From mboxrd@z Thu Jan 1 00:00:00 1970 X-Spam-Checker-Version: SpamAssassin 3.4.4 (2020-01-24) on inbox.vuxu.org X-Spam-Level: X-Spam-Status: No, score=-1.0 required=5.0 tests=MAILING_LIST_MULTI, T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.4 Received: (qmail 3520 invoked from network); 1 Aug 2023 21:52:56 -0000 Received: from minnie.tuhs.org (2600:3c01:e000:146::1) by inbox.vuxu.org with ESMTPUTF8; 1 Aug 2023 21:52:56 -0000 Received: from minnie.tuhs.org (localhost [IPv6:::1]) by minnie.tuhs.org (Postfix) with ESMTP id 6EF8541011; Wed, 2 Aug 2023 07:52:51 +1000 (AEST) Received: from sdaoden.eu (sdaoden.eu [217.144.132.164]) by minnie.tuhs.org (Postfix) with ESMTPS id 55C3C40F9B for ; Wed, 2 Aug 2023 07:52:47 +1000 (AEST) Date: Tue, 01 Aug 2023 23:52:44 +0200 Author: Steffen Nurpmeso From: Steffen Nurpmeso To: "Ron Natalie" Message-ID: <20230801215244.WTv6e%steffen@sdaoden.eu> In-Reply-To: References: <20230801204800.wvlfp%steffen@sdaoden.eu> Mail-Followup-To: "Ron Natalie" , "The Eunuchs Hysterical Society" User-Agent: s-nail v14.9.24-499-g5e26999314 OpenPGP: id=EE19E1C1F2F7054F8D3954D8308964B51883A0DD; url=https://ftp.sdaoden.eu/steffen.asc; preference=signencrypt BlahBlahBlah: Any stupid boy can crush a beetle. But all the professors in the world can make no bugs. MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Message-ID-Hash: V7KENFQZZFQ2VEC2TGV3UFPT4JQL547L X-Message-ID-Hash: V7KENFQZZFQ2VEC2TGV3UFPT4JQL547L X-MailFrom: steffen@sdaoden.eu X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: The Eunuchs Hysterical Society X-Mailman-Version: 3.3.6b1 Precedence: list Subject: [TUHS] Re: shell escapes in utilities List-Id: The Unix Heritage Society mailing list Archived-At: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: Ron Natalie wrote in : |Even without shell escapes there are fun and cames with abusing setuid=20 |(but accessible) programs. |Things like opening all the available file descriptors, closing=20 |stdin/out/err before invocation, doing things to overrun buffers, etc=E2= =80=A6 Of course. Even experienced programmers still make errors, or kernel bugs introduce problems which even such a programmer did not take into account. (Like that isatty(3) uses "a" IOCTL, and a Linux bug caused local root exploit of any SETUID program that uses C stdio's stdout (testing ISO C's "whether output shall be line or fully buffered"), as seen earlier this year i think.) This is for my convenience, one could "overlayfs them away". ..And my user account has a number of capabilities, starting X, accessing audio and video, starting QEMU instances, changing files under /x/{src,iso,os,doc} etc. $ groups audio video cdrom input kvm _icmp users steffen ports doc backups shared = media vm code And brute forcing/attacking the encfs ~/.sic where keys are stored to access more one could. At least, via the ACPI that Linux thankfully supports on this box, all (other) encfs are unloaded, and (all) X displays are locked (via slock, requiring password to unlock) when the display is closed. And all keys are removed from all SSH agents, even though this is hard because even root cannot simply signal this as would be possible with gnupg based agents. Ie. act 'pkill -HUP gpg-agent >/dev/null 2>&1 &' inc vs for a in /tmp/ssh-*/agent.*; do [ -e "$a" ] || continue act "SSH_AUTH_SOCK=3D\"$a\" ssh-add -D /dev/null 2>&1 &" inc 1 2 done which prevents personal /tmp directories (or requires work). (Asynchronousity of signals hopefully no attack vector / problem.) No healing in sight for this. On the server there is only # find /sbin /bin /usr/sbin /usr/bin -perm /4000 /bin/bbsuid but most daemons will not even be able to find that, or much in their /dev/ etc. Like my local web browser, which is, except for armed perpetrators, the far biggest attack surface here. --steffen | |Der Kragenbaer, The moon bear, |der holt sich munter he cheerfully and one by one |einen nach dem anderen runter wa.ks himself off |(By Robert Gernhardt)