5

I'm using a VPN script for Juniper's Secure Access protocol form here, which executes a binary located under ~/.juniper_networks/network_connect/ncsvc with the following permissions:

-rws--s--x 1 root root 1225424 okt.  25 13:54 ncsvc

But when I do, I get the following error:

ncsvc> Failed to setuid to root. Error 1: Operation not permitted

Moving/copying the ~/.juniper_networks folder to e.g. /opt/juniper (with the same owner permissions), I don't get the error. In the forum thread at Ubuntuforums someone pointed out that it's probably because I have encrypted my /home and thus a "problem" with ecryptfs.

How can I fix this?

Improve this question

2 Answers 2

Reset to default
5

The nosuid mount option is used when the eCryptfs mount is set up. This is done for security reasons to prevent privilege escalation attacks.

You can move the ncsvc binary outside of your home directory (just like you did with /opt/juniper/) and create a symlink from your ~/.juniper_networks/network_connect/ncsvc to the new location.

Improve this answer
4
  • Yes, but is there a way to make eCryptfs set suid instead of nosuid? The eCryptfs options does not appear in the /etc/fstab file.
    – carestad
    Oct 31, 2012 at 14:27
  • No, that is not possible.
    – tyhicks
    Nov 1, 2012 at 8:27
  • But why? The same script worked in 12.04, so this change has to be recent.
    – carestad
    Nov 1, 2012 at 20:49
  • 1
    Because of security concerns. An unprivileged user could mount a user-created (possibly malicious) filesystem on a USB drive. The mount would be marked nosuid. But then the unprivileged user could mount eCryptfs on top of it and execute setuid-root binaries. This vulnerability was assigned CVE-2012-3409 and was fixed in ecryptfs-utils-99.
    – tyhicks
    Nov 2, 2012 at 7:47
1

I can only think of two work around for the encrypted /home partition.

  1. If you connect to a VPN via a website, start firefox with: sudo firefox since it is likely your /root is not encrypted. After network connect starts you can close the browser and leave the client running in the background.

  2. This is from what was mentioned before. Basically have the client running outside of an encrypted partition:

    rm ~/.juniper_networks
sudo mkdir /opt/.juniper_networks
ln -s /opt/.juniper_networks ~/.juniper_networks
sudo chown yourusername:yourgroupname /opt/.juniper_networks

After the above start and proceed with installing network connect again. This time it will be installed in /opt/.juniper_networks.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .