Cloud IAM Governance: The Architecture of Google Cloud OS Login

In enterprise cloud environments running on Google Cloud Platform (GCP), OS Login is the strategic access management bridge connecting Google Cloud Identity and Access Management (IAM) to standard Linux operating system user accounts. Rather than managing static, un-rotated SSH keys across thousands of Google Compute Engine (GCE) virtual machine instances, OS Login links POSIX user profiles directly to Google Workspace and Cloud Identity accounts.

To ensure strict separation of duties, Google Cloud IAM defines two primary roles for virtual machine access:

  • roles/compute.osLogin: Grants standard, unprivileged SSH access to the VM instance without sudo or root administrative execution capabilities.
  • roles/compute.osAdminLogin: Grants administrative SSH access, automatically placing the user in the instance's sudo and google-sudoers groups.

The vulnerability cataloged as CVE-2020-8903 represents a breakdown of this fundamental cloud governance boundary. Carrying a severity rating of CVSS 8.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N), the defect allows a user possessing only standard roles/compute.osLogin access to escalate privileges to root, completely bypassing IAM role restrictions.

Root Cause Mechanics: Insecure Temporary IPC Sockets (CWE-269)

The vulnerability resides within the google-guest-agent and guest-oslogin daemon packages (versions between 20190304 and 20200507) running inside the Linux guest operating system:

  • Un-sanitized Shared Socket Directory: The guest agent daemon—which executes with superuser root privileges to synchronize IAM user accounts, manage SSH keys, and configure Pluggable Authentication Modules (PAM)—established inter-process communication (IPC) UNIX domain sockets inside shared temporary directories (e.g., /tmp or /var/run) without enforcing restrictive umask or directory ownership checks.
  • Symlink Following & Socket Hijacking: A low-privileged local user logged in via standard OS Login can predict socket file paths and construct malicious symbolic links or pre-create UNIX sockets before the root guest agent initializes.
  • Arbitrary File Overwrite to Root Execution: When the root guest agent daemon writes user synchronization data, it follows the attacker's symlink, allowing arbitrary file overwrites across sensitive system configuration paths (such as /etc/sudoers.d/ or /etc/pam.d/sshd). The attacker inserts a custom sudoers rule granting their unprivileged account password-less sudo access:
# Attack Sequence Exploiting CVE-2020-8903 inside GCE VM
# Logged in as standard unprivileged user: john_doe_example_com

# 1. Create a symlink in shared temporary directory pointing to sudoers
ln -s /etc/sudoers.d/99_oslogin_backdoor /tmp/.google_guest_socket_tmp

# 2. Wait for google-guest-agent periodic synchronization (or trigger via metadata update)
# Daemon follows symlink and writes data with root permissions

# 3. Elevate to root via sudo
sudo -i
# [root@gce-instance ~]# id
# uid=0(root) gid=0(root) groups=0(root)

Cloud Security Best Practices & IAM Hardening

Defensive Layer Cloud Control Engineering Recommendation
Guest OS Packages Update guest-oslogin Upgrade guest packages to version 20200507 or higher across all base VM images and Compute Engine templates.
Metadata Security Block Project-Wide SSH Keys Set block-project-ssh-keys=true in metadata to enforce OS Login as the exclusive access mechanism.
IAM Audit Least Privilege Review Audit GCP IAM bindings to ensure users are not over-provisioned with roles/compute.instanceAdmin.
Runtime Monitoring Security Command Center Enable Google Cloud Security Command Center (SCC) Event Threat Detection to alert on unexpected local privilege escalation events.

Verification Commands for Cloud Engineering Teams

Cloud security engineers can verify guest package versions across Compute Engine instances using Google Cloud SDK: 

# Query installed guest-oslogin version on Debian / Ubuntu instances
dpkg -l | grep -E "google-compute-engine-oslogin|google-guest-agent"

# Query installed guest-oslogin version on RHEL / Rocky / CentOS instances
rpm -qa | grep -E "google-compute-engine-oslogin|google-guest-agent"

# Update guest packages to latest patched builds
sudo apt-get update && sudo apt-get install --only-upgrade google-compute-engine-oslogin