Live data from Hacker News

Beep security update

debian.org

61–70 of 103 posts

Re: Beep security update

#61
post #41

Earlier quoted context omitted.

It can't be done in general. A signal handler is just a function that at runtime is connected to a signal. With some work many or most unsafe handlers in the wild can be detected, but so can many other problems, I guess.

Perhaps a better question is why signal handlers have these restrictions, and why they don't behave more like e.g. threads.

Because they were modeled after interrupts, and can't be changed for historical reasons. (E.g. any code which relies on the atomicity of a signal handler with respect to its context thread would break.)

Signal handlers were always meant to be "top-half" interrupt handlers -- set a flag or put something in a queue for the main thread to process. signalfd(2) formalized this usage.

Re: Beep security update

#62
post #19

The author of beep needs to read the POSIX specification on async-signal-safety [1]. In particular, it is not safe to call exit, free, ioctl, putchar, or perror from a signal handler. [1] http://pubs.opengroup.org/onlinepubs/9699919799/functions/V2...

> In particular, it is not safe to call exit, free, ioctl, putchar, or perror from a signal handler. Why is it accepted by the compiler, then?

This is a good question and doesn't deserve to be downvoted.

I think the reason must be that the problem lies in the intersection of three areas of development (the C programming language, the C standard library, and the POSIX operating system definition) and so requires coordination to solve.

Think about how you would implement warnings for failures of async-signal-safety. One approach would go like this:

1. In compiler front-ends, introduce a new attribute that can be attached to function declarations to indicate that they are async-signal-safe, for example __attribute__((async_signal_safe)), and a new attribute that can be attached to function parameters and struct members to indicate that the passed value must be async-signal-safe, for example __attribute__((require_async_signal_safe)).

2. In C library headers, apply the async_signal_safe attribute to all the async-signal-safe function declarations, and apply the require_async_signal_safe attribute to the parameter to the signal function and to the sa_handler member of struct sigaction.

3. In compilers, propagate the async_signal_safe attribute, so that any function that only calls async_signal_safe functions is also marked with the attribute.

4. In compilers, check that when a function is passed to a parameter or assigned to a member with the require_async_signal_safe attribute, the function is marked with the async_signal_safe attribute, and issue a warning if not.

This doesn't solve the whole problem (sometimes the compiler will not be able to know which function is going to be passed as the parameter to signal, because this is determined at runtime), and it might have false positives in obscure situations (you might in theory use a struct sigaction for some other purpose and never pass it to sigaction) but it would catch many cases, including the one in beep.

But notice the amount of coordination required. It would require input from several people with different areas of expertise.

Re: Beep security update

#63
post #44

Earlier quoted context omitted.

Simply displaying a character doesn't need sudo at all anyway, so just echo -e "\07"

`sudo` isn't there for displaying the character, it's there for ioctl to have permissions to play the beep on remote terminals[1]. I think some terminal emulators (eg Konsole) will just read char 7 and play a system defined WAV or other workaround but your more classic terminals (eg xterm) would potentially have difficulties calling the system bell. [1] for reference: Xorg terminals are also classed as remote termina…

Even in that case, you'd have to run the terminal as root. Running echo as root won't do anything. X11 also has beep functionality built in, which is what I'd expect xterm to use.

Re: Beep security update

#64
post #43

Earlier quoted context omitted.

The Debian patch with diff highlighting: https://gist.github.com/jwilk/561ae35894756aae1e31503d0c52db... AFAICS, it does this: 1) Fixes use of uninitialized memory. 2) Fixes double-free in the signal handler. 3) Makes sure that the device is opened only once. I still don't understand what exactly the bug is supposed to be. I also don't understand what is the purpose of 3). With this fix applied, it's still possible f…

How did you find the Debian patch? http://git.deb.at/w/pkg/beep.git doesn't seem to have any changes.

Probably not in that repo as the upload was done by the security team.

Best way to get the source is to run “apt-get source beep” on a Debian system.

Re: Beep security update

#65
post #19

Earlier quoted context omitted.

> In particular, it is not safe to call exit, free, ioctl, putchar, or perror from a signal handler. Why is it accepted by the compiler, then?

Why wouldn't it be? Why would a compiler know what a signal handler is?

Because signals and signal handlers are part of the language spec.

Re: Beep security update

#66
post #19

The author of beep needs to read the POSIX specification on async-signal-safety [1]. In particular, it is not safe to call exit, free, ioctl, putchar, or perror from a signal handler. [1] http://pubs.opengroup.org/onlinepubs/9699919799/functions/V2...

> In particular, it is not safe to call exit, free, ioctl, putchar, or perror from a signal handler. Why is it accepted by the compiler, then?

It’s undefined behavior, which means the compiler is free to accept it and do something sensible, or failing subtle ways, or make demons fly out of your nose.

Re: Beep security update

#67
post #65

Earlier quoted context omitted.

Why wouldn't it be? Why would a compiler know what a signal handler is?

Because signals and signal handlers are part of the language spec.

I was going to disagree and say that they are part of POSIX, not part of C99; but they are indeed part of C99, section 7.14.1 specifically.

Re: Beep security update

#68
post #64

Earlier quoted context omitted.

How did you find the Debian patch? http://git.deb.at/w/pkg/beep.git doesn't seem to have any changes.

Probably not in that repo as the upload was done by the security team. Best way to get the source is to run “apt-get source beep” on a Debian system.

Or if you don't have a Debian stable system at hand:

Go to https://packages.debian.org/stable/beep and download files from the "Download Source Package" section.

If you're only interested in the patch, get this one: http://security.debian.org/debian-security/pool/updates/main...

Re: Beep security update

#69
post #51
post #19

Earlier quoted context omitted.

> In particular, it is not safe to call exit, free, ioctl, putchar, or perror from a signal handler. Why is it accepted by the compiler, then?

I'll be quicker to blame the signal API than the programming language on that front. Dealing with unix signals correctly and robustly is far from trivial and rife with footguns. For instance I believe that Rust still doesn't have a good general purpose solution for handling signals that doesn't involve the libc and unsafe code. Signal is basically the crappiest form of IPC available on a modern operating system short…

> emulating a mouse and keyboard and typing into the other application's terminal window

There was a "talk"-like application for BBC Micro Econet called `*NOTIFY` which worked like that (minus the mouse, no mice in those days). You could message people, but also type commands as them. Happy days ...

Re: Beep security update

#70
post #4
post #2

Can't one just sudo echo -e "\7” anyway? Or if you're trying to do something fancier there is snd-pcsp which lets use use the piezo as a normal ALSA device (quality may vary). Not that many modern machines even include such a useful device.

Nitpick: on my machine, that's: sudo echo -e "\07"

"echo -e" is not portable, and neither are any escape sequences for echo.

The portable way to print ASCII BEL is:

    printf '\a'
Post reply on HN