Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Run unknown shell script with a line-by-line confirmation prompt

gist.github.com

Post reply on HN
Print view View original

71–80 of 86 posts

Re: Show HN: Run unknown shell script with a line-by-line confirmation prompt

#71

Post by qqii »

dwohnitmok wrote: post #56
cookiengineer wrote: post #44

What would be amazing is a tool that analyses the script first, figures out folders and files (and networking) it influences and allows to sandbox it accordingly. This script wants to modify: - /usr/local/program/* - /etc/program/* - $HOME/.program Do you want to execute this? [Yes/No] ..because you know, what happens when you execute a script that does rm -rf /usr in the 100th step?

In its full generality this runs afoul of the halting problem. That doesn't mean what you want is completely unattainable, you just need to figure out whether you're okay with false positives, false negatives, or your tool just giving up on certain scripts (or some combination thereof).

False positives (this program could access these file locations) seems like a reasonable tradeoff.

Re: Show HN: Run unknown shell script with a line-by-line confirmation prompt

#72

Post by usr1106 »

rgoulter wrote: post #68
aroulin wrote: post #64

Earlier quoted context omitted.

doesn't the halting problem only hold if you have infinite memory?

I've seen this argument that 'halting problem is undecideable': http://www.lel.ed.ac.uk/~gpullum/loopsnoop.html The argument doesn't rely on infinite memory.

With finite memory and no external inputs an observer can enumerate all possible states.

In real systems external inputs provide an infinite source of "memory" to read from.

Re: Show HN: Run unknown shell script with a line-by-line confirmation prompt

#73

Post by lloeki »

dwohnitmok wrote: post #56
cookiengineer wrote: post #44

What would be amazing is a tool that analyses the script first, figures out folders and files (and networking) it influences and allows to sandbox it accordingly. This script wants to modify: - /usr/local/program/* - /etc/program/* - $HOME/.program Do you want to execute this? [Yes/No] ..because you know, what happens when you execute a script that does rm -rf /usr in the 100th step?

In its full generality this runs afoul of the halting problem. That doesn't mean what you want is completely unattainable, you just need to figure out whether you're okay with false positives, false negatives, or your tool just giving up on certain scripts (or some combination thereof).

I would be fine with a static analyser doing the last one (giving up in doubt), considering that install scripts are a smaller subset of all possible shell scripts.

Such a static analyser would have two interesting aspects: on the end user side, the one mentioned of outputting the touched paths, and also doubling as being a linter for the script developer.

Re: Show HN: Run unknown shell script with a line-by-line confirmation prompt

#74

Post by tessellated »

opk wrote: post #2

You can also do this with bashdb which is possibly also a more robust solution.

Yes, I was instantly reminded of the time I implemented the core functionality of the 'time' command in shellscript, only to find out about it months later.

Re: Show HN: Run unknown shell script with a line-by-line confirmation prompt

#75

Post by krageon »

cookiengineer wrote: post #44

What would be amazing is a tool that analyses the script first, figures out folders and files (and networking) it influences and allows to sandbox it accordingly. This script wants to modify: - /usr/local/program/* - /etc/program/* - $HOME/.program Do you want to execute this? [Yes/No] ..because you know, what happens when you execute a script that does rm -rf /usr in the 100th step?

You could do this by running your script pivot mounted into a namespace that mounts your "real" filesystem as readonly and layers with overlayfs to log changes. You can then terminate the script if the overlay diff gets too large (I assume on a 100GB disk you don't want 60GB of changes, and in any case you could tell it what to expect beforehand). That saves you having to do all this complicated analysing for files and folders and replaces it with something relatively foolproof.

Re: Show HN: Run unknown shell script with a line-by-line confirmation prompt

#76

Post by krageon »

klyrs wrote: post #70
junon wrote: post #66

Earlier quoted context omitted.

A browser extension is not a threat model, I'm not sure what you mean.

Browser extensions are an attack surface, examination of which is a key aspect of threat modeling.

It depends on whether or not your threat model includes threats likely to exploit this attack surface. I'm assuming this is why GP said that a browser extension isn't a threat model.

Re: Show HN: Run unknown shell script with a line-by-line confirmation prompt

#77

Post by joosters »

vanviegen wrote: post #59
dwohnitmok wrote: post #58

Earlier quoted context omitted.

This would still be defeated by any script that is nondeterministic which is a real possibility if you're trying to defend against malicious scripts or against very poorly written scripts.

You wouldn't need to run the script twice. Just apply the file modifications when the user okays them.

But the modifications might not be valid in the real system. For example, imagine a script that adds a new user to the system: in the container, it picks a new user ID that is free. A diff of the filesystem will show a new line being added to /etc/passwd - seems OK, right? But the user ID picked might clash with one on the real system, causing everything to fail when you apply the change.

Re: Show HN: Run unknown shell script with a line-by-line confirmation prompt

#78

Post by kevincox »

Skunkleton wrote: post #36
protomyth wrote: post #12

It would be interesting to have a shell that allowed transactions like a database and could list what files have been affected while in the transaction.

You could snapshot your filesystem, then run the script and diff against the snapshot. Isolating executables (even shell scripts) is really outside the scope of what a shell normally provides.

This sort of provides rollbacks but not isolation. You would have to rollback all chances that happened to the filesystem (or the whole system if you don't know what filesystems were touched by the program) during the period between snapshot and when you finish your inspection.

It would be interesting if you could mount the snapshot then attempt to merge in the changes to the live system once approved. I don't know if any filesystems that support merges though.

Re: Show HN: Run unknown shell script with a line-by-line confirmation prompt

#79

Post by harperlee »

lloeki wrote: post #73
dwohnitmok wrote: post #56

Earlier quoted context omitted.

In its full generality this runs afoul of the halting problem. That doesn't mean what you want is completely unattainable, you just need to figure out whether you're okay with false positives, false negatives, or your tool just giving up on certain scripts (or some combination thereof).

I would be fine with a static analyser doing the last one (giving up in doubt), considering that install scripts are a smaller subset of all possible shell scripts. Such a static analyser would have two interesting aspects: on the end user side, the one mentioned of outputting the touched paths, and also doubling as being a linter for the script developer.

Or just raising attention to the weird commands that trips its analysis up, just in case they are path obfuscation. That should be easy to spot for the admin...

Re: Show HN: Run unknown shell script with a line-by-line confirmation prompt

#80

Post by kevincox »

jjnoakes wrote: post #18
klyrs wrote: post #13

Earlier quoted context omitted.

One complication is that websites can hijack your copy buffer, and the text you paste isn't the text you copied. I avoid this by pasting into an editor, not directly into a shell.

Excuse my ignorance but when are you copying commands from a site you don't trust? If I don't trust a site I don't run anything it suggests to me, copy hijacking or no.

Because I just read the command on the site and I trusted my verification of the command.

But if the site is nefarious it can adjust my copy so that I copy a mailious command rather than the one I verified.

Post reply on HN