Local DoS attack vectors in seunshare 3.10 (SUSE Security Team Blog)

The SUSE Security Team Blog has a postwith an analysis of seunshare,which is used by SELinux to confine untrusted programs. During areview of version3.10 of the program, the team identified two localDenial-of-Service (DoS) vectors.

Since seunshare is supposed to run on SELinux-enabled systems, itis important to understand what kind of privilege escalation can beachieved when vulnerabilities are exploited in a setuid-root binarylike this. Many SELinux-enabled systems, such as Fedora and openSUSE,ship with the "targeted" SELinux policy by default. This policy isfocused on confining well-known system services, but assigns anunconfined SELinux context to interactive users by default to achievea balance between security and usability.

There is currently no domain transition from the unconfined domainto the more restricted seunshare_t defined in the SELinux policy forseunshare. This means the execution of seunshare continues in theunconfined domain. Thus in the context of attacks carried out byinteractive users, the impact of the vulnerabilities below will be aroot-like privilege escalation despite the system running in SELinuxenforced mode.

See the post for the full write-up of the team's discoveries and timeline. Thevulnerabilities have been fixed in version3.11.