Passenger on Big Sur potential privilege escalation vulnerability detected

Viewed 56

New installation of Passenger using homebrew on Big Sur. Because of the new location (I'm coming from an El Capitan box) of homebrew installations inside /opt/homebrew, Passenger isn't happy because it's something I can see from the set permissions. The error:

2021/03/19 09:22:16 [warn] 85#0: 1024 worker_connections exceed open file resource limit: 256
[ N 2021-03-19 09:22:16.2962 31353/T1 age/Wat/WatchdogMain.cpp:1373 ]: Starting Passenger watchdog...
[ N 2021-03-19 09:22:16.3519 31355/T1 age/Cor/CoreMain.cpp:1340 ]: Starting Passenger core...
[ N 2021-03-19 09:22:16.3521 31355/T1 age/Cor/CoreMain.cpp:256 ]: Passenger core running in multi-application mode.
[ W 2021-03-19 09:22:16.3944 31355/T1 age/Cor/CoreMain.cpp:1007 ]: WARNING: potential privilege escalation vulnerability detected. Phusion Passenger is running as root, and part(s) of the Passenger root path (/opt/homebrew/opt/passenger/libexec/src/ruby_supportlib/phusion_passenger/locations.ini) can be changed by non-root user(s):

 - /opt/homebrew/opt/passenger/libexec/src/ruby_supportlib/phusion_passenger/locations.ini is not secure: it can be modified by user rich
 - /opt/homebrew/opt/passenger/libexec/src/ruby_supportlib/phusion_passenger is not secure: it can be modified by user rich
 - /opt/homebrew/opt/passenger/libexec/src/ruby_supportlib is not secure: it can be modified by user rich
 - /opt/homebrew/opt/passenger/libexec/src is not secure: it can be modified by user rich
 - /opt/homebrew/opt/passenger/libexec is not secure: it can be modified by user rich
 - /opt/homebrew/opt/passenger is not secure: it can be modified by user rich
 - /opt/homebrew/opt is not secure: it can be modified by user rich
 - /opt/homebrew is not secure: it can be modified by user rich

It is a warming, but I'm not sure if it's limping or fully functional.

Should I worry? Should I change anything? Will this go away? Seems it's been designed this way, but I see warnings.

Any insight appreciated. Thank you.

0 Answers
Related