/sbin/init.d/inetd <- scurity hole?

[Alex Lavrov.]

Hello,

Today I noticed, that in inetd's startup script, there is "umask 000" command. So, every file that is created with services that use inetd, will be created as "rwxrwxrwx" ...

Is it some kind of security hole or there is some goal that I don't see?


Thanx.

[harry d brown jr]

This is how I think it works: If inetd opens a socket to listen on, then umask needs to be 000, so other processes can try to communicate on those sockets.

live free or die
harry d brown jr

[Alex Lavrov.]

In that case, sockets should be created by inetd and the permissions must be set inside inetd and not in startup script, so the other files won't have 777 permissions.

[TwoProc]

Yeah, I agree Alex - it sure looks like a security problem - however, in the past when I've gone in and changed the settings and make them generate at different security levels other than wide-open, the services using them don't work anymore. So, it works as Harry says. I don't like it either, as the sockets tend to be created in public areas (/tmp, /var/tmp ) and, at the very least, are subject to being crashed from most anyone doing an rm-f on them. It would be great to find out that there is a way to secure this - hopefully someone has some more insight on this.

[harry d brown jr]

Alex,

See this:
http://forums1.itrc.hp.com/service/forums/questionanswer.do?admit=716493758+1116511776207+28353475&threadId=36043

There are no www.cert.org Security Vulnerabilities listed.

live free or die
harry d brown jr

[Alex Lavrov.]

Thanx for the replies!

Heh, it seems that there is no really good answer to this issue ....

[Bill Hassell · Accepted solution]

inetd normally doesn't start processes that create files (other than logfiles) and these services (daemons) usually set their own permissions explicitly. So inetd is OK with umask 000, or put a better way: inetd must have umask 000 or certain services and daemons may not function correctly. It is important to provide umask for all user logins however. Since it is not provided with standard HP-UX, be sure to add umask 022 (or better) to /etc/profile and /etc/csh.login, on every server.

[Qi Jian Gang]

Some of the application use client server, which skips the .profile etc seting and result in generating file with world write
permission. Better give umask 022 in inetd,
and encourage application to set it's own umask when needed.