys_script_t httpd_sys_rw_content_t : file { ioctl read write create getattr setattr lock append unlink link rename open } ;
allow httpd_sys_script_t anon_inodefs_t : file { ioctl read write getattr lock append open } ;
allow httpd_sys_script_t httpd_sys_script_t : file { ioctl read write getattr lock append open } ;
allow httpd_sys_script_t httpd_tmp_t : file { ioctl read write create getattr setattr lock append unlink link rename open } ;
httpd_sys_script_t is a process label which only applies to content in /proc. This means processes running as httpd_sys_script_t can write to there process data.
anon_inodefs_t is an in memory label, most likely not on your disk.
The only on disk places it can write files labeled httpd_sys_rw_content_t and /tmp.
grep httpd_sys_rw_content_t /etc/selinux/targeted/contexts/files/file_contexts
or on my box
# find /etc -context "*:httpd_sys_rw_content_t:*"
/etc/BackupPC
/etc/BackupPC/config.pl
/etc/BackupPC/hosts
/etc/glpi
With SELinux disabled, this hacked process would be allowed to write any content that is world writable on your system as well as any content owned by the apache user or group.
Lets look at what it can read.
sesearch -A -s httpd_sys_script_t -c file -p read -C | grep open | grep -v ^D | grep -v exec_t
allow domain locale_t : file { ioctl read getattr lock open } ;
allow httpd_sys_script_t iso9660_t : file { ioctl read getattr lock open } ;
allow httpd_sys_script_t httpd_sys_ra_content_t : file { ioctl read create getattr lock append open } ;
allow httpd_sys_script_t httpd_sys_rw_content_t : file { ioctl read write create getattr setattr lock append unlink link rename open } ;
allow httpd_sys_script_t squirrelmail_spool_t : file { ioctl read getattr lock open } ;
allow domain ld_so_t : file { ioctl read getattr execute open } ;
allow httpd_sys_script_t anon_inodefs_t : file { ioctl read write getattr lock append open } ;
allow httpd_sys_script_t sysctl_kernel_t : file { ioctl read getattr lock open } ;
allow domain base_ro_file_type : file { ioctl read getattr lock open } ;
allow httpd_sys_script_t httpd_sys_script_t : file { ioctl read write getattr lock append open } ;
allow nsswitch_domain cert_t : file { ioctl read getattr lock open } ;
allow httpd_script_type etc_runtime_t : file { ioctl read getattr lock open } ;
allow httpd_script_type fonts_cache_t : file { ioctl read getattr lock open } ;
allow domain mandb_cache_t : file { ioctl read getattr lock open } ;
allow domain abrt_t : file { ioctl read getattr lock open } ;
allow domain lib_t : file { ioctl read getattr lock execute open } ;
allow domain man_t : file { ioctl read getattr lock open } ;
allow httpd_sys_script_t cifs_t : file { ioctl read getattr lock execute execute_no_trans entrypoint open } ;
allow domain sysctl_vm_overcommit_t : file { ioctl read getattr lock open } ;
allow httpd_sys_script_t nfs_t : file { ioctl read getattr lock execute execute_no_trans entrypoint open } ;
allow kernel_system_state_reader proc_t : file { ioctl read getattr lock open } ;
allow nsswitch_domain passwd_file_t : file { ioctl read getattr lock open } ;
allow nsswitch_domain sssd_public_t : file { ioctl read getattr lock open } ;
allow domain cpu_online_t : file { ioctl read getattr lock open } ;
allow httpd_script_type public_content_rw_t : file { ioctl read getattr lock open } ;
allow nsswitch_domain etc_runtime_t : file { ioctl read getattr lock open } ;
allow nsswitch_domain hostname_etc_t : file { ioctl read getattr lock open } ;
allow domain ld_so_cache_t : file { ioctl read getattr lock open } ;
allow nsswitch_domain sssd_var_lib_t : file { ioctl read getattr lock open } ;
allow httpd_script_type public_content_t : file { ioctl read getattr lock open } ;
allow nsswitch_domain krb5_conf_t : file { ioctl read getattr lock open } ;
allow domain abrt_var_run_t : file { ioctl read getattr lock open } ;
