[MDEV-15473] Isolate/sandbox PAM modules, so that they can't crash the server - Jira

Details

Type: Task
Status: Closed (View Workflow)
Priority: Critical
Resolution: Fixed
Fix Version/s: 10.4.0
Component/s: Authentication and Privilege System, Plugin - pam
Labels:
None

Sprint:
10.4.0-1

Description

Buggy PAM modules can currently crash the server. See ~~MDEV-10361~~ for example. Should auth_pam isolate PAM modules somehow to prevent problems like this from taking down the whole server? Is it feasible for auth_pam to use sandboxes for PAM modules, or would that cripple performance and slow down authentication too much?

Attachments

Issue Links

causes

MDEV-19876 pam v2: auth_pam_tool_dir and auth_pam_tool permissions are wrong in RPMs

Closed

MDEV-19877 pam v2: auth_pam_tool input format is not user friendly for debugging

Open

MDEV-19878 pam v2: pam password authentication doesn't work at all

Closed

MDEV-19880 pam v1: pam password authentication doesn't work at all in MariaDB 10.4

Closed

MDEV-19881 pam plugin from MariaDB 10.3 doesn't work with MariaDB 10.4

Open

MDEV-19882 pam v2: auth_pam_tool truncates passwords that are not null-terminated

Closed

MDEV-21385 PAM v2 plugin produces lots of zombie processes

Closed

MDEV-22459 pam v2 should log an error if auth_pam_tool exec fails

Closed

MDEV-22482 pam v2: mysql_upgrade doesn't fix the ownership/privileges of auth_pam_tool

Open

MXS-2633 Pam authentication doesn't work with server 10.4

Closed

is blocked by

MDEV-7032 new pam plugin with a suid wrapper

Closed

relates to

MDEV-16813 Document PAM updates

Open

MDEV-18311 Change default PAM service name to mariadb

Open

MXS-3753 Add option to run PAM authentication in a suid sanbox

Closed

MDEV-10361 auth_pam + RSA SecurID PAM module + SQLyog causes server crash

Closed

(5 causes, 1 is blocked by, 4 relates to)

Activity

Ascending order - Click to sort in descending order

Geoff Montee (Inactive) created issue - 2018-03-05 19:19

Geoff Montee (Inactive) made changes - 2018-03-05 19:19

Field	Original Value	New Value
Link		This issue relates to ~~MDEV-10361~~ [ ~~MDEV-10361~~ ]

Julien Fritsch made changes - 2018-03-28 14:29

Priority

Major [ 3 ]

Critical [ 2 ]

Julien Fritsch made changes - 2018-03-28 14:29

Assignee

Sergei Golubchik [ serg ]

Ralf Gebhardt added a comment - 2018-03-28 14:45 - edited

serg If I understand this correctly, the server is crashing. From my point of view this should be a bug, do you agree?

Ralf Gebhardt added a comment - 2018-03-28 14:45 - edited serg If I understand this correctly, the server is crashing. From my point of view this should be a bug, do you agree?

Sergei Golubchik added a comment - 2018-03-28 23:23

No, this is not a bug. Everything works as designed. By design, a plugin is executed in the server address space, in the server process. So if the plugin crashes, it is expected that it will take the whole server with it.

It is possible, of course, to redesign the plugin architecture and execute plugins in a sandbox. But this will be by no means a bug fix.

Sergei Golubchik added a comment - 2018-03-28 23:23 No, this is not a bug. Everything works as designed. By design, a plugin is executed in the server address space, in the server process. So if the plugin crashes, it is expected that it will take the whole server with it. It is possible, of course, to redesign the plugin architecture and execute plugins in a sandbox. But this will be by no means a bug fix.

