Bug 51240 - UDM REST API server runs as root
UDM REST API server runs as root
Status: NEW
Product: UCS
Classification: Unclassified
Component: UDM - REST API
UCS 4.4
Other Linux
: P5 normal (vote)
: ---
Assigned To: UMC maintainers
UMC maintainers
:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2020-05-07 08:50 CEST by Philipp Hahn
Modified: 2020-05-07 08:50 CEST (History)
1 user (show)

See Also:
What kind of report is it?: Security Issue
What type of bug is this?: ---
Who will be affected by this bug?: ---
How will those affected feel about the bug?: ---
User Pain:
Enterprise Customer affected?:
School Customer affected?:
ISV affected?:
Waiting Support:
Flags outvoted (downgraded) after PO Review:
Ticket number:
Bug group (optional):
Max CVSS v3 score: 0.0 (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:N)


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Philipp Hahn univentionstaff 2020-05-07 08:50:11 CEST
Running network facing services needlessly as user "root" is a CWE-272 violation of the "Principle of least privilege".

# ps u $(pgrep -f univention.admin.rest.server)
USER       PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
root     18165  0.0  1.1 281824 11704 ?        Ss   Mai06   0:00 /usr/bin/python2.7 -m univention.admin.rest.server

Nevertheless the service should not run as user "root" but use a dedicated local user account.

(I remember a discussion during the development about this, but don't remember the details, why it was not done in the end)