Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I'm using a VPN script for Juniper's Secure Access protocol form here, which executes a binary located under ~/.juniper_networks/network_connect/ncsvc with the following permissions:

-rws--s--x 1 root root 1225424 okt.  25 13:54 ncsvc

But when I do, I get the following error:

ncsvc> Failed to setuid to root. Error 1: Operation not permitted

Moving/copying the ~/.juniper_networks folder to e.g. /opt/juniper (with the same owner permissions), I don't get the error. In the forum thread at Ubuntuforums someone pointed out that it's probably because I have encrypted my /home and thus a "problem" with ecryptfs.

How can I fix this?

share|improve this question

2 Answers 2

The nosuid mount option is used when the eCryptfs mount is set up. This is done for security reasons to prevent privilege escalation attacks.

You can move the ncsvc binary outside of your home directory (just like you did with /opt/juniper/) and create a symlink from your ~/.juniper_networks/network_connect/ncsvc to the new location.

share|improve this answer
    
Yes, but is there a way to make eCryptfs set suid instead of nosuid? The eCryptfs options does not appear in the /etc/fstab file. –  carestad Oct 31 '12 at 14:27
    
No, that is not possible. –  tyhicks Nov 1 '12 at 8:27
    
But why? The same script worked in 12.04, so this change has to be recent. –  carestad Nov 1 '12 at 20:49
1  
Because of security concerns. An unprivileged user could mount a user-created (possibly malicious) filesystem on a USB drive. The mount would be marked nosuid. But then the unprivileged user could mount eCryptfs on top of it and execute setuid-root binaries. This vulnerability was assigned CVE-2012-3409 and was fixed in ecryptfs-utils-99. –  tyhicks Nov 2 '12 at 7:47

I can only think of two work around for the encrypted /home partition.

  1. If you connect to a VPN via a website, start firefox with: sudo firefox since it is likely your /root is not encrypted. After network connect starts you can close the browser and leave the client running in the background.

  2. This is from what was mentioned before. Basically have the client running outside of an encrypted partition:

    rm ~/.juniper_networks
    sudo mkdir /opt/.juniper_networks
    ln -s /opt/.juniper_networks ~/.juniper_networks
    sudo chown yourusername:yourgroupname /opt/.juniper_networks
    

After the above start and proceed with installing network connect again. This time it will be installed in /opt/.juniper_networks.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.