{"action":"created","issue":{"url":"https://api.github.com/repos/pmix/master/issues/92","repository_url":"https://api.github.com/repos/pmix/master","labels_url":"https://api.github.com/repos/pmix/master/issues/92/labels{/name}","comments_url":"https://api.github.com/repos/pmix/master/issues/92/comments","events_url":"https://api.github.com/repos/pmix/master/issues/92/events","html_url":"https://github.com/pmix/master/pull/92","id":155574282,"number":92,"title":"security: validate connections with SO_PEERCRED + misc fixes","user":{"login":"garlick","id":169947,"avatar_url":"https://avatars.githubusercontent.com/u/169947?v=3","gravatar_id":"","url":"https://api.github.com/users/garlick","html_url":"https://github.com/garlick","followers_url":"https://api.github.com/users/garlick/followers","following_url":"https://api.github.com/users/garlick/following{/other_user}","gists_url":"https://api.github.com/users/garlick/gists{/gist_id}","starred_url":"https://api.github.com/users/garlick/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/garlick/subscriptions","organizations_url":"https://api.github.com/users/garlick/orgs","repos_url":"https://api.github.com/users/garlick/repos","events_url":"https://api.github.com/users/garlick/events{/privacy}","received_events_url":"https://api.github.com/users/garlick/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":12,"created_at":"2016-05-18T18:47:43Z","updated_at":"2016-05-23T17:01:06Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/pmix/master/pulls/92","html_url":"https://github.com/pmix/master/pull/92","diff_url":"https://github.com/pmix/master/pull/92.diff","patch_url":"https://github.com/pmix/master/pull/92.patch"},"body":"This PR changes the way that the \"native\" security module works, as proposed in #91.  Instead of checking a client-supplied credential against the uid/gid registered by the server, send a NULL credential and validate a `struct ucred` from SO_PEERCRED against the uid/gid registered by the server.\r\n\r\nThis also closes a vulnerability where a client could bypass a security module's `validate_cred` method by sending a NULL cred.\r\n\r\nFinally,  munge is removed from the list of security modules, since only UNIX domain socket connections are supported by PMIx presently, and it adds latency to the synchronous connect handshake of clients without improving security over SO_PEERCRED.\r\n\r\nTesting:\r\n* The fact that the \"native\" module no longer has a `create_cred` method means the client sends an empty cred; so the fact debug logs show its `validate_cred` method being called (where before it wasn't) indicate that NULL cred vulnerability is fixed.\r\n* debug logs show ucred values are as expected, and that validation is successful\r\n* I've run my RM with its PMIx server and PMI1 client (linked against libpmix.so) many times without issue\r\n* Briefly tried `PMIX_DEBUG=5 ./pmix_test -n 16 -e ./pmix_client` and all looks OK."},"comment":{"url":"https://api.github.com/repos/pmix/master/issues/comments/221031768","html_url":"https://github.com/pmix/master/pull/92#issuecomment-221031768","issue_url":"https://api.github.com/repos/pmix/master/issues/92","id":221031768,"user":{"login":"rhc54","id":2440928,"avatar_url":"https://avatars.githubusercontent.com/u/2440928?v=3","gravatar_id":"","url":"https://api.github.com/users/rhc54","html_url":"https://github.com/rhc54","followers_url":"https://api.github.com/users/rhc54/followers","following_url":"https://api.github.com/users/rhc54/following{/other_user}","gists_url":"https://api.github.com/users/rhc54/gists{/gist_id}","starred_url":"https://api.github.com/users/rhc54/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rhc54/subscriptions","organizations_url":"https://api.github.com/users/rhc54/orgs","repos_url":"https://api.github.com/users/rhc54/repos","events_url":"https://api.github.com/users/rhc54/events{/privacy}","received_events_url":"https://api.github.com/users/rhc54/received_events","type":"User","site_admin":false},"created_at":"2016-05-23T17:01:06Z","updated_at":"2016-05-23T17:01:06Z","body":"Sounds fine with me\r\n"}}
{"actor":{"display_login":"rhc54"}}