sgid (set-group-ID) pkexec to fix hidepid
adrelanos opened this issue · comments
So basically, I have this one but I gotta say. While we are at it, let's hide pid too. Our workaround solution is not good enough because like things with pkexec don't work. I see. Users under the group proc are exempt from our hardening. So like, why don't we just set group id for the pkexec binary. We will set the group id as proc for pkexec (or anything at all that might break). Like Stuid and setgid are not cool security wise, but we are sgid'ing to group rpoc, which is non root, only proc privileges. So worst case some program that uses pkexec may elevate privileges to get access to prov (literally requires vulnerability in the os), which still would be like, no issue because thats basically what we have as of now. Did you consider this? Has this been tried.
Originally posted by @monsieuremre in #172 (comment)
There was a similar attempt: usr/bin/pkexec.security-misc
But that failed. Why? I don't remember. But it's certainly in the forum history. Has been given up with.
setgid (similar to suid) requires the program to call setegid(). Just only chmoding would be insufficient. So this feature either needs to be implemented upstream (preferably) or above wrapper would need to be modified for this approach.
I am not sure why a setegid() based approach would work better than the previous sudo / lxqt-sudo based approach.
Then also you'd need to test this in Wayland, which might complicate that because running a GUI application (the pkexec prompt) under a different user account (let alone root) is difficult (if possible at all, I don't know).
Such approaches probably require a deep understanding of pkexec.
This is another case where I am highly skeptical that any hacks in Kicksecure can reach acceptable quality, being a shortcut for the proper fix upstream in pkexec.
But yeah, feel free to try create a proof of concept.
Yeah it does not work btw. You can close the issue.