#801622 ntfs-3g: remove setuid on ntfs-3g binary

Package:
ntfs-3g
Source:
ntfs-3g
Description:
read/write NTFS driver for FUSE
Submitter:
Simon Ruderich
Date:
2021-09-09 10:36:03 UTC
Severity:
normal
Tags:
#801622#5
Date:
2015-10-12 16:59:22 UTC
From:
To:
Package: ntfs-3g
Version: 1:2014.2.15AR.2-1+deb8u2cip2
Severity: normal
Tags: patch

Hello,

At the moment ntfs-3g ships with a setuid binary which is
unnecessary as FUSE already provides the setuid fusermount binary
and problematic if the code wasn't properly audited (which is
most likely the case). fusermount had CVEs in the past, i.e.
regarding missing environment sanitation, which could also be
present in ntfs-3g.

The attached patch removes unnecessary checks in the code which
abort when run as non-root, disables the blkdev mount option
which is not supported as non-root (and not required for ntfs-3g)
and removes the allow_other FUSE option which is problematic (as
it may hang processes of other users and has open CVEs) and also
not supported as non-root.

In addition the program must be compiled with
--with-fuse=external to use fusermount directly.

diff -Nru ntfs-3g-2014.2.15AR.2/debian/rules ntfs-3g-2014.2.15AR.2/debian/rules
--- ntfs-3g-2014.2.15AR.2/debian/rules	2015-05-26 20:03:00.000000000 +0200
+++ ntfs-3g-2014.2.15AR.2/debian/rules	2015-10-06 18:05:11.000000000 +0200
@@ -24,7 +24,7 @@
 	dh ${@} --parallel --with autoreconf

 override_dh_auto_configure:
-	dh_auto_configure -- --exec-prefix=/ --enable-crypto --enable-extras --enable-xattr-mappings --enable-quarantined --disable-ldconfig --with-fuse=internal $(CONFIGURE_FLAGS)
+	dh_auto_configure -- --exec-prefix=/ --enable-crypto --enable-extras --enable-xattr-mappings --enable-quarantined --disable-ldconfig --with-fuse=external $(CONFIGURE_FLAGS)

 override_dh_auto_install:
 	dh_auto_install

And obviously the setuid flag must be removed.

Please consider applying this patch and if possible bringing it
upstream as it makes ntfs-3g securer on all systems.

Regards
Simon

#801622#10
Date:
2021-09-09 10:33:00 UTC
From:
To:
Ubuntu made this hardening move in 2019:
"Don't install /bin/ntfs-3g as setuid root"
https://launchpad.net/bugs/1821250

I CCed the security team; maybe they have an opinion on this.