allow domain textrel_shlib_t : file { ioctl read getattr execute execmod open } ;
allow httpd_sys_script_t httpd_tmp_t : file { ioctl read write create getattr setattr lock append unlink link rename open } ;
allow domain machineid_t : file { ioctl read getattr lock open } ;
allow httpd_sys_script_t mysqld_etc_t : file { ioctl read getattr lock open } ;
allow domain rpm_script_tmp_t : file { ioctl read getattr lock open } ;
allow nsswitch_domain samba_var_t : file { ioctl read getattr lock open } ;
allow domain sysctl_crypto_t : file { ioctl read getattr lock open } ;
allow nsswitch_domain net_conf_t : file { ioctl read getattr lock open } ;
allow httpd_script_type etc_t : file { ioctl read getattr execute execute_no_trans open } ;
allow httpd_script_type fonts_t : file { ioctl read getattr lock open } ;
allow httpd_script_type ld_so_t : file { ioctl read getattr execute execute_no_trans open } ;
allow nsswitch_domain file_context_t : file { ioctl read getattr lock open } ;
allow httpd_sys_script_t httpd_squirrelmail_t : file { ioctl read getattr lock append open } ;
allow httpd_script_type base_ro_file_type : file { ioctl read getattr lock execute execute_no_trans open } ;
allow httpd_sys_script_t snmpd_var_lib_t : file { ioctl read getattr lock open } ;
allow nsswitch_domain samba_etc_t : file { ioctl read getattr lock open } ;
allow domain man_cache_t : file { ioctl read getattr lock open } ;
allow httpd_script_type bin_t : file { ioctl read getattr lock execute execute_no_trans open } ;
allow httpd_script_type lib_t : file { ioctl read getattr lock execute execute_no_trans open } ;
allow httpd_sys_script_t httpd_sys_content_t : file { ioctl read getattr lock execute execute_no_trans entrypoint open } ;
allow nsswitch_domain etc_t : file { ioctl read getattr lock open } ;
ET allow nsswitch_domain cert_t : file { ioctl read getattr lock open } ; [ authlogin_nsswitch_use_ldap ]
ET allow nsswitch_domain slapd_cert_t : file { ioctl read getattr lock open } ; [ authlogin_nsswitch_use_ldap ]
ET allow nsswitch_domain net_conf_t : file { ioctl read getattr lock open } ; [ authlogin_nsswitch_use_ldap ]
ET allow domain sysctl_kernel_t : file { ioctl read getattr lock open } ; [ fips_mode ]
Looks like a lot of types, but most of these are System Types bin_t, lib_t ld_so_t, man_t fonts_t, most stuff under /usr etc.
It would be allowed to read /etc/passwd (passwd_t) and most content in /etc.
It can read apache static content, like web page data.
Well what can't it read?
user_home_t - This is where I keep my credit card data
usr_tmp_t where an admin might have left something
Other content in /var
*db_t - No database data.
It can not read most of apache runtime data like apache content in /var/lib or /var/log or /etc/httpd
With SELinux disabled, this process would be allowed to read any content that is world readable on your system as well as any content owned by the apache user our group.
We also need to look at what domains httpd_sys_script_t can transition to?
# sesearch -T -s httpd_sys_script_t -c process -C | grep -v ^D
Found 9 semantic te rules:
type_transition httpd_sys_script_t httpd_rotatelogs_exec_t : process httpd_rotatelogs_t;
type_transition httpd_sys_script_t abrt_helper_exec_t : process abrt_helper_t;
type_transition httpd_sys_script_t antivirus_exec_t : process antivirus_t;
type_transition httpd_sys_script_t sepgsql_ranged_proc_exec_t : process sepgsql_ranged_proc_t;
type_transition httpd_sys_script_t sepgsql_trusted_proc_exec_t : process sepgsql_trusted_proc_t;
SELinux would also block the process executing a setuid process to raise its capabilities.
Now this is a horrible exploit but as you can see SELinux would probably have protected a lot/most of your valuable data on your machine. It would buy you time for you to patch your system.
Did you setenforce 1?
