Red Hat Patching

Enterprise Unix Administration /Advanced Linux Administration /Red Hat Administration

Patching process quality

Linux patching process quality recently became noticeably worse so for example upgrade of 8.0 to 8.3 might break some functionality. Appling just security pataches and trailing the most recent minor release by two (using 8.1 in case of RHEL8) or even three minor releases is safer in current circumstances.

NEWS CONTENTS

• 20210612* Seven-year-old make-me-root bug in Linux service polkit patched ( Jun 12, 2021 , www.theregister.com ) [Recommended]
• 20210612* Seven years old bug in Polkit gives unprivileged users root access ( Jun 12, 2021 , londonnewstime.com ) [Recommended]
• 20210202 : RedHat local repository and offline updates ( Aug 03, 2018 , stackoverflow.com )
• 20210202 : How can we regularly update a disconnected system (A system without internet connection) ( May 02, 2019 , access.redhat.com )
• 20201223 : How do you guys handle Linux Updates-Patches ( Dec 23, 2020 , community.infosecinstitute.com )

Old News ;-)

[Jun 12, 2021] Seven-year-old make-me-root bug in Linux service polkit patched

Highly recommended!

Linux systems that have polkit version 0.113 or later installed – like Debian (unstable) , RHEL 8 , Fedora 21+ , and Ubuntu 20.04 – are affected.

Jun 12, 2021 | www.theregister.com

A seven-year-old privilege escalation vulnerability that's been lurking in several Linux distributions was patched last week in a coordinated disclosure.

In a blog post on Thursday, GitHub security researcher Kevin Backhouse recounted how he found the bug ( CVE-2021-3560 ) in a service called polkit associated with systemd, a common Linux system and service manager component.

Introduced in commit bfa5036 seven years ago and initially shipped in polkit version 0.113, the bug traveled different paths in different Linux distributions. For example, it missed Debian 10 but it made it to the unstable version of Debian , upon which other distros like Ubuntu are based.

Formerly known as PolicyKit, polkit is a service that evaluates whether specific Linux activities require higher privileges than those currently available. It comes into play if, for example, you try to create a new user account.

me title=

Backhouse says the flaw is surprisingly easy to exploit, requiring only a few commands using standard terminal tools like bash, kill, and dbus-send.

"The vulnerability is triggered by starting a dbus-send command but killing it while polkit is still in the middle of processing the request," explained Backhouse.

Killing dbus-send – an interprocess communication command – in the midst of an authentication request causes an error that arises from polkit asking for the UID of a connection that no longer exists (because the connection was killed).

• ALPACA gnaws through TLS protection to snarf cookies and steal data
• How to use Google's new dependency mapping tool to find security flaws buried in your projects
• OpenSSL shuts down two high-severity bugs: Flaws enable cert shenanigans, denial-of-service attacks
• Severe bug in Libgcrypt – used by GPG and others – is a whole heap of trouble, prompts patch scramble

"In fact, polkit mishandles the error in a particularly unfortunate way: rather than rejecting the request, it treats the request as though it came from a process with UID 0," explains Backhouse. "In other words, it immediately authorizes the request because it thinks the request has come from a root process."

This doesn't happen all the time, because polkit's UID query to the dbus-daemon occurs multiple times over different code paths. Usually, those code paths handle the error correctly, said Backhouse, but one code path is vulnerable – and if the disconnection happens when that code path is active, that's when the privilege elevation occurs. It's all a matter of timing, which varies in unpredictable ways because multiple processes are involved.

The intermittent nature of the bug, Backhouse speculates, is why it remained undetected for seven years.

Linux systems that have polkit version 0.113 or later installed – like Debian (unstable) , RHEL 8 , Fedora 21+ , and Ubuntu 20.04 – are affected.

"CVE-2021-3560 enables an unprivileged local attacker to gain root privileges," said Backhouse. "It's very simple and quick to exploit, so it's important that you update your Linux installations as soon as possible." ®

[Jun 12, 2021] Seven years old bug in Polkit gives unprivileged users root access

Highly recommended!

