Skip to content

Commit

Permalink
Remove check for whether localhost connection is root
Browse files Browse the repository at this point in the history
We don't use this functionality internally and it's a potential
security liability if someone decides to set up their own internal
proxy to middlewared socket that's running as root.
  • Loading branch information
anodos325 committed Jul 23, 2024
1 parent bbfdd38 commit 2955960
Showing 1 changed file with 0 additions and 16 deletions.
16 changes: 0 additions & 16 deletions src/middlewared/middlewared/plugins/auth.py
Original file line number Diff line number Diff line change
Expand Up @@ -673,22 +673,6 @@ async def check_permission(middleware, app):
await AuthService.session_manager.login(app, UnixSocketSessionManagerCredentials(user))
return

if isinstance(origin, TCPIPOrigin):
if not (origin.addr.startswith('127.') or origin.addr == '::1'):
return

# This is an expensive operation, but it is only performed for localhost TCP connections which are rare
if process := await middleware.run_in_thread(get_peer_process, origin.addr, origin.port):
try:
euid = (await middleware.run_in_thread(process.uids)).effective
except psutil.NoSuchProcess:
pass
else:
if euid == 0:
user = await middleware.call('auth.authenticate_root')
await AuthService.session_manager.login(app, RootTcpSocketSessionManagerCredentials(user))
return


def setup(middleware):
middleware.event_register('auth.sessions', 'Notification of new and removed sessions.')
Expand Down

0 comments on commit 2955960

Please sign in to comment.