How to defend from privilege escalation if user is using the disk group?

Question

A base Centos7 install:

[root@teszt ~]# lsblk
NAME        MAJ:MIN RM  SIZE RO TYPE MOUNTPOINT
sda           8:0    0  100G  0 disk 
├─sda1        8:1    0    1G  0 part /boot
└─sda2        8:2    0   99G  0 part 
  ├─cl-root 253:0    0   50G  0 lvm  /
  ├─cl-swap 253:1    0    2G  0 lvm  [SWAP]
  └─cl-home 253:2    0   47G  0 lvm  /home
sr0          11:0    1 56.6M  0 rom  
[root@teszt ~]# ls -lah /dev/sda1
brw-rw----. 1 root disk 8, 1 Mar 12 09:25 /dev/sda1
[root@teszt ~]# useradd -m tesztuser
[root@teszt ~]# id tesztuser
uid=1000(tesztuser) gid=1000(tesztuser) groups=1000(tesztuser)
[root@teszt ~]# usermod -a -G disk tesztuser
[root@teszt ~]# id tesztuser
uid=1000(tesztuser) gid=1000(tesztuser) groups=1000(tesztuser),6(disk)
[root@teszt ~]# su - tesztuser
[tesztuser@teszt ~]$ id
uid=1000(tesztuser) gid=1000(tesztuser) groups=1000(tesztuser),6(disk) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
[tesztuser@teszt ~]$ dd if=/dev/sda1 of=copy-of-boot-fs
2097152+0 records in
2097152+0 records out
1073741824 bytes (1.1 GB) copied, 5.33951 s, 201 MB/s
[tesztuser@teszt ~]$ ls -lah copy-of-boot-fs 
-rw-rw-r--. 1 tesztuser tesztuser 1.0G Mar 12 09:28 copy-of-boot-fs
[tesztuser@teszt ~]$

Question: if we need to give the "normal" user to the "disk" group, how can we defend from the attacks like privilege escalation? The user can read/write to the RAW disk, thus doing whatever it wants, ex.: trojan the kernel at next reboot or modify its uid/gid to god 0/0.

Adding a normal user to disk group is needed when ex.: a normal user is using VirtualBox and it wants to use a RAW LV for the guest, and not a file on top of an FS because of performance.

score 0 · Accepted Answer · edited Apr 13 '17 at 12:37

if we need to give the "normal" user to the "disk" group, how can we defend from the attacks like privilege escalation?

You can't. The solution is not to put users in the disk group. It isn't meant for that.

To give a user access to a raw volume, put that volume in a different group, and only that volume. The way to do that is to add a udev rule. See give group permissions to specific device, Udev rule not setting group, Allow non-root user to read/write /dev files, …

How to defend from privilege escalation if user is using the disk group?

1 Answers1