Security Bug - Privilege escalation attack

[ronalchn]

There exists a security issue where any user on the system can obtain root privileges, because isolate is vulnerable to a privilege escalation attack.

The default setup installs isolate with the permissions of 4755, so any user can execute isolate and perform this attack. A corresponding pull request for MOE is at bblackham/moe-cms#3. A demonstration of how it might be performed (without actually performing it), is at https://github.com/ronalchn/isolate-cheater, in the test which uses system-cronjob-writer/main.cpp.

To protect your system against the attack immediately, you can do one of the following:

• delete the isolate executable
• chmod to 4754, chgrp to a new group, and only add to the group users who already have root access
• or just apply this commit

Note that any old copy of the isolate executable can be used as an attack vector - check to see if any old versions are used

isolate: Update from NZOI/moe-cms@ee98549