6 ms·

> Recently I saw a tweet where someone mentioned that you can include /dev/stdin in C code compiled with gcc. This is, to say the very least, surprising. You c

> Recently I saw a tweet where someone mentioned that you can include /dev/stdin in C code compiled with gcc. This is, to say the very least, surprising. You can also call something to read from stdin in your Makefile, or read from stdin in your executable. > But is it equally obvious that the compiler also needs to be sandboxed? Yes. Why wouldn't it be sandboxed?! > I even found one service that ... showed me the hash of the root password. Wow. That's bad. Of course, that's not a compiler issue, but rather a system administration issue. /etc/shadow should not be world-readable. > This effectively means this service is running compile tasks as root. That's quite a leap from 'I can read /etc/shadow' to 'I am root'. > Interestingly, including pseudo-files from /proc does not work. It seems gcc treats them like empty files. More accurately, it seems the system treats them like empty files. gcc does a stat on the file, which returns 'regular file' and 'size=0'. gcc therefore calls read() with a length of 0 bytes.

himinlomax 7y ago
> That's quite a leap from 'I can read /etc/shadow' to 'I am root'. Of all the leaps in that post, that's the least leapy thing. `shadow` exists precisely so that only `root` can read its content, whereas before said content resided in `passwd` which _needs_ to be readable by all. I see only two possibilities here. Either the people who set up that compile service are complete morons and run said compile as actual root in an actual VM; OR, more likely, shit runs in a container with an _apparent_ id of 0 but no actual privilege outside its temporary environment.
- boring_twenties 7y ago
  If it was in a typical container there'd be no hashed password for root, though. Just a ! or *. In fact that's kinda the standard practice anyway nowadays (disallow logging in directly as root), so I'm really not sure what these guys are doing.
- londons_explore 7y ago
  Running as actual root in a VM would be my preferred design. There are lots of times a user might need to apt-get some dependencies for their compile job. Let an attacker do whatever they like in the VM. Then delete the VM between users. Docker containers aren't really a good security barrier, and a VM is much better (although VM escape vulnerabilities aren't unheard of).
  - rbanffy 7y ago
    There are many ways a hostile program inside a VM can escape it and run code on the host or, at least, negatively affect it.
    - arpa 7y ago
      Please do share how can one escape qemu.
      - jacquesm 7y ago
        At your service: https://www.techrepublic.com/article/vm-escape-flaw-in-qemu-allows-for-arbitrary-code-execution-denial-of-service/ https://www.techrepublic.com/article/vm-escape-flaw-in-qemu-...
        softwarelimits 7y ago
        Did you try this on an up2date Linux OS, like eg Debian or Ubuntu? What was your result? Certainly as a real hacker you are not only re-posting "things from the news" but validate everything before posting any comments? Are you? I did not see any relevant content on the websites you mention in your HN profile, I expected some in-depth security publications - maybe update it with some real code that shows us how you are using the mentioned CVE-2019-14378 to perform escapes on any KVM host? Thanks!
        VBprogrammer 7y ago
        I'm trying to understand what your point is, are you denying that there was a vulnerability? As it stands it just sounds like you are just being a jerk on the internet.
        softwarelimits 7y ago
        I am asking for actual code that shows his statement is still true. The statements I read as an answer to my question contain zero value and still lots of very unrelated words. If you are sure there are vulns right now, please publish them. If not, shut up. Nillywilly "computers might be insecure" is on a level I would not expect to read on a side like this one. I just want to keep the quality level high for this news discussion site.
simias 7y ago
>That's quite a leap from 'I can read /etc/shadow' to 'I am root'. Is it? There are alternatives of course but I would say that without further clues that seems the most likely explanation. I agree with the rest of your points though. In general it seems fairly obvious that build systems should be sandboxed if they're building "foreign" code, after all if you can mess with the source code you can probably affect the build system as well, and from there you can basically do anything you want.
yk 7y ago
> Yes. Why wouldn't it be sandboxed?! Famous last words.
megla_ 7y ago
okay champ
antirez 7y ago
> More accurately, it seems the system treats them like empty files. The reason is that the content is generated by a callback that the kernel calls, and the kernel does not want the content to be generated just in order to stat(2) the file, so it shows a zero length, and assumes that things like /bin/cat will just read(2) until EOF is returned, without trying to be too smart.
softwarelimits 7y ago
If that was my server I would of course put a joke in /etc/shadow - did you try to brute force the hashes? It would not be a great surprise to find some obvious funny content if you try?
- boop-the-snoot 7y ago
  That'd be pretty funny :D Like for example, if the entry for root in the joke /etc/shadow was the hash of "Thank you Mario! But our princess is in another castle!"
  - tlavoie 7y ago
    That's a pretty long passphrase, so someone would have to have put it in the word list directly to ever guess something that long. Would be fun though.
- ryanlol 7y ago
  How many of your servers actually have jokes in /etc/shadow?
  - m463 7y ago
    only the shadow knows
ryanlol 7y ago
How many systems have you ran into with world readable /etc/shadow?