The polkit service is used by systemd. Linux systems that have polkit version 0.113 or later installed – like Debian (unstable), RHEL 8, Fedora 21+, and Ubuntu 20.04 – are affected. "CVE-2021-3560 enables an unprivileged local attacker to gain root privileges," said Backhouse. "It's very simple and quick to exploit, so it's important that you update your Linux installations as soon as possible."

See Red Hat Advisory ...

Jun 12, 2021 | londonnewstime.com

Security researchers have discovered some 7-year-old vulnerabilities Linux distribution

Can be used by unprivileged local users to bypass authentication and gain root access.

The bug patched last week exists in Polkit System Service, a toolkit used to assess whether a particular Linux activity requires higher privileges than currently available. Polkit is installed by default on some Linux distributions, allowing unprivileged processes to communicate with privileged processes.

Linux distributions that use systemd also use Polkit because the Polkit service is associated with systemd.

This vulnerability has been tracked as CVE-2021-3560 and has a CVSS score of 7.8. It was discovered by Kevin Backhouse, a security researcher on GitHub. He states that this issue occurred in 2013 with code commit bfa5036.

Initially shipped with Polkit version 0.113, it has moved to various Linux distributions over the last seven years.

"If the requesting process disconnects from dbus-daemon just before the call to polkit_system_bus_name_get_creds_sync begins, the process will not be able to get the unique uid and pid of the process and will not be able to verify the privileges of the requesting process." And Red Hat Advisory ..

"The biggest threats from this vulnerability are data confidentiality and integrity, and system availability."

so Blog post According to Backhouse, exploiting this vulnerability is very easy and requires few commands using standard terminal tools such as bash, kill and dbus-send.

This flaw affects Polkit versions between 0.113 and 0.118. Red Hat's Cedric Buissart said it will also affect Debian-based distributions based on Polkit 0.105.

Among the popular Linux distributions affected are Debian "Bullseye", Fedora 21 (or later), Ubuntu 20.04, RHEL 8.

Polkit v.0.119, released on 3rd ^rd We will address this issue in June. We recommend that you update your Linux installation as soon as possible to prevent threat attackers from exploiting the bug.

CVE-2021-3560 is the latest in a series of years ago vulnerabilities affecting Linux distributions.

In 2017, Positive Technologies researcher Alexander Popov discovered a flaw in the Linux kernel introduced in the code in 2009. Tracked as CVE-2017-2636, this flaw was finally patched in 2017.

Another old Linux security flaw indexed as CVE-2016-5195 was introduced in 2007 and patched in 2016. This bug, also known as the "dirty COW" zero-day, was used in many attacks before the patch was applied.

Ancient Linux bugs provide root access to unprivileged users

Source link Ancient Linux bugs provide root access to unprivileged users

[Feb 02, 2021] RedHat local repository and offline updates

Aug 03, 2018 | stackoverflow.com

My company just bought a two redhat license for two physical machines , the machines wont be accessible via internet , so we have an issue here regarding the updates , patches , ... etc .

i am thinking of configuring a local repository to be accessible via internet and have all the necessary updates but there is a problem here that i have only two licenses , is it applicable if i activate the local repository for the updates and one of my two service machines , or is there any other way like if there is some sort of offline package that i can download it separately from redhat and update my machines without internet access ?

thanks in advance

XXX

You have several options:

• Red Hat Satellite
• Download the updates on a connected system (using reposync )
• Update with new minor release media
• Manually downloading and installing or updating packages
• Create a Local Repository

See How can we regularly update a disconnected system (A system without internet connection)? for details.

[Feb 02, 2021] How can we regularly update a disconnected system (A system without internet connection)

May 02, 2019 | access.redhat.com

Solution Verified - Updated August 10 2017 at 12:12 PM - English

Resolution

Depending on the environment and circumstances, there are different approaches for updating an offline system.

Approach 1: Red Hat Satellite

For this approach a Red Hat Satellite server is deployed. The Satellite receives the latest packages from Red Hat repositories. Client systems connect to the Satellite and install updates. More details on Red Hat Satellite are available here: https://www.redhat.com/red_hat_network/ . Please also refer to the document Update a Disconnected Red Hat Network Satellite .

• Pros:
  • Installation of updates can be automated.
  • Completely supported solution.
  • Provides selective granualarity regarding which updates get made available and installed
  • Satellite can provide repositories for different major versions of Red Hat products
• Cons:
  • Purchase of Satellite subscription required, setup and maintenance of the Satellite server.

