<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
Hi everyone,</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
As this is my first message on the list, let me introduce myself. I'm in charge of Product Security at Eviden, and I'm currently interested in hardening some Baseboard Management Controller (BMC) running on linux (OpenBMC). As a company, we are an HPC and Enterprise
server vendor.</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
As part of this hardening effort, we are investigating some mechanisms to segregate some critical files in a separate memory area, for instance /etc/passwd and /etc/shadow. The rationale for this is that these files may have to survive some reset-to-defaults,
while being kept read-write in normal use. The user may want to change its passwords 😉. On the other hand, other files in /etc must reside in read-only memory as they are bound to the hardware.</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
The approach we had in mind was to move the corresponding files in a different location and set a symbolic link at the usual place in /etc. During testing, we discovered shadow limitation which prevents from following links. Namely, the opening of file in lib/commonio.c
uses O_NOFOLLOW flag.</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<a href="https://serverfault.com/questions/491033/cannot-useradd-adduser-when-etc-passwd-shadow-group-are-symlink-debian-squee" target="_blank" id="OWA135fde0d-de4c-1e92-4830-60fd02a588c4" class="fui-Link ___1rxvrpe f2hkw1w f3rmtva f1ewtqcl fyind8e f1k6fduh f1w7gpdv fk6fouc fjoy568 figsok6 f1hu3pq6 f11qmguv f19f4twv f1tyq0we f1g0x7ka fhxju0i f1qch9an f1cnd47f fqv5qza f1vmzxwi f1o700av f13mvf36 f1cmlufx f9n3di6 f1ids18y f1tx3yz7 f1deo86v f1eh06m1 f1iescvh fhgqx19 f1olyrje f1p93eir f1nev41a f1h8hb77 f1lqvz6u f10aw75t fsle3fq f17ae5zn OWAAutoLink" title="https://serverfault.com/questions/491033/cannot-useradd-adduser-when-etc-passwd-shadow-group-are-symlink-debian-squee" rel="noreferrer noopener">https://serverfault.com/questions/491033/cannot-useradd-adduser-when-etc-passwd-shadow-group-are-symlink-debian-squee</a></div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
As we are in some embedded linux, we could just recompile shadow without this flag. But before doing this, I'd like to understand the rationale for this flag. Can anyone provide clarification on this?</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
Thanks in advance.</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<div id="Signature">
<table style="width: 100%;">
<tbody>
<tr>
<td style="padding: 0cm; width: 100%;">
<p style="margin: 0cm; font-family: Calibri, sans-serif; font-size: 11pt;"><span style="font-family: Montserrat; font-size: 9pt; color: black;"> </span></p>
<p style="margin: 0cm; font-family: Calibri, sans-serif; font-size: 11pt;"><span style="font-family: Montserrat; font-size: 9pt; color: black;">Bien cordialement / Kind regards, </span></p>
<p style="margin: 0cm; font-family: Calibri, sans-serif; font-size: 11pt;"><span style="font-family: "Montserrat SemiBold"; font-size: 10pt; color: black;"><b> </b></span></p>
<p style="margin: 0cm;"><span style="font-family: "Montserrat SemiBold"; font-size: 10pt; color: black;"><b>Florent Chabaud</b></span><span style="font-family: Calibri, sans-serif; font-size: 11pt;"><br>
</span><span style="font-family: Montserrat; font-size: 9pt; color: black;">Chief Product Security Officer – BDS</span><span style="font-family: Calibri, sans-serif; font-size: 11pt;"><br>
</span><span style="font-family: Montserrat; font-size: 9pt; color: black;">M: +33 (0) 675 084 850</span><span style="font-family: Calibri, sans-serif; font-size: 11pt;"><br>
</span><span style="font-family: Montserrat; font-size: 9pt; color: black;">Rue du Gros Caillou – 78340 Les Clayes-sous-Bois – France</span><span style="font-family: Calibri, sans-serif; font-size: 11pt;"><br>
</span><span style="font-family: Montserrat; font-size: 9pt; color: black;"><a href="https://eviden.com/" target="_blank" style="color: black; margin-top: 0px; margin-bottom: 0px;">eviden.com</a></span><span style="font-family: Calibri, sans-serif; font-size: 11pt;"><br>
<img style="max-width: 810px; margin-top: 0px; margin-bottom: 0px;" data-outlook-trace="F:1|T:1" src="cid:b2f33e46-ee1d-4943-893d-43694876d9c5"></span></p>
</td>
<td style="padding: 0cm;"></td>
</tr>
</tbody>
</table>
<table style="width: 187.5pt;">
<tbody>
<tr>
<td style="border-width: 2.25pt medium medium; border-style: solid none none; border-color: rgb(226, 226, 226) currentcolor currentcolor; padding: 7.5pt 0.75pt 0.75pt;">
<p style="line-height: 12pt; margin: 0cm; font-family: Calibri, sans-serif; font-size: 11pt;">
<span style="font-family: Montserrat; font-size: 9pt; color: rgb(74, 74, 74);">an atos business </span></p>
</td>
</tr>
</tbody>
</table>
<table>
<tbody>
<tr>
<td style="padding: 7.5pt 0.75pt 0.75pt;"></td>
</tr>
<tr>
<td style="padding: 0.75pt;">
<p style="line-height: 15pt; margin: 0cm; font-family: Calibri, sans-serif; font-size: 11pt;">
<span style="font-family: Montserrat; font-size: 9pt; color: rgb(74, 74, 74);"><i>This e-mail and any files transmitted with it are confidential and are intended solely for the use of the individual or entity to whom they are addressed. Personal data are processed
according to my company privacy policy. Unless you are the intended addressee (or authorized to receive for such intended addressee), you are not allowed to use, copy or disclose to anyone the message or any information contained in the message. If you have
received the message in error, please advise the sender by reply to <a href="mailto:florent.chabaud@eviden.com" style="margin-top: 0px; margin-bottom: 0px;">
florent.chabaud@eviden.com</a> and delete the message. Thank you </i></span></p>
</td>
</tr>
</tbody>
</table>
<p style="margin: 0cm;"><span style="font-family: Calibri, sans-serif; font-size: 11pt;"> </span></p>
<p style="margin: 0cm;"><span style="font-family: Calibri, sans-serif; font-size: 11pt;"> </span></p>
</div>
</body>
</html>