Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Remote code execution, git, and OS X

rachelbythebay.com

Post reply on HN
Print view View original

71–80 of 385 posts

Re: Remote code execution, git, and OS X

#71

Post by cyphar »

Daviey wrote: post #68

Initially I was shocked that the vendor has files on the system that cannot be changed by the user.. but now I think there is more to it. The real thing that is bugging me, is finding out what /usr/bin/git really is.. which this article doesn't answer. Is it a standalone immutable executable that the file system is aware of, or something else? Right now, I wish I had a mac.

There's a security feature on El Capitan that essentially makes certain files and directories on your host system immutable. Presumably it's some set of filesystem flags, but not even root can change them. There's a magic nvram command you can use to disable the security feature (which if you're a developer you'll have to do eventually since you can't touch anything in /lib or /usr/bin or /bin). The command in question is:

    nvram boot-args="rootless=0"
It seems to me that this is related to that feature. Although, I don't get why it looks like the two files are hardlinked but you can modify one -- maybe it's because this magic was only applied to the /usr/bin directory (and thus a hardlink to the file can still be modified). That's a bit dumb IMO, but I can imagine this being a bug in the OS X kernel.

Unfortunately, I'm not sure how to actually create such files (maybe if I disable System Integrity Protection, create a file and hardlink to it and then re-enable SIP). If I figure it out on my friends' MacBook I'll comment below.

EDIT: Okay, so it might not be what I said earlier. If I do something along the lines of:

1. Disable SIP (csrutil disable in recovery).

2. Create a file in /usr/bin and hardlink it to a non-SIP location (like $HOME).

3. Re-enable SIP (csrutil enable).

4. Try to change the permissions on either of the hardlinks.

It will fail. So presumably SIP correctly propagates permissions to all dentries. I'm not sure what's happening then.

Re: Remote code execution, git, and OS X

#72

Post by cyphar »

valleyer wrote: post #52
mukundmr wrote: post #43

If you execute csrutil disable && reboot, you will be able to disable System Integrity protection and do what you want including fixing /usr/bin/git. What is the problem?

You need to do that from the Recovery OS, by the way.

You can use an nvram command to do it from the main OS.

    nvram boot-args="rootless=0"
EDIT: Actually, it looks like that no longer works. Dammit.

Re: Remote code execution, git, and OS X

#73

Post by brightball »

stephenr wrote: post #39
brightball wrote: post #15

Earlier quoted context omitted.

And at this point the first instruction for any OSX user who downloads and compiles anything is "Install Homebrew"

Except for those who have used it and refuse to use it again. There are prebuilt binaries of up to date git distributed via .pkg. The yeast infection that is Homebrew is unnecessary

That's kind've harsh. What's the issue? Homebrew was about the best option that's existed on OSX for a few years now I thought...

Re: Remote code execution, git, and OS X

#74

Post by [deleted] »

yelnatz wrote: post #49
madeofpalk wrote: post #42

Earlier quoted context omitted.

If you don't have Xcode installed then you don't have git. IIRC, you might have a /usr/bin/git executable but that's not actually git, all it does is shows a GUI that prompts you to install XCode

Thanks. Yea, /usr/bin/git is still there: $ git --version $ git version 2.6.4 (Apple Git-63) But glad to know it won't do anything.

[deleted]

Re: Remote code execution, git, and OS X

#75

Post by Daviey »

cyphar wrote: post #71
Daviey wrote: post #68

Initially I was shocked that the vendor has files on the system that cannot be changed by the user.. but now I think there is more to it. The real thing that is bugging me, is finding out what /usr/bin/git really is.. which this article doesn't answer. Is it a standalone immutable executable that the file system is aware of, or something else? Right now, I wish I had a mac.

There's a security feature on El Capitan that essentially makes certain files and directories on your host system immutable. Presumably it's some set of filesystem flags, but not even root can change them. There's a magic nvram command you can use to disable the security feature (which if you're a developer you'll have to do eventually since you can't touch anything in /lib or /usr/bin or /bin). The command in questi…

Perfect, thank you!

Re: Remote code execution, git, and OS X

#76

Post by pjmlp »

Best part:

> So, what's the big deal? Crappy C code gets exploited every day, and we upgrade it, and then we're "safe" until the next huge hole that's been there forever is reported. (In the meantime, people party with their private stash of vulnerabilities.)

Re: Remote code execution, git, and OS X

#77

Post by [deleted] »

Daviey wrote: post #68

Initially I was shocked that the vendor has files on the system that cannot be changed by the user.. but now I think there is more to it. The real thing that is bugging me, is finding out what /usr/bin/git really is.. which this article doesn't answer. Is it a standalone immutable executable that the file system is aware of, or something else? Right now, I wish I had a mac.

[deleted]

Re: Remote code execution, git, and OS X

#78

Post by atdt »

mukundmr wrote: post #43

If you execute csrutil disable && reboot, you will be able to disable System Integrity protection and do what you want including fixing /usr/bin/git. What is the problem?

The problem is that System Integrity protection was put in place for my benefit and marketed to me as a feature that had been "designed to help prevent potentially malicious software from modifying protected files and folders on [my] Mac", and now that I have it and paid money for it (or the Apple hardware it runs on), I find out that it is making me less secure by preventing me from removing a software component which has a remote code execution vulnerability, and that the only way around that is to disable the feature is by using Recovery to update my computer's NVRAM.

Re: Remote code execution, git, and OS X

#79

Post by groundCode »

bndr wrote: post #7

Why the hate for OS X? Fedora 22 and Fedora 23 have only git 2.4.11 and 2.5.5 in their repositories.

Because Apple have purposefully made it more difficult than it should be for developers to find and disable the vulnerable versions.....and thus far, not released a patch.

Re: Remote code execution, git, and OS X

#80

Post by fniephaus »

Same problem is valid for Python. The subprocess module on El Capitan has a bug that has caused me a lot of trouble recently: http://bugs.python.org/issue26083#msg258011

You'll need to put an updated subprocess.py in your Python path, editing the one provided by OS X is prevented by the System Integrity Protection... ¯\_(ツ)_/¯

Post reply on HN