Azure / Azure/azure-linux-extensions

Passphrase file is readable by anyone

Open
#1,563 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Python
Stars
333
Forks
278
Avg merge
2d 9h
Merged PRs (30d)
4

Description

As mentioned in #497 the problem persists on Ubuntu 20.04 VMs. LinuxPassPhraseFileName is readable by anyone by default

```
$ ls -lAh /mnt/azure_bek_disk/*
-rwxr-xr-x 1 root root 148 Jun 2 10:25 /mnt/azure_bek_disk/CRITICAL_DATA_WARNING_README.txt
-r-xr-xr-x 1 root root 172 Jun 2 10:25 /mnt/azure_bek_disk/LinuxPassPhraseFileName
-r-xr-xr-x 1 root root 172 Jun 2 10:25 /mnt/azure_bek_disk/LinuxPassPhraseFileName_1_0
```

fmpov, permission 400 will be more secure.

changing permissions does not seem to have any effect, as its a vfat mounted disk
```
$ sudo chmod -v 400 /mnt/azure_bek_disk/LinuxPassPhraseFileName*
mode of '/mnt/azure_bek_disk/LinuxPassPhraseFileName' changed from 0555 (r-xr-xr-x) to 0400 (r--------)
mode of '/mnt/azure_bek_disk/LinuxPassPhraseFileName_1_0' changed from 0555 (r-xr-xr-x) to 0400 (r--------)

$ ls -lAh /mnt/azure_bek_disk/*
-rwxr-xr-x 1 root root 148 Jun 2 10:25 /mnt/azure_bek_disk/CRITICAL_DATA_WARNING_README.txt
-r-xr-xr-x 1 root root 172 Jun 2 10:25 /mnt/azure_bek_disk/LinuxPassPhraseFileName
-r-xr-xr-x 1 root root 172 Jun 2 10:25 /mnt/azure_bek_disk/LinuxPassPhraseFileName_1_0
```

Modification of parent read directory and fstab options doesn't seem to have an effect either:

```bash
sudo umount /mnt/azure_bek_disk
sudo chmod -v 700 /mnt/azure_bek_disk/
# now mounting is not possible anymore, so I restarted
```
changed fstab from

```bash
LABEL=BEK\040VOLUME /mnt/azure_bek_disk auto defaults,discard,nofail 0 0
```

to

```bash
LABEL=BEK\040VOLUME /mnt/azure_bek_disk vfat auto,nouser,noexec,ro,uid=0,gid=0,umask=0277 0 0
```
Without any effect

Do you know a workaround for this?

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by reproducing the reported permissions on an Ubuntu 20.04 VM and inspect how the BEK volume is mounted as vfat. Compare the resulting mount options and file modes with the requested protection, then verify any workaround against LinuxPassPhraseFileName and its versioned copy.

Written by the indexing model from the issue text.

Assessment

Tech stack
linux, python
Domain
infrastructure, operating-systems, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.