---

Approach 2: Download the updates on a connected system

If a second, similar system exists

• which has the same packages installed (the same package profile)
• and if this second system can be activated/connected to the RHN

then the second system can download applicable errata packages. After downloading the errata packages can be applied to other systems. More documentation: How to update offline RHEL server without network connection to Red Hat Network/Proxy/Satellite? .

• Pros:
  • No additional server required.
• Cons:
  • Updating procedure is hard to automate, will probably be performed manually each time.
  • A new system is required for each architecture / major version of RHEL (such as 6.x)

---

Approach 3: Update with new minor release media

DVD media of new RHEL minor releases (i.e. RHEL6.1) are available from RHN. These media images can directly on the system be used for updating, or offered i.e. via http and be used from other systems as a yum repository for updating. For more details refer to:

• Need to set up yum repository for locally-mounted DVD on Red Hat Enterprise Linux 5
• Need to set up yum repository for locally-mounted DVD on Red Hat Enterprise Linux 6
• Need to set up yum repository for locally-mounted DVD on Red Hat Enterprise Linux 7
• Pros:
  • No additional server required.
• Cons:
  • Updates are restricted to updated packages that are part of the minor releases. Erratas released after the minor release becomes available will be contained in the next minor release.
  • Fetching the update media and updating the systems is difficult to automate.
  • The media only contains the base RHEL packages. They do not contain packages from the optional repository. This prevents the bundled download of the packages from these these channels as media image.

---

Approach 4: Manually downloading and installing or updating packages

It is possible to download and install errata packages. For details refer to this document: How do I download security RPMs using the Red Hat Errata Website? .

• Pros:
  • No additional server required.
• Cons:
  • Consumes a lot of time.
  • Difficult to automate.
  • Dependency resolution can become very complicated and time consuming.

---

Approach 5: Create a Local Repository

This approach is applicable to RHEL 5/6/7. With a registered server that is connected to Red Hat repositories, and is the same Major version. The connected system can use reposync to download all the rpms from a specified repository into a local directory. Then using http,nfs,ftp,or targeting a local directory (file://) this can be configured as a repository which yum can use to install packages and resolve dependencies.

How to create a local mirror of the latest update for Red Hat Enterprise Linux 5, 6, 7 without using Satellite server?

• Pros:
  • Automation possible.
  • For Development and testing environments, this allows a static (unchanging) repository for the Dev systems to verify updates before the Prod systems update.
• Cons:
  • Advanced features that Satellite provides are not available in this approach.
  • Does not provide selective granularity as to which errata get made available and installed.
  • A new system is required for each architecture / major version of RHEL (such as 6.x)
  • Clients can not version lock to a minor version using a local repository. The repository must version lock before the reposync to collect only the specified version packages.
  • Clients will not see any new updates until the local repository runs reposync and createrepo --update to download new packages and create new metadata
    • The clients will likely have to run yum clean all to clear out old metadata and collect the new repo metadata

Checking the security erratas :-

To check the security erratas on the system that is not connected to the internet, download the copy the updateinfo.xml.gz file from the identical registered system. The detailed steps can be checked in How to update security Erratas on system which is not connected to internet ? knowledgebase.

Root Cause

Without a connection to the RHN/RHSM the updates have to be transferred over other paths. These are partly hard to implement and automate.

• Product(s)
• Red Hat Satellite
• Red Hat Enterprise Linux

• Tags
• hosted
• rhel_5
• rhel_6
• rhn
• satellite
• update
• upgrade
• yum

This solution is part of Red Hat's fast-track publication program, providing a huge library of solutions that Red Hat engineers have created while supporting our customers. To give you the knowledge you need the instant it becomes available, these articles may be presented in a raw and unedited form. 8 Comments Sort By Oldest Sort By Newest Log in to comment RZ Community Member 26 points

---

1 February 2012 3:56 PM Randy Zagar

"Approach 3: update with new minor release media" will not work with RHEL 6. Many packages (over 1500) in the "optional" channels simply are not present on any iso images. There is an open case , but the issue will not be addressed before RHEL 6 Update 4 (and possibly never).