himinlomax 7y ago

> That's quite a leap from 'I can read /etc/shadow' to 'I am root'. Of all the leaps in that post, that's the least leapy thing. `shadow` exists precisely so that only `root` can read its content, whereas before said content resided in `passwd` which _needs_ to be readable by all. I see only two possibilities here. Either the people who set up that compile service are complete morons and run said compile as actual root in an actual VM; OR, more likely, shit runs in a container with an _apparent_ id of 0 but no actual privilege outside its temporary environment.

boring_twenties 7y ago
If it was in a typical container there'd be no hashed password for root, though. Just a ! or *. In fact that's kinda the standard practice anyway nowadays (disallow logging in directly as root), so I'm really not sure what these guys are doing.
londons_explore 7y ago
Running as actual root in a VM would be my preferred design. There are lots of times a user might need to apt-get some dependencies for their compile job. Let an attacker do whatever they like in the VM. Then delete the VM between users. Docker containers aren't really a good security barrier, and a VM is much better (although VM escape vulnerabilities aren't unheard of).
- rbanffy 7y ago
  There are many ways a hostile program inside a VM can escape it and run code on the host or, at least, negatively affect it.
  - arpa 7y ago
    Please do share how can one escape qemu.
    - jacquesm 7y ago
      At your service: https://www.techrepublic.com/article/vm-escape-flaw-in-qemu-allows-for-arbitrary-code-execution-denial-of-service/ https://www.techrepublic.com/article/vm-escape-flaw-in-qemu-...
      - softwarelimits 7y ago
        Did you try this on an up2date Linux OS, like eg Debian or Ubuntu? What was your result? Certainly as a real hacker you are not only re-posting "things from the news" but validate everything before posting any comments? Are you? I did not see any relevant content on the websites you mention in your HN profile, I expected some in-depth security publications - maybe update it with some real code that shows us how you are using the mentioned CVE-2019-14378 to perform escapes on any KVM host? Thanks!
        VBprogrammer 7y ago
        I'm trying to understand what your point is, are you denying that there was a vulnerability? As it stands it just sounds like you are just being a jerk on the internet.
        softwarelimits 7y ago
        I am asking for actual code that shows his statement is still true. The statements I read as an answer to my question contain zero value and still lots of very unrelated words. If you are sure there are vulns right now, please publish them. If not, shut up. Nillywilly "computers might be insecure" is on a level I would not expect to read on a side like this one. I just want to keep the quality level high for this news discussion site.

simias 7y ago

>That's quite a leap from 'I can read /etc/shadow' to 'I am root'. Is it? There are alternatives of course but I would say that without further clues that seems the most likely explanation. I agree with the rest of your points though. In general it seems fairly obvious that build systems should be sandboxed if they're building "foreign" code, after all if you can mess with the source code you can probably affect the build system as well, and from there you can basically do anything you want.

yk 7y ago

> Yes. Why wouldn't it be sandboxed?! Famous last words.

megla_ 7y ago

okay champ

antirez 7y ago

> More accurately, it seems the system treats them like empty files. The reason is that the content is generated by a callback that the kernel calls, and the kernel does not want the content to be generated just in order to stat(2) the file, so it shows a zero length, and assumes that things like /bin/cat will just read(2) until EOF is returned, without trying to be too smart.

softwarelimits 7y ago

If that was my server I would of course put a joke in /etc/shadow - did you try to brute force the hashes? It would not be a great surprise to find some obvious funny content if you try?

boop-the-snoot 7y ago
That'd be pretty funny :D Like for example, if the entry for root in the joke /etc/shadow was the hash of "Thank you Mario! But our princess is in another castle!"
- tlavoie 7y ago
  That's a pretty long passphrase, so someone would have to have put it in the word list directly to ever guess something that long. Would be fun though.
ryanlol 7y ago
How many of your servers actually have jokes in /etc/shadow?
- m463 7y ago
  only the shadow knows

ryanlol 7y ago

How many systems have you ran into with world readable /etc/shadow?