F46 Change Proposal: Usermode2 (self-contained)

Wiki - https://fedoraproject.org/wiki/Changes/Usermode2 Discourse poll - https://discussion.fedoraproject.org/t/f46-change-proposal-usermode2-self-contained/206311/2 This is a proposed Change for Fedora Linux. This document represents a proposed Change. As part of the Changes process, proposals are publicly announced in order to receive community feedback. This proposal will only be implemented if approved by the Fedora Engineering Steering Committee. == Summary == Replace the C implementation of the `usermode` package with a Rust rewrite of its `userhelper`/`consolehelper` tools. For those two tools, the rewrite is a drop-in replacement: same package name, same setuid-root/unprivileged binary split, same `/etc/pam.d` and `/etc/security/console.apps` configuration format, and the same command-line interface. The package's other, obsolete tools, `usermount`, `consolehelper-gtk`, `userpasswd`, `userinfo`, and `pam-panel-icon`, are dropped and not reimplemented. == Owner == * Name: [[User:asn| Andreas Schneider]] * Email: asn@redhat.com == Detailed Description == `userhelper` is a setuid-root helper that authenticates a user via PAM and runs a privileged program on their behalf. `consolehelper` is its unprivileged wrapper, prompting the user at the console or via a graphical `pinentry` dialog on `userhelper`'s behalf. Together they let an administrator grant ordinary users PAM-gated access to a specific privileged program, without making that program itself setuid. The existing C implementation (last released as usermode 1.114) has had no upstream release since 2014. This Change replaces it with a rewrite in Rust, a memory-safe language, while keeping the package name, on-disk configuration format, and CLI of `userhelper`/`consolehelper` unchanged so existing `console.apps`/PAM configurations for managed programs keep working without modification. The original `usermode` package also shipped several standalone GUI tools, all obsolete and all dropped from the rewrite: * `usermount`, for mounting/unmounting removable media, superseded by `udisks`/`polkit` and modern desktop auto-mount handling. * `consolehelper-gtk`, a separate `consolehelper` variant linked against GTK2 (long end-of-life), unnecessary since `consolehelper` drives `pinentry` for its GUI prompts rather than linking a GTK toolkit directly, so there is no separate toolkit-specific binary to maintain. * `userpasswd`, a GUI password-change dialog, superseded by `passwd(1)` and the account-settings password dialogs built into modern desktop environments. * `userinfo`, a GUI equivalent of `chfn`, superseded by `chfn(1)` and modern `accountsservice`-based desktop account-settings panels. * `pam-panel-icon`, a notification-area icon for `pam_timestamp` status, whose use has declined along with `pam_timestamp` itself. None of these are reimplemented in the rewrite. The privilege-separated design is preserved and sharpened: the only setuid-root binary is `userhelper`, kept to PAM calls, privilege transitions, and `exec`. GUI/toolkit code and the `pinentry` dependency live entirely in the unprivileged `consolehelper`, which relays PAM conversation requests to `userhelper` over a socket rather than `userhelper` linking GUI code directly. Secrets (passwords, PAM authtoks) are held in `memsecurity`-backed zeroizing memory for their entire lifetime in both processes, rather than plain `String`/`Vec<u8>`. * Source: https://gitlab.com/cryptomilk/usermode * Design: https://gitlab.com/cryptomilk/usermode/-/blob/main/DESIGN.md == Feedback == No feedback collected yet; this proposal has not been publicly announced. == Benefit to Fedora == `userhelper` is one of the few setuid-root binaries shipped in Fedora, making memory-safety bugs in it directly security relevant. The rewrite removes the memory-unsafety risk (buffer overflows, use-after-free, uninitialized reads) inherent to the original C implementation, which has had no upstream release since 2014 and no active upstream maintenance. Functionality for `userhelper`/`consolehelper` is unchanged for administrators and users: the same binaries, the same `console.apps`/PAM configuration keys (`USER`, `UGROUPS`, `SESSION`, `FALLBACK`, `RETRY`, `GUI`, `NOXOPTION`, `BANNER`, `KEEP_ENV_VARS`, config-file includes, ...), and the same exit codes and man pages. Existing packages that integrate with `consolehelper` (e.g. via a symlink to a managed program name) require no changes. One notable consumer is the `mock` package, which ships `/etc/security/console.apps/mock` and `/etc/pam.d/mock` so users in the `mock` group can run it without full root privileges. The package also drops five long-obsolete tools (`usermount`, `consolehelper-gtk`, `userpasswd`, `userinfo`, `pam-panel-icon`), trimming the setuid-root attack surface and packaging maintenance burden to the two tools that are still actively used. This aligns with Fedora's broader push to adopt memory-safe languages for security-critical