Ralf Gebhardt made changes - 2018-04-09 13:27

Fix Version/s

10.4 [ 22408 ]

Ralf Gebhardt made changes - 2018-04-09 13:28

Link

This issue relates to ~~MDEV-7032~~ [ ~~MDEV-7032~~ ]

Ralf Gebhardt added a comment - 2018-04-09 13:44

By getting ~~MDEV-7032~~ done, the Server should not crash in this cases anymore

Ralf Gebhardt added a comment - 2018-04-09 13:44 By getting MDEV-7032 done, the Server should not crash in this cases anymore

Sergei Golubchik made changes - 2018-05-22 20:08

Link

This issue is blocked by ~~MDEV-7032~~ [ ~~MDEV-7032~~ ]

Sergei Golubchik made changes - 2018-05-22 20:09

Link

This issue relates to ~~MDEV-7032~~ [ ~~MDEV-7032~~ ]

Rasmus Johansson (Inactive) made changes - 2018-05-23 07:42

Assignee

Sergei Golubchik [ serg ]

Alexey Botchkov [ holyfoot ]

Alexey Botchkov made changes - 2018-05-24 08:17

Status

Open [ 1 ]

In Progress [ 3 ]

Rasmus Johansson (Inactive) made changes - 2018-05-29 07:52

Sprint

10.4.0-1 [ 254 ]

Rasmus Johansson (Inactive) made changes - 2018-05-29 07:52

Rank

Ranked lower

Alexey Botchkov added a comment - 2018-06-04 13:50 - edited

http://lists.askmonty.org/pipermail/commits/2018-June/012595.html

Short description -
structurally i added the auth_pam_safe.so and auth_pam_tool modules.
The 'so' provides the same interface as the auth_pam.so, just is crash-safe. The auth_pam_tool is the 'sandbox' applicatin that does the PAM calls.
Part of the auth_pam.c was moved to the auth_pam_base.c to be included into auth_pam.c and auth_pam_toll.c.

I didn't add tests here intentionally - would like to agree the overall design first.

Alexey Botchkov added a comment - 2018-06-04 13:50 - edited http://lists.askmonty.org/pipermail/commits/2018-June/012595.html Short description - structurally i added the auth_pam_safe.so and auth_pam_tool modules. The 'so' provides the same interface as the auth_pam.so, just is crash-safe. The auth_pam_tool is the 'sandbox' applicatin that does the PAM calls. Part of the auth_pam.c was moved to the auth_pam_base.c to be included into auth_pam.c and auth_pam_toll.c. I didn't add tests here intentionally - would like to agree the overall design first.

Alexey Botchkov made changes - 2018-06-04 13:50

Assignee	Alexey Botchkov [ holyfoot ]	Sergei Golubchik [ serg ]
Status	In Progress [ 3 ]	In Review [ 10002 ]

Sergei Golubchik made changes - 2018-06-07 07:56

Assignee	Sergei Golubchik [ serg ]	Alexey Botchkov [ holyfoot ]
Status	In Review [ 10002 ]	Stalled [ 10000 ]

Alexey Botchkov made changes - 2018-07-01 09:00

Status

Stalled [ 10000 ]

In Progress [ 3 ]

Alexey Botchkov added a comment - 2018-07-01 09:00

http://lists.askmonty.org/pipermail/commits/2018-July/012669.html

Alexey Botchkov added a comment - 2018-07-01 09:00 http://lists.askmonty.org/pipermail/commits/2018-July/012669.html

Alexey Botchkov made changes - 2018-07-01 09:00

Assignee	Alexey Botchkov [ holyfoot ]	Sergei Golubchik [ serg ]
Status	In Progress [ 3 ]	In Review [ 10002 ]

Sergei Golubchik made changes - 2018-07-01 18:12

Assignee	Sergei Golubchik [ serg ]	Alexey Botchkov [ holyfoot ]
Status	In Review [ 10002 ]	Stalled [ 10000 ]

Alexey Botchkov made changes - 2018-07-03 12:23

Status

Stalled [ 10000 ]

In Progress [ 3 ]

