Bash tools are insecure

[Elan Ruusamäe]

i'm, sorry, these programs are not production safe:

pt-diskstats pt-sift pt-summary pt-mysql-summary pt-collect pt-mext

if good old maatkit programs mentioned risks in their manual pages, then these programs do not even mention such risk giving false sense of security to the end user.

they are using hardcoded filenames in world writable dir (/tmp) and thus are open to symlink attacks

pt-summary even considers the risk and does nothing to prevent the symlink attack:

--- CUT ---
# The temp files are for storing working results so we don't call commands many
# times (gives inconsistent results, maybe adds load on things I don't want to
# such as RAID controllers). They must not exist -- if they did, someone would
# symlink them to /etc/passwd and then run this program as root. Call this
# function with "rm" or "touch" as an argument.
temp_files() {
   for file in /tmp/percona-toolkit /tmp/percona-toolkit2; do
      case "$1" in
      touch)
         if ! touch "${file}"; then
            echo "I can't make my temp file ${file}";
            exit 1;
         fi
         ;;
      rm)
         rm -f "${file}"
         ;;
      esac
   done
}
--- CUT ---

if program needs state files with fixed filenames to work, it should then create temporary dir first and place the files there
or using some other ways to use private dir, i.e let user choose the work dir via some commandline option

[Daniel Nichter (daniel-nichter)]

Elan, You'll be happy to know that work is already underway to fix these issues. When theses Aspera tools were forked into Percona Toolkit, we had already intended to make them secure and open about their risks like the Maatkit tools. I began work to that end a month or so ago, but another project came up which demanded all my time. I'll return soon to these tools and when I'm finished, they won't have these concerns.

[Baron Schwartz (baron-xaprb)]

pt-summary does in fact do something about it: it removes the files (so if they were symlinks, they would be unlinked) and then creates them again. So the initial report is a bit mistaken. However, it is true that we need to use mktemp to avoid the problem completely.

[Elan Ruusamäe (glen666)]

glad to hear!

but i'd still like to comment:

removing file and creating again under same filename is not secure. it is still open to race condition attacks.

attacker could repeatedly ln -s the path you unlinked and he has still chance to win if he slipped between removal and and creation file by main process. that's the race condition is all about.

http://en.wikipedia.org/wiki/Time-of-check-to-time-of-use
http://linux.die.net/man/1/mktemp

mktemp and friends do additional checks to ensure that the tempfile being created is their own.

[Baron Schwartz (baron-xaprb)]

Yes, the race condition is possible. Honestly when I wrote these tools
I was not a good shell programmer and did not know the right way to do
it. But we will fix it.

[Baron Schwartz (baron-xaprb)]

Although I agree about the vulnerability, I do not believe that this is actually of critical importance, just high importance. Critical would be "the tool executes rm -rf / when you run it"

[Baron Schwartz (baron-xaprb)]

I've targeted this for our next release and assigned to Brian. Daniel's existing work for bin/pt-stalk in ~daniel-nichter/percona-toolkit/pt-stalk-2.0/ should be a good model to follow.

[Elan Ruusamäe (glen666)]

pt-pmp from 2.0.3 release contains hardcoded /tmp:

$ grep -n /tmp/ pt-pmp
103: rm -f /tmp/percona-toolkit
158: gdb -ex "set pagination 0" -ex "thread apply all bt" -batch -p $OPT_p >> "${OPT_k:-/tmp/percona-toolkit}"
159: date +'TS %N.%s %F %T' >> "${OPT_k:-/tmp/percona-toolkit}"
165: aggregate_stacktrace "${OPT_l}" "${OPT_k:-/tmp/percona-toolkit}"
166: rm -f /tmp/percona-toolkit

[Daniel Nichter (daniel-nichter)]

Yes, it looks like we missed one. Thanks for reporting this. I've created and targeted bug 928966 for 2.0.4.

[Shahriyar Rzayev (rzayev-sehriyar)]

Percona now uses JIRA for bug reports so this bug report is migrated to: https://jira.percona.com/browse/PT-278