Remove dependency on perl-suid for Perl 5.12

Bug #786250 reported by Allison Randal
258
This bug affects 1 person
Affects Status Importance Assigned to Milestone
backuppc (Debian)
Fix Released
Unknown
backuppc (Fedora)
Fix Released
High
backuppc (Ubuntu)
Fix Released
High
Unassigned

Bug Description

Binary package hint: backuppc

The 5.12 release of Perl removes the suidperl binary, and therefore the perl_5.12.3-6ubuntu4 package no longer includes the perl-suid package. Oneiric will be migrating to Perl 5.12, and so all packages that depend on perl-suid must be updated to remove the dependency.

The Perl 5 Porters (upstream core developers of Perl) recommend two alternative solutions to suidperl: sudo or a small C wrapper. BackupPC uses suidperl for a CGI script, which means it's not possible to substitute sudo. Fedora has applied a patch to use a C wrapper around the CGI script (https://bugzilla.redhat.com/show_bug.cgi?id=611009), and a similar patch has been submitted for Debian but not yet applied (http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=581950). I'll submit a branch of lp:ubuntu/backuppc applying this patch to the Ubuntu package. I'm requesting review of this solution by the Security Team, since it involves escalating privileges through a CGI script.

Related branches

Revision history for this message
In , Ralf (ralf-redhat-bugs) wrote :

Description of problem:
The release of perl in rawhide does not support perl-suidperl.

BackupPC is the last remaining package which requires perl-suidperl.
It therefore shows up as package with broken deps in rawhide package deps reports, e.g.
http://lists.fedoraproject.org/pipermail/devel/2010-July/138206.html

i.e. this package is not installable under rawhide

Version-Release number of selected component (if applicable):
BackupPC-0:3.1.0-14.fc14

Additional info:
This package will have to be removed from
Fedora >=14, should this issue not be resolved.

Revision history for this message
In , Iain (iain-redhat-bugs) wrote :

One simple option would be to create a C wrapper for BackupPC_Admin script and make that setuid instead of the script itself.

See http://perldoc.perl.org/perlsec.html#Security-Bugs for more details.

Revision history for this message
In , Johan (johan-redhat-bugs) wrote :
Revision history for this message
In , Iain (iain-redhat-bugs) wrote :

There's also a debian bug about the same issue, but little progress.

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=581950

Using a C wrapper is really quite simple. Move the existing BackupPC_Admin script to BackupPC_Admin.pl, compile the wrapper and install as /usr/share/BackupPC/sbin/BackupPC_Admin with permissions 4755.

#include <unistd.h>
#ifndef REAL_PATH
#define REAL_PATH "/usr/share/BackupPC/sbin/BackupPC_Admin.pl"
#endif
int main(ac, av)
char **av;
{
    execv(REAL_PATH, av);
    return 0;
}

Revision history for this message
In , Johan (johan-redhat-bugs) wrote :

Thank for the tip Iain :)

I will probably use that to fix the current issue (I really do not want to see BackupPC disappear from repositories).

I won't have tiome for that until next week (I'm very overbooked this week), I hope having some advices from upstream until that.

Revision history for this message
In , Johan (johan-redhat-bugs) wrote :

Someone on BackupPC users mailing list tell me I can use apache suid mechanism (http://sourceforge.net/mailarchive/forum.php?thread_name=4C2F62D4.3010702%40gmail.com&forum_name=backuppc-users).

What do you think about this solution?

Revision history for this message
In , Iain (iain-redhat-bugs) wrote :

Unfortunately, I don't think you'll be able to use apache's suexec mechanism. It's configured at compile time to only execute programs that live under /var/www (and packaging guidelines forbids packages from installing anything under /var/www), and to only execute programs as a user with uid >= 500 and gid >= 100.

Revision history for this message
In , Bug (bug-redhat-bugs) wrote :

This bug appears to have been reported against 'rawhide' during the Fedora 14 development cycle.
Changing version to '14'.

More information and reason for this action is here:
http://fedoraproject.org/wiki/BugZappers/HouseKeeping

Revision history for this message
In , Fedora (fedora-redhat-bugs) wrote :

BackupPC-3.1.0-15.fc14 has been submitted as an update for Fedora 14.
http://admin.fedoraproject.org/updates/BackupPC-3.1.0-15.fc14

Revision history for this message
In , Fedora (fedora-redhat-bugs) wrote :

BackupPC-3.1.0-15.fc14 has been pushed to the Fedora 14 testing repository. If problems still persist, please make note of it in this bug report.
 If you want to test the update, you can install it with
 su -c 'yum --enablerepo=updates-testing update BackupPC'. You can provide feedback for this update here: http://admin.fedoraproject.org/updates/BackupPC-3.1.0-15.fc14

Revision history for this message
In , Fedora (fedora-redhat-bugs) wrote :

BackupPC-3.1.0-15.fc14 has been pushed to the Fedora 14 stable repository. If problems still persist, please make note of it in this bug report.

Allison Randal (allison)
visibility: private → public
Changed in backuppc (Debian):
status: Unknown → New
Colin Watson (cjwatson)
Changed in backuppc (Ubuntu):
status: New → Triaged
importance: Undecided → Medium
importance: Medium → High
Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package backuppc - 3.2.0-3ubuntu5

---------------
backuppc (3.2.0-3ubuntu5) oneiric; urgency=low

  * Replace dependency on perl-suid with a small setuid wrapper, since the
    perl-suid package been removed in Perl 5.12. (LP: #786250)
 -- Allison Randal <email address hidden> Sun, 29 May 2011 17:49:10 -0700

Changed in backuppc (Ubuntu):
status: Triaged → Fix Released
Changed in backuppc (Debian):
status: New → Fix Released
Changed in backuppc (Fedora):
importance: Unknown → High
status: Unknown → Fix Released
To post a comment you must log in.
This report contains Public Security information  
Everyone can see this security related information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.