Alexey Botchkov added a comment - 2018-07-03 12:24

Final patch.
http://lists.askmonty.org/pipermail/commits/2018-July/012672.html

Alexey Botchkov added a comment - 2018-07-03 12:24 Final patch. http://lists.askmonty.org/pipermail/commits/2018-July/012672.html

Alexey Botchkov made changes - 2018-07-03 12:24

Fix Version/s		10.4.0 [ 23115 ]
Fix Version/s	10.4 [ 22408 ]
Resolution		Fixed [ 1 ]
Status	In Progress [ 3 ]	Closed [ 6 ]

Sergei Golubchik added a comment - 2018-07-03 15:21

still need to check that filesystem permissions on the new directory is set correctly

and minor cleanup in tests.

Sergei Golubchik added a comment - 2018-07-03 15:21 still need to check that filesystem permissions on the new directory is set correctly and minor cleanup in tests.

Sergei Golubchik made changes - 2018-07-03 15:21

Resolution	Fixed [ 1 ]
Status	Closed [ 6 ]	Stalled [ 10000 ]

Julien Fritsch made changes - 2018-07-05 12:50

Link

This issue is part of PT-73 [ PT-73 ]

Julien Fritsch made changes - 2018-07-05 12:52

Link

This issue is part of PT-73 [ PT-73 ]

Julien Fritsch made changes - 2018-07-05 12:56

Epic Link

PT-73 [ 68549 ]

Alexey Botchkov added a comment - 2018-07-05 13:41

http://lists.askmonty.org/pipermail/commits/2018-July/012680.html

Alexey Botchkov added a comment - 2018-07-05 13:41 http://lists.askmonty.org/pipermail/commits/2018-July/012680.html

Alexey Botchkov made changes - 2018-07-05 13:41

Assignee	Alexey Botchkov [ holyfoot ]	Sergei Golubchik [ serg ]
Status	Stalled [ 10000 ]	In Review [ 10002 ]

Sergei Golubchik made changes - 2018-07-06 00:22

Assignee	Sergei Golubchik [ serg ]	Alexey Botchkov [ holyfoot ]
Status	In Review [ 10002 ]	Stalled [ 10000 ]

Alexey Botchkov made changes - 2018-07-09 09:58

Status

Stalled [ 10000 ]

In Progress [ 3 ]

Alexey Botchkov added a comment - 2018-07-09 09:58

http://lists.askmonty.org/pipermail/commits/2018-July/012691.html

Alexey Botchkov added a comment - 2018-07-09 09:58 http://lists.askmonty.org/pipermail/commits/2018-July/012691.html

Alexey Botchkov made changes - 2018-07-09 09:58

Assignee	Alexey Botchkov [ holyfoot ]	Sergei Golubchik [ serg ]
Status	In Progress [ 3 ]	In Review [ 10002 ]

Sergei Golubchik made changes - 2018-07-09 14:07

Assignee	Sergei Golubchik [ serg ]	Alexey Botchkov [ holyfoot ]
Status	In Review [ 10002 ]	Stalled [ 10000 ]

Alexey Botchkov made changes - 2018-07-09 21:04

Status

Stalled [ 10000 ]

In Progress [ 3 ]

Alexey Botchkov added a comment - 2018-07-09 21:04

http://lists.askmonty.org/pipermail/commits/2018-July/012692.html

Alexey Botchkov added a comment - 2018-07-09 21:04 http://lists.askmonty.org/pipermail/commits/2018-July/012692.html

Alexey Botchkov made changes - 2018-07-09 21:04

Assignee	Alexey Botchkov [ holyfoot ]	Sergei Golubchik [ serg ]
Status	In Progress [ 3 ]	In Review [ 10002 ]

Sergei Golubchik made changes - 2018-07-10 16:23

Assignee	Sergei Golubchik [ serg ]	Alexey Botchkov [ holyfoot ]
Status	In Review [ 10002 ]	Stalled [ 10000 ]

