leviathan
270ddc1681
Adds tools/verify-vm/provisioners/<module>.sh hook so per-module setup
(build vulnerable sudo from source, drop polkit allow rule, add sudoers
grant) lives in checked-in scripts rather than manual VM steps. Vagrantfile
runs the script as root before build-and-verify if it exists.
Also fixes mainline kernel fetch to fall back from /v${KVER}/amd64/ to
/v${KVER}/ for old kernels (≤ ~4.15) where debs aren't under the amd64
subdir, and accepts both 'linux-image-' (old) and 'linux-image-unsigned-'
(new) deb names.
Wires up 4 previously-deferred targets to expect VULNERABLE:
- sudo_chwoot: builds sudo 1.9.16p1 from upstream into /usr/local
- udisks_libblockdev: installs udisks2 + polkit rule for vagrant user
- mutagen_astronomy: pins mainline 4.14.70 (one below the .71 fix)
- sudo_runas_neg1: adds (ALL,!root) sudoers grant
35 lines
1.4 KiB
Bash
Executable File
35 lines
1.4 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# CVE-2025-6019 udisks/libblockdev SUID-on-mount (Qualys). Debian 12's
|
|
# cloud image is server-oriented and doesn't ship udisks2. Install it,
|
|
# and drop a polkit rule allowing the vagrant user to invoke the
|
|
# affected action.ids — the real-world bug-path is "active console
|
|
# user invokes loop-setup", and we don't have a graphical session in
|
|
# Vagrant. The polkit rule simulates the trust polkit would give a
|
|
# logged-in workstation user.
|
|
set -e
|
|
|
|
export DEBIAN_FRONTEND=noninteractive
|
|
apt-get install -y -qq udisks2 libblockdev-utils3 >/dev/null
|
|
|
|
mkdir -p /etc/polkit-1/rules.d
|
|
cat >/etc/polkit-1/rules.d/49-skk-verify.rules <<'EOF'
|
|
polkit.addRule(function(action, subject) {
|
|
if (subject.user == "vagrant" &&
|
|
(action.id == "org.freedesktop.UDisks2.loop-setup" ||
|
|
action.id == "org.freedesktop.UDisks2.filesystem-mount" ||
|
|
action.id == "org.freedesktop.UDisks2.filesystem-mount-other-seat" ||
|
|
action.id == "org.freedesktop.UDisks2.modify-device")) {
|
|
return polkit.Result.YES;
|
|
}
|
|
});
|
|
EOF
|
|
|
|
systemctl enable udisks2.service >/dev/null 2>&1 || true
|
|
systemctl restart udisks2.service
|
|
sleep 2
|
|
|
|
echo "[+] udisks2 status:"
|
|
systemctl is-active udisks2.service
|
|
echo "[+] udisks2 version: $(dpkg-query -W -f='${Version}' udisks2)"
|
|
echo "[+] libblockdev version: $(dpkg-query -W -f='${Version}' libblockdev-utils3 2>/dev/null || dpkg-query -W -f='${Version}' libblockdev-utils2)"
|