| Brad Bishop | 6a62e0e | 2019-10-21 08:11:42 -0400 | [diff] [blame] | 1 | From 1f233773962bf1a9c2d228a180eacddb9db2d574 Mon Sep 17 00:00:00 2001 |
| 2 | From: Alexander Scheel <ascheel@redhat.com> |
| 3 | Date: Tue, 7 May 2019 16:04:29 -0400 |
| 4 | Subject: [PATCH] su to radiusd user/group when rotating logs |
| 5 | |
| 6 | The su directive to logrotate ensures that log rotation happens under the |
| 7 | owner of the logs. Otherwise, logrotate runs as root:root, potentially |
| 8 | enabling privilege escalation if a RCE is discovered against the |
| 9 | FreeRADIUS daemon. |
| 10 | |
| 11 | Signed-off-by: Alexander Scheel <ascheel@redhat.com> |
| 12 | |
| 13 | Upstream-Status: Backport |
| 14 | [https://github.com/FreeRADIUS/freeradius-server/commit/1f233773962bf1a9c2d228a180eacddb9db2d574] |
| 15 | |
| 16 | CVE: CVE-2019-10143 |
| 17 | |
| 18 | Signed-off-by: Yi Zhao <yi.zhao@windriver.com> |
| 19 | --- |
| 20 | debian/freeradius.logrotate | 3 +++ |
| 21 | redhat/freeradius-logrotate | 1 + |
| 22 | scripts/logrotate/freeradius | 3 +++ |
| 23 | suse/radiusd-logrotate | 1 + |
| 24 | 4 files changed, 8 insertions(+) |
| 25 | |
| 26 | diff --git a/debian/freeradius.logrotate b/debian/freeradius.logrotate |
| 27 | index 7d837d5..a8d29b7 100644 |
| 28 | --- a/debian/freeradius.logrotate |
| 29 | +++ b/debian/freeradius.logrotate |
| 30 | @@ -9,6 +9,7 @@ |
| 31 | notifempty |
| 32 | |
| 33 | copytruncate |
| 34 | + su freerad freerad |
| 35 | } |
| 36 | |
| 37 | # (in order) |
| 38 | @@ -26,6 +27,7 @@ |
| 39 | notifempty |
| 40 | |
| 41 | nocreate |
| 42 | + su freerad freerad |
| 43 | } |
| 44 | |
| 45 | # There are different detail-rotating strategies you can use. One is |
| 46 | @@ -45,4 +47,5 @@ |
| 47 | notifempty |
| 48 | |
| 49 | nocreate |
| 50 | + su freerad freerad |
| 51 | } |
| 52 | diff --git a/redhat/freeradius-logrotate b/redhat/freeradius-logrotate |
| 53 | index 360765d..bb97ca5 100644 |
| 54 | --- a/redhat/freeradius-logrotate |
| 55 | +++ b/redhat/freeradius-logrotate |
| 56 | @@ -9,6 +9,7 @@ rotate 4 |
| 57 | missingok |
| 58 | compress |
| 59 | delaycompress |
| 60 | +su radiusd radiusd |
| 61 | |
| 62 | # |
| 63 | # The main server log |
| 64 | diff --git a/scripts/logrotate/freeradius b/scripts/logrotate/freeradius |
| 65 | index 3de435e..eecf631 100644 |
| 66 | --- a/scripts/logrotate/freeradius |
| 67 | +++ b/scripts/logrotate/freeradius |
| 68 | @@ -17,6 +17,7 @@ |
| 69 | notifempty |
| 70 | |
| 71 | copytruncate |
| 72 | + su radiusd radiusd |
| 73 | } |
| 74 | |
| 75 | # (in order) |
| 76 | @@ -34,6 +35,7 @@ |
| 77 | notifempty |
| 78 | |
| 79 | nocreate |
| 80 | + su radiusd radiusd |
| 81 | } |
| 82 | |
| 83 | # There are different detail-rotating strategies you can use. One is |
| 84 | @@ -53,4 +55,5 @@ |
| 85 | notifempty |
| 86 | |
| 87 | nocreate |
| 88 | + su radiusd radiusd |
| 89 | } |
| 90 | diff --git a/suse/radiusd-logrotate b/suse/radiusd-logrotate |
| 91 | index 24d56be..be5a797 100644 |
| 92 | --- a/suse/radiusd-logrotate |
| 93 | +++ b/suse/radiusd-logrotate |
| 94 | @@ -11,6 +11,7 @@ missingok |
| 95 | compress |
| 96 | delaycompress |
| 97 | notifempty |
| 98 | +su radiusd radiusd |
| 99 | |
| 100 | # |
| 101 | # The main server log |
| 102 | -- |
| 103 | 2.7.4 |
| 104 | |