22 May 2014 9:27 AM Umesh Susvirkar

I agree with "Randy Zager" "optional" packages should be available offline along with other channels which are not available in ISO's.

12 July 2016 7:20 PM Adrian Kennedy

Can Approach 5 "additional server, reposync fetching" be applied with RHEL 7 servers?

4 August 2016 8:55 AM Dejan Cugalj

Raw

Yes. You need to:
- subscribe server to RH 
- synchronize repositories with reposync util
- up to 40GB per major release of RHEL.

16 August 2016 10:54 PM Michael White

However, won't I need to stand up another RHEL 7 server in additional to the RHEL 6 server?

8 August 2017 7:01 PM John Castranio

Correct. When using an external server to reposync updates, you will need one system for each Major Version of RHEL that you want to sync packages from.

RHEL 7 does not have access to RHEL 6 repositories just as RHEL 6 can't access RHEL 7 repositories

15 January 2019 10:14 PM BRIAN KEYES

what I am looking for is the instructions on the reposync install AND how to update off line clients

do I have to manually install apache?

16 January 2019 10:50 PM Randy Zagar

You will need: a RH Satellite or RH Proxy server, an internal yum server, and a RHN client for each OS variant (and architecture) you intend to support "offline". E.g. supporting 6Server, 6Client, and 6Workstation for i686 and x86_64 would normally require 6 RHN clients, but only three RHN clients would be necessary for RHEL7, as there's no support for i686 architecture

Yum clients can (according to the docs) use nfs resource paths in the baseurl statement, so apache is not strictly necessary on your yum server, but most people do it that way...

Each RHN client will need: local storage to store packages downloaded via reposync (e.g. "reposync -d -g -l -n -t -p /my/storage --repoid=rhel-i686-workstation-optional-6"). You'll need to run "createrepo" on each repository that gets updated, and you'll need to create an rsync service that provides access to each clients' /my/storage volume

Your internal yum server will need a cron script to run rsync against your RHN clients so you can collect all these software channels in one spot.

You'll also need to create custom yum repo files for your client systems (e.g. redhat-6Workstation.repo) that will point to the correct repositories on your yum server.

I'd recommend you NOT run these cron scripts during normal business hours... your sys-admins will want a stable copy so they can clone things for other offline networks.

If you're clever, you can convince one RHN client system to impersonate the different OS variants, reducing the number of systems you need to deploy.

You'll also most likely want to run "hardlink" on your yum server pretty regularly as there's lots of redundant packages across each OS variant.

[Dec 23, 2020] How do you guys handle Linux Updates-Patches

Dec 23, 2020 | community.infosecinstitute.com

Do you use scripts? Configuration Management? Satellite/Spacewalk? Or do you do you practice immutable infrastructure, and simply replace old instances with new ones that have updates pre-baked (update during provisioning)?
I also see the likes of Katello and RH CloudForms System Engine from a Google search.
On top of that, what is your methodology of determining what gets updated and what doesn't? 0 0 0 0 Goals for 2018:
Certs: RHCSA, LFCS: Ubuntu, CNCF CKA, CNCF CKAD | AWS Certified DevOps Engineer, AWS Solutions Architect Pro, AWS Certified Security Specialist, GCP Professional Cloud Architect
Learn: Terraform, Kubernetes, Prometheus & Golang | Improve: Docker , Python Programming
To-do | In Progress | Completed · Share on Facebook Share on Twitter Comments

• thomas_ COMPTIA N+/S+/L+ CCNA R&S CCNP R&S/ENTERPRISE/COLLAB MEMBER POSTS: 959 ■■■■■■■□□□ JUNE 2016 I'm not really a sysadmin, so you probably don't really care about my answer. I run a few websites using DigitalOcean droplets with CentOS. I don't do any of what you mentioned. Every once in awhile I will SSH in and do a "yum makecache" and then a "yum update" and just update all of the packages. The blogs are low traffic and don't get a lot of visitors to them, so I'm not too concerned with them breaking. Maybe when they are higher traffic and make more money I'll look at doing those things. I havent had anything break yet(that I know about). I would rather mitigate against known issues than worry about potential unknown ones caused by the new updates. · Share on Facebook Share on Twitter
• Mike7 MEMBER POSTS: 1,081 ■■■■□□□□□□ JUNE 2016 I automated patching of my CentOS VMs via yum-cron. You can configure it to download patches only or apply patches after downloading.
  The VMs are backup daily, so I can roll-back if necessary. Works well for me so far. · Share on Facebook Share on Twitter
• brombulec MEMBER POSTS: 186 ■■■□□□□□□□ JUNE 2016 Configuration management = Puppet/chef/ansible
  Patch management = satellite/katello/spacewalk

