Show HN: Run unknown shell script with a line-by-line confirmation prompt • Hacker News Board

Re: Show HN: Run unknown shell script with a line-by-line confirmation prompt

#51

Post by lillecarl » Thu, Apr 15, 2021, 4:19 AM UTC

barbazoo wrote: post #41

dumpsterdiver wrote: post #30

Earlier quoted context omitted.

I understand your point, but there is a big difference between running a 20 year old program written in C and running a shell script that someone with one or two years of experience hacked out in ten minutes. To answer your question, I do fuzz many of the GNU utilities that I use regularly, and I have discovered vulnerabilities that way. Of course it is unreasonable to read all of the code that runs in our operating…

Plus the risk associated with running Linux or any of the executables is orders of magnitude lower than copy/pasting and running a bash script one found on the internet.

The same can't be said for npm packages and people still use them.

Re: Show HN: Run unknown shell script with a line-by-line confirmation prompt

#52

Post by vanviegen » Thu, Apr 15, 2021, 4:40 AM UTC

mlyle wrote: post #45

cookiengineer wrote: post #44

What would be amazing is a tool that analyses the script first, figures out folders and files (and networking) it influences and allows to sandbox it accordingly. This script wants to modify: - /usr/local/program/* - /etc/program/* - $HOME/.program Do you want to execute this? [Yes/No] ..because you know, what happens when you execute a script that does rm -rf /usr in the 100th step?

Very difficult to do in any kind of robust way. A script can run all kinds of things and use myriad forms of obfuscation, causing all kinds of obscure side effects.

I imagine this could be done by actually running the script in some sort of sandbox, having file changes written to overlayfs at first.

This would still allow the script to steal data though, as installer script generally require internet access.

Re: Show HN: Run unknown shell script with a line-by-line confirmation prompt

#53

Post by MereInterest » Thu, Apr 15, 2021, 4:40 AM UTC

renewiltord wrote: post #42

jjnoakes wrote: post #18

Earlier quoted context omitted.

Excuse my ignorance but when are you copying commands from a site you don't trust? If I don't trust a site I don't run anything it suggests to me, copy hijacking or no.

Realistically, I copy all sorts of commands from all sorts of sites. Some fool has a blog saying "Run `kubectl blahblah -o yaml`" and I copy `kubectl blahblah -o yaml` but he can then inject nonsense in it so when I paste it something else runs. Fortunately, my terminal emulator doesn't run on paste.

Which terminal emulator do you use, and what happens if you paste something including newline characters?

Re: Show HN: Run unknown shell script with a line-by-line confirmation prompt

#54

Post by renewiltord » Thu, Apr 15, 2021, 4:53 AM UTC

MereInterest wrote: post #53

renewiltord wrote: post #42

Earlier quoted context omitted.

Realistically, I copy all sorts of commands from all sorts of sites. Some fool has a blog saying "Run `kubectl blahblah -o yaml`" and I copy `kubectl blahblah -o yaml` but he can then inject nonsense in it so when I paste it something else runs. Fortunately, my terminal emulator doesn't run on paste.

Which terminal emulator do you use, and what happens if you paste something including newline characters?

Gnome Terminal 3.36.2 with Zsh

The entire newline-inclusive text is pasted into the terminal and nothing is run until I hit Return.

Input: https://pastebin.com/LpDW2r0d

Result: https://streamable.com/94z5oq

Re: Show HN: Run unknown shell script with a line-by-line confirmation prompt

#55

Post by dang » Thu, Apr 15, 2021, 5:24 AM UTC

barbazoo wrote: post #4

> Useful for running unknown scripts Or just, you know, read them before you run them.

"Please respond to the strongest plausible interpretation of what someone says, not a weaker one that's easier to criticize. Assume good faith."

"Please don't post shallow dismissals, especially of other people's work. A good critical comment teaches us something."

https://news.ycombinator.com/newsguidelines.html

Re: Show HN: Run unknown shell script with a line-by-line confirmation prompt

#56

Post by dwohnitmok » Thu, Apr 15, 2021, 5:25 AM UTC

cookiengineer wrote: post #44

What would be amazing is a tool that analyses the script first, figures out folders and files (and networking) it influences and allows to sandbox it accordingly. This script wants to modify: - /usr/local/program/* - /etc/program/* - $HOME/.program Do you want to execute this? [Yes/No] ..because you know, what happens when you execute a script that does rm -rf /usr in the 100th step?

In its full generality this runs afoul of the halting problem.

That doesn't mean what you want is completely unattainable, you just need to figure out whether you're okay with false positives, false negatives, or your tool just giving up on certain scripts (or some combination thereof).

Re: Show HN: Run unknown shell script with a line-by-line confirmation prompt

#57

Post by ipsin » Thu, Apr 15, 2021, 5:29 AM UTC

junon wrote: post #34

klyrs wrote: post #19

Earlier quoted context omitted.

I distrust every site. What sites do you trust, and why do you assume they haven't been hacked or xss'd?

Because that's an unrealistic threat model for most users.

I think the most realistic threat model right now is "subverted browser extension", which is effectively equivalent to internet-wide XSS. Luckily I've only been hit once, and with adware, but it's a risk.

Re: Show HN: Run unknown shell script with a line-by-line confirmation prompt

#58

Post by dwohnitmok » Thu, Apr 15, 2021, 5:30 AM UTC

vanviegen wrote: post #52

mlyle wrote: post #45

Earlier quoted context omitted.

Very difficult to do in any kind of robust way. A script can run all kinds of things and use myriad forms of obfuscation, causing all kinds of obscure side effects.

I imagine this could be done by actually running the script in some sort of sandbox, having file changes written to overlayfs at first. This would still allow the script to steal data though, as installer script generally require internet access.

This would still be defeated by any script that is nondeterministic which is a real possibility if you're trying to defend against malicious scripts or against very poorly written scripts.

Re: Show HN: Run unknown shell script with a line-by-line confirmation prompt

#59

Post by vanviegen » Thu, Apr 15, 2021, 6:07 AM UTC

dwohnitmok wrote: post #58

vanviegen wrote: post #52

Earlier quoted context omitted.

I imagine this could be done by actually running the script in some sort of sandbox, having file changes written to overlayfs at first. This would still allow the script to steal data though, as installer script generally require internet access.

This would still be defeated by any script that is nondeterministic which is a real possibility if you're trying to defend against malicious scripts or against very poorly written scripts.

You wouldn't need to run the script twice. Just apply the file modifications when the user okays them.

Re: Show HN: Run unknown shell script with a line-by-line confirmation prompt

#60

Post by imhoguy » Thu, Apr 15, 2021, 6:23 AM UTC

cookiengineer wrote: post #44

What would be amazing is a tool that analyses the script first, figures out folders and files (and networking) it influences and allows to sandbox it accordingly. This script wants to modify: - /usr/local/program/* - /etc/program/* - $HOME/.program Do you want to execute this? [Yes/No] ..because you know, what happens when you execute a script that does rm -rf /usr in the 100th step?

Such can be easily implemented on top of Docker filesystem overlays/snapshots. You just run the script in question e.g. in fresh Ubuntu container and then compare overlay directories to see what changed.