From mboxrd@z Thu Jan  1 00:00:00 1970
X-Spam-Checker-Version: SpamAssassin 3.4.4 (2020-01-24) on inbox.vuxu.org
X-Spam-Level: 
X-Spam-Status: No, score=0.2 required=5.0 tests=DKIM_INVALID,DKIM_SIGNED,
	T_SCC_BODY_TEXT_LINE autolearn=no autolearn_force=no version=3.4.4
Received: (qmail 17764 invoked from network); 10 May 2022 06:43:06 -0000
Received: from 9front.inri.net (168.235.81.73)
  by inbox.vuxu.org with ESMTPUTF8; 10 May 2022 06:43:06 -0000
Received: from mail.posixcafe.org ([45.76.19.58]) by 9front; Tue May 10 02:40:52 -0400 2022
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=posixcafe.org;
	s=20200506; t=1652164847;
	h=from:from:reply-to:subject:subject:date:date:message-id:message-id:
	 to:to:cc:mime-version:mime-version:content-type:content-type:
	 content-transfer-encoding:content-transfer-encoding;
	bh=T/rcpSJmkB/1vTCHFyMU1J0x2hYWLTH7FQYmkRs7nzQ=;
	b=GOlhR7WSIlhDOgNKDA87HxGYJxfFOttqDtsdsUJL+QCOqq1lYa4Hs06lJwjFuIyATGkmzY
	WX7mkCqT+D9vMfEfCbhERt/8G/QDw9AuUhX7U+QCuhWGjX8/McLfqJbKt3FJf+sC7/zPbM
	l0BddpLXxbouBpy8M7kqyDoMwaI/CQs=
Received: from [192.168.168.200] (161-97-228-135.lpcnextlight.net [161.97.228.135])
	by mail.posixcafe.org (OpenSMTPD) with ESMTPSA id 789eec6f (TLSv1.3:TLS_AES_256_GCM_SHA384:256:NO)
	for <9front@9front.org>;
	Tue, 10 May 2022 01:40:47 -0500 (CDT)
Message-ID: <28db6450-6d7c-977f-aaff-62f152e79968@posixcafe.org>
Date: Tue, 10 May 2022 00:40:44 -0600
MIME-Version: 1.0
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101
 Thunderbird/91.8.1
Content-Language: en-US
To: 9front@9front.org
From: Jacob Moody <moody@mail.posixcafe.org>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 7bit
List-ID: <9front.9front.org>
List-Help: <http://lists.9front.org>
X-Glyph: ➈
X-Bullshit: transactional stateless standard engine-oriented session-scale optimizer 
Subject: [9front] [PATCH] kernel: disallow executing from #| or #d
Reply-To: 9front@9front.org
Precedence: bulk

Hello,

I noticed that you could execute from #| and #d.
ex:

cpu% bind '#|' /n/pipetest
cpu% /n/pipetest/data1 &
cpu% echo '#!/bin/rc' >> /n/pipetest/data
cpu% echo 'echo hello' >> /n/pipetest/data
cpu% hello

I believe this would also work for binaries
if the writer could predict what parts of the binary
the kernel will want to read. I am inclined to
block this behavior but would be curious what others
think. Included is a patch to error on OEXEC opens
in devdup and devpipe.

thanks,
moody

---
diff 6ca8e6bbafcc871301a90aa7bd4ca10533b1999a 521f304f5db4c74740b3e00503e2bf22e9f60dc6
--- a/sys/src/9/port/devdup.c	Mon May  9 11:22:00 2022
+++ b/sys/src/9/port/devdup.c	Tue May 10 00:35:16 2022
@@ -63,7 +63,7 @@
 	Chan *f;
 	int fd, twicefd;

-	if(omode & ORCLOSE)
+	if(omode & ORCLOSE || omode & OEXEC)
 		error(Eperm);
 	if(c->qid.type & QTDIR){
 		if(omode != 0)
--- a/sys/src/9/port/devpipe.c	Mon May  9 11:22:00 2022
+++ b/sys/src/9/port/devpipe.c	Tue May 10 00:35:16 2022
@@ -228,6 +228,8 @@
 		c->offset = 0;
 		return c;
 	}
+	if(omode == OEXEC)
+		error(Eperm);

 	p = c->aux;
 	qlock(p);