  End of story · Share on Facebook Share on Twitter

• DoubleNNs MEMBER POSTS: 2,013 ■■■■■□□□□□ JUNE 2016 @Mike7
  I didn't know yum-cron existed until now. Do you think you could point me to good resources about it?

  I'm particularly interested in what benefits yum-cron has over "manually" managing yum via a regular cronjob. Also how does the download only mechanism work? And if I download-only patches on say 6/15 can I then apply only the previously downloaded patches (without downloading new ones) on 6/30?

  @brombulec
  Where's the SaltStack love?

  If an environment is mostly RHEL (as opposed to CentOS or SuSE/Debian-based) do you recommend Satellite over Spacewalk? Additionally it seems like Katello and CloudForms have tons of features not in Satellite or Spacewalk. Do you recommend those?

  Even more important, what benefits does having one of those Patch Management systems provide as opposed to simply scheduling yum or Config Mgmt to update?

  Sorry for the barrage of questions, I've just never really thought too much about package management, until now. Goals for 2018:
  Certs: RHCSA, LFCS: Ubuntu, CNCF CKA, CNCF CKAD | AWS Certified DevOps Engineer, AWS Solutions Architect Pro, AWS Certified Security Specialist, GCP Professional Cloud Architect
  Learn: Terraform, Kubernetes, Prometheus & Golang | Improve: Docker , Python Programming

Recommended Links

Softpanorama Recommended

Top articles

[Jun 12, 2021] Seven-year-old make-me-root bug in Linux service polkit patched Published on Jun 12, 2021 | www.theregister.com

[Jun 12, 2021] Seven years old bug in Polkit gives unprivileged users root access Published on Jun 12, 2021 | londonnewstime.com

Sites

rhel5-guide-i731 NSA RHEL5 Hardening guide

***** Linux Security Securing and Hardening Linux Production Systems (Linux Security Cookbook - HOWTO - Guide)

[PDF] Hardening Red Hat Enterprise Linux 5

Red Hat Enterprise Linux 4

Hardening a Linux Installation

• CIS_RHLinux_Benchmark_v1.0.4.pdf - the Benchmark document contains detailed instructions for implementing the steps necessary for CIS Level-I security on Red Hat Linux systems.
• CIS_SUSE_Linux_Benchmark_v1.0.pdf - the Benchmark document contains detailed instructions for implementing the steps necessary for CIS Level-1 security on SUSE Enterprise Server.
• CIS_Slackware_Linux_Benchmark_v1.0.pdf - the Benchmark document contains detailed instructions for implementing the steps necessary for CIS Level-1 security on Slackware Linux systems.
• A scoring tool for Linux benchmarks is currently being developed. It is scheduled for release in June of 2006.

Etc

Society

Groupthink : Two Party System as Polyarchy : Corruption of Regulators : Bureaucracies : Understanding Micromanagers and Control Freaks : Toxic Managers :   Harvard Mafia : Diplomatic Communication : Surviving a Bad Performance Review : Insufficient Retirement Funds as Immanent Problem of Neoliberal Regime : PseudoScience : Who Rules America : Neoliberalism  : The Iron Law of Oligarchy : Libertarian Philosophy

Quotes

War and Peace : Skeptical Finance : John Kenneth Galbraith :Talleyrand : Oscar Wilde : Otto Von Bismarck : Keynes : George Carlin : Skeptics : Propaganda  : SE quotes : Language Design and Programming Quotes : Random IT-related quotes :  Somerset Maugham : Marcus Aurelius : Kurt Vonnegut : Eric Hoffer : Winston Churchill : Napoleon Bonaparte : Ambrose Bierce :  Bernard Shaw : Mark Twain Quotes

Bulletin:

