bug#28618: Emacs Security Issue

[Noam Postavsky]

tags 28618 + unreproducible
quit

Dor Azouri <dor.azouri@safebreach.com> writes:

> Reproduction steps:
> ===================
> 1)  Add the following ELisp line of code to the init file. It will be
> loaded on startup and execute the command “touch /stub.file”, when “~
> /.emacs.d/” is the working directory.
>         (let ((default-directory "~/.emacs.d/")) (shell-command
> "touch /stub.file"))
> 2)  Wait for the user to invoke Emacs in elevated mode. The owner of
> the newly created stub file is root.

As Glenn noted, this doesn't actually work: 'sudo emacs' uses
/root/.emacs, not ~/.emacs.

~$ sudo id
uid=0(root) gid=0(root) groups=0(root)
~$ echo '(let ((default-directory "~/.emacs.d/")) (shell-command "touch 
/stub.file"))' > .emacs
~$ emacs # *Messages* has "touch: cannot touch '/stub.file': Permission denied"
~$ ls /stub.file
ls: cannot access '/stub.file': No such file or directory
~$ sudo emacs
~$ ls /stub.file
ls: cannot access '/stub.file': No such file or directory