system components. == Scope == * Proposal owners: Add missing Rust dependencies to Fedora (rust-ascon-aead, rust-ascon-core, rust-bitcode, rust-bitcode_derive, rust-memsec, rust-memsecurity, rust-pam-client2, rust-pam-sys2, rust-pinentry, rust-random-detached). Update the Fedora `usermode` package to build and ship the Rust rewrite. Packages are already available for test installation via COPR: https://copr.fedorainfracloud.org/coprs/asn/usermode/ * Other developers: N/A (not a System Wide Change) * Release engineering: N/A (not a System Wide Change) * Policies and guidelines: N/A (not needed for this Change) * Trademark approval: N/A (not needed for this Change) * Alignment with the Fedora Strategy: Yes: this is a memory-safety improvement to a security-sensitive, privileged system component, in line with Fedora's ongoing effort to reduce memory-unsafe code in security-critical paths. == Upgrade/compatibility impact == For `userhelper`/`consolehelper`: none expected. The package name, binary names, file locations and modes (`userhelper` setuid root, `consolehelper` 0755), configuration file format (`/etc/security/console.apps/<prog>`, `/etc/pam.d/<prog>`), and command-line interface are unchanged from the C implementation. Existing managed-program configurations continue to work unmodified across the upgrade. `usermount`, `consolehelper-gtk`, `userpasswd`, `userinfo`, and `pam-panel-icon` are removed from the package. Systems still invoking any of these directly, symlinking `consolehelper` to `usermount` or `userpasswd`/`userinfo`, or relying on `consolehelper-gtk` specifically rather than `consolehelper`, lose that functionality on upgrade. This is expected to affect few if any systems given these tools' functionality has been superseded for years. == Early Testing (Optional) == Do you require 'QA Blueprint' support? N == How To Test == 1. No special hardware is needed. A test VM or container is recommended since `userhelper` is setuid root. 2. Install the rewrite from COPR: https://copr.fedorainfracloud.org/coprs/asn/usermode/ (or build from source per the project README: https://gitlab.com/cryptomilk/usermode). 3. Create a PAM service file at `/etc/pam.d/<prog>` and a config file at `/etc/security/console.apps/<prog>` for a test program, e.g.: <pre> # /etc/security/console.apps/testprog USER=root PROGRAM=/usr/bin/id </pre> 4. Symlink `consolehelper` under the managed program's name (`ln -s /usr/bin/consolehelper /usr/bin/testprog`) and run it as an unprivileged user, both at a graphical session (verifying the `pinentry` prompt) and from a plain console/SSH session (verifying the text PAM conversation). 5. Expected result: after successful authentication per the PAM service's policy, the wrapped program (`/usr/bin/id` in the example) runs with root privileges and its output is shown to the user; failed authentication is rejected with the documented exit code and no privileged program runs. == User Experience == No visible change for end users or administrators. `userhelper` and `consolehelper` behave the same as the C implementation: the same authentication prompts (graphical `pinentry` or console), the same configuration options, and the same error messages/exit codes. == Dependencies == Build-time dependency on a Rust toolchain (`rustc`/`cargo`) and the Rust crates in `Cargo.lock` (notably `pam-client2`, `nix`, `memsecurity`, `zeroize`, `pinentry`, `log`, `thiserror`, `serde`/`serde_json`), all already packaged in Fedora or vendored per standard Rust packaging guidelines. At runtime, `userhelper` depends on `pam` for authentication, same as the C implementation. `consolehelper` depends on `pinentry` for its graphical password prompt. Both are already Fedora packages. No other Fedora packages depend on `usermode` for their build. At runtime, packages such as `mock` depend on `consolehelper` through the symlink convention described above; this rewrite keeps that runtime interface unchanged. == Contingency Plan == * Contingency mechanism: Revert the `usermode` package to the last C implementation build. (Andreas Schneider) * Contingency deadline: Beta freeze. * Blocks release? No. == Documentation == Upstream README, DESIGN.md, and `userhelper(8)`/`consolehelper(8)` man pages: https://gitlab.com/cryptomilk/usermode == Release Notes == `usermode` (`userhelper`/`consolehelper`) is now implemented in Rust instead of C, improving memory safety for this setuid-root component. No configuration or behavior changes are expected; existing `console.apps`/PAM configurations continue to work unchanged. -- Aoife Moloney Fedora Operations Architect Fedora Project Matrix: @amoloney:fedora.im IRC: amoloney -- _______________________________________________ devel-announce mailing list -- devel-announce@lists.fedoraproject.org To unsubscribe send an email to devel-announce-leave@lists.fedoraproject.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/devel-announce@lists.fedoraproject.org Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new