Vol 25, No.12 (December, 2013) Rational Fools vs. Efficient Crooks The efficient markets hypothesis : Political Skeptic Bulletin, 2013 : Unemployment Bulletin, 2010 :  Vol 23, No.10 (October, 2011) An observation about corporate security departments : Slightly Skeptical Euromaydan Chronicles, June 2014 : Greenspan legacy bulletin, 2008 : Vol 25, No.10 (October, 2013) Cryptolocker Trojan (Win32/Crilock.A) : Vol 25, No.08 (August, 2013) Cloud providers as intelligence collection hubs : Financial Humor Bulletin, 2010 : Inequality Bulletin, 2009 : Financial Humor Bulletin, 2008 : Copyleft Problems Bulletin, 2004 : Financial Humor Bulletin, 2011 : Energy Bulletin, 2010 : Malware Protection Bulletin, 2010 : Vol 26, No.1 (January, 2013) Object-Oriented Cult : Political Skeptic Bulletin, 2011 : Vol 23, No.11 (November, 2011) Softpanorama classification of sysadmin horror stories : Vol 25, No.05 (May, 2013) Corporate bullshit as a communication method  : Vol 25, No.06 (June, 2013) A Note on the Relationship of Brooks Law and Conway Law

History:

Fifty glorious years (1950-2000): the triumph of the US computer engineering : Donald Knuth : TAoCP and its Influence of Computer Science : Richard Stallman : Linus Torvalds  : Larry Wall  : John K. Ousterhout : CTSS : Multix OS Unix History : Unix shell history : VI editor : History of pipes concept : Solaris : MS DOS :  Programming Languages History : PL/1 : Simula 67 : C : History of GCC development :  Scripting Languages : Perl history   : OS History : Mail : DNS : SSH : CPU Instruction Sets : SPARC systems 1987-2006 : Norton Commander : Norton Utilities : Norton Ghost : Frontpage history : Malware Defense History : GNU Screen : OSS early history

Classic books:

The Peter Principle : Parkinson Law : 1984 : The Mythical Man-Month :  How to Solve It by George Polya : The Art of Computer Programming : The Elements of Programming Style : The Unix Hater’s Handbook : The Jargon file : The True Believer : Programming Pearls : The Good Soldier Svejk : The Power Elite

Most popular humor pages:

Manifest of the Softpanorama IT Slacker Society : Ten Commandments of the IT Slackers Society : Computer Humor Collection : BSD Logo Story : The Cuckoo's Egg : IT Slang : C++ Humor : ARE YOU A BBS ADDICT? : The Perl Purity Test : Object oriented programmers of all nations : Financial Humor : Financial Humor Bulletin, 2008 : Financial Humor Bulletin, 2010 : The Most Comprehensive Collection of Editor-related Humor : Programming Language Humor : Goldman Sachs related humor : Greenspan humor : C Humor : Scripting Humor : Real Programmers Humor : Web Humor : GPL-related Humor : OFM Humor : Politically Incorrect Humor : IDS Humor : "Linux Sucks" Humor : Russian Musical Humor : Best Russian Programmer Humor : Microsoft plans to buy Catholic Church : Richard Stallman Related Humor : Admin Humor : Perl-related Humor : Linus Torvalds Related humor : PseudoScience Related Humor : Networking Humor : Shell Humor : Financial Humor Bulletin, 2011 : Financial Humor Bulletin, 2012 : Financial Humor Bulletin, 2013 : Java Humor : Software Engineering Humor : Sun Solaris Related Humor : Education Humor : IBM Humor : Assembler-related Humor : VIM Humor : Computer Viruses Humor : Bright tomorrow is rescheduled to a day after tomorrow : Classic Computer Humor

The Last but not Least Technology is dominated by two types of people: those who understand what they do not manage and those who manage what they do not understand ~Archibald Putt. Ph.D

The statements, views and opinions presented on this web page are those of the author (or referenced source) and are not endorsed by, nor do they necessarily reflect, the opinions of the Softpanorama society. We do not warrant the correctness of the information provided or its fitness for any purpose. The site uses AdSense so you need to be aware of Google privacy policy. You you do not want to be tracked by Google please disable Javascript for this site. This site is perfectly usable without Javascript.

Created Jan 2, 2005. Last modified: February 03, 2021