Alexey Botchkov added a comment - 2018-07-14 19:44

http://lists.askmonty.org/pipermail/commits/2018-July/012698.html

Alexey Botchkov added a comment - 2018-07-14 19:44 http://lists.askmonty.org/pipermail/commits/2018-July/012698.html

Alexey Botchkov made changes - 2018-07-14 19:44

issue.field.resolutiondate

2018-07-14 19:44:03.0

2018-07-14 19:44:03.835

Alexey Botchkov made changes - 2018-07-14 19:44

Resolution		Fixed [ 1 ]
Status	Stalled [ 10000 ]	Closed [ 6 ]

Ian Gilfillan made changes - 2018-07-24 12:47

Link

This issue relates to MDEV-16813 [ MDEV-16813 ]

Ralf Gebhardt made changes - 2018-08-23 13:07

Rank

Ranked higher

Geoff Montee (Inactive) made changes - 2019-01-19 19:59

Link

This issue relates to MDEV-18311 [ MDEV-18311 ]

Geoff Montee (Inactive) made changes - 2019-06-27 01:03

Link

This issue causes MDEV-19877 [ MDEV-19877 ]

Geoff Montee (Inactive) made changes - 2019-06-27 01:04

Link

This issue causes ~~MDEV-19876~~ [ ~~MDEV-19876~~ ]

Geoff Montee (Inactive) made changes - 2019-06-27 01:17

Link

This issue causes ~~MDEV-19878~~ [ ~~MDEV-19878~~ ]

Geoff Montee (Inactive) made changes - 2019-06-27 01:44

Link

This issue causes ~~MDEV-19879~~ [ ~~MDEV-19879~~ ]

Geoff Montee (Inactive) made changes - 2019-06-27 02:03

Link

This issue causes ~~MDEV-19880~~ [ ~~MDEV-19880~~ ]

Geoff Montee (Inactive) made changes - 2019-06-27 02:22

Link

This issue causes MDEV-19881 [ MDEV-19881 ]

Geoff Montee (Inactive) made changes - 2019-06-27 02:41

Link

This issue causes MENT-75 [ MENT-75 ]

Geoff Montee (Inactive) made changes - 2019-06-27 05:39

Link

This issue causes ~~MDEV-19882~~ [ ~~MDEV-19882~~ ]

Geoff Montee (Inactive) made changes - 2019-06-28 18:59

Link

This issue causes ~~MDEV-19879~~ [ ~~MDEV-19879~~ ]

Geoff Montee (Inactive) made changes - 2019-08-15 19:06

Link

This issue causes ~~MXS-2633~~ [ ~~MXS-2633~~ ]

Geoff Montee (Inactive) made changes - 2020-05-06 16:27

Link

This issue causes MDEV-22482 [ MDEV-22482 ]

Geoff Montee (Inactive) made changes - 2020-05-06 16:32

Link

This issue causes ~~MDEV-22459~~ [ ~~MDEV-22459~~ ]

Geoff Montee (Inactive) made changes - 2020-05-26 17:17

Link

This issue causes ~~MDEV-21385~~ [ ~~MDEV-21385~~ ]

Hartmut Holzgraefe made changes - 2021-09-01 13:27

Link

This issue relates to ~~MXS-3753~~ [ ~~MXS-3753~~ ]

Sergei Golubchik made changes - 2021-12-06 21:23

Workflow

MariaDB v3 [ 85839 ]

MariaDB v4 [ 133484 ]

Jira Automation (IT) made changes - 2024-07-04 07:54

Zendesk Related Tickets

128753 118208

People

Assignee:: Alexey Botchkov

Reporter:: Geoff Montee (Inactive)

Votes:: 5 Vote for this issue

Watchers:: 8 Start watching this issue

Dates

Created:: 2018-03-05 19:19

Updated:: 2024-07-08 00:22

Resolved:: 2018-07-14 19:44

Git Integration

Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.

MariaDB Server

Details

Description

Attachments

Issue Links

Activity

People

Dates

Git Integration