Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

You gave me a u32. I gave you root. (io_uring ZCRX freelist LPE)

ze3tar.github.io

Post reply on HN
Print view View original

51–60 of 152 posts

Re: You gave me a u32. I gave you root. (io_uring ZCRX freelist LPE)

#51

Post by Jtsummers »

skullone wrote: post #48
amluto wrote: post #47

Earlier quoted context omitted.

But one would have to explicitly choose to use unsafe Rust for this instead of ordinary safe Rust. And safe Rust has no particular difficulty writing to slots in an array or slice or vector specified by their index.

except nearly everyone uses unsafe rust

> except nearly everyone uses unsafe rust

Really? Why? I've not used Rust outside of some fairly small efforts, but I've never found a reason to reach for unsafe. So why is "nearly everyone" else using it?

Re: You gave me a u32. I gave you root. (io_uring ZCRX freelist LPE)

#53

Post by dvt »

ellieh wrote: post #50
dvt wrote: post #34

Earlier quoted context omitted.

Obviously the way to prevent this is by bounds checking, which is literally in the `770594e` patch. It's just a bug and they happen routinely in all languages. Since this is doing pointer arithmetic, it could just as easily happen in unsafe Rust, for example.

sure, but with unsafe Rust you have a very clear marking for the section of code that requires additional care and attention. it is also customary to include a "SAFETY" comment outlining why using unsafe is OK here

You actually kind of don't, I use like a zillion crates which have unsafe Rust in them and it's not like I'm sitting here reading every single line of their code. I like Rust for various reasons, but its memory safety is (imo) overstated, especially when doing low-level stuff.

Re: You gave me a u32. I gave you root. (io_uring ZCRX freelist LPE)

#54

Post by dvt »

Jtsummers wrote: post #51
skullone wrote: post #48

Earlier quoted context omitted.

except nearly everyone uses unsafe rust

> except nearly everyone uses unsafe rust Really? Why? I've not used Rust outside of some fairly small efforts, but I've never found a reason to reach for unsafe. So why is "nearly everyone" else using it?

Let's say you want to call win32 (or Mac) OS functions, all of a sudden you're doing all kinds of wonky pointer stuff because that's how these operating systems have been architected. Doing unsafe stuff is pretty inevitable if you want to do anything non-hello-world-ish.

Re: You gave me a u32. I gave you root. (io_uring ZCRX freelist LPE)

#55

Post by amluto »

dvt wrote: post #54
Jtsummers wrote: post #51

Earlier quoted context omitted.

> except nearly everyone uses unsafe rust Really? Why? I've not used Rust outside of some fairly small efforts, but I've never found a reason to reach for unsafe. So why is "nearly everyone" else using it?

Let's say you want to call win32 (or Mac) OS functions, all of a sudden you're doing all kinds of wonky pointer stuff because that's how these operating systems have been architected. Doing unsafe stuff is pretty inevitable if you want to do anything non-hello-world-ish.

So what? Just because you used the keyword `unsafe` to call an unsafe API does not mean that you are going to use unsafe pointer access to write to a vector.

Re: You gave me a u32. I gave you root. (io_uring ZCRX freelist LPE)

#56

Post by Jtsummers »

dvt wrote: post #54
Jtsummers wrote: post #51

Earlier quoted context omitted.

> except nearly everyone uses unsafe rust Really? Why? I've not used Rust outside of some fairly small efforts, but I've never found a reason to reach for unsafe. So why is "nearly everyone" else using it?

Let's say you want to call win32 (or Mac) OS functions, all of a sudden you're doing all kinds of wonky pointer stuff because that's how these operating systems have been architected. Doing unsafe stuff is pretty inevitable if you want to do anything non-hello-world-ish.

> Doing unsafe stuff is pretty inevitable if you want to do anything non-hello-world-ish.

So the vast majority of Rust projects involve writing at least one unsafe block? Is that really your claim?

Re: You gave me a u32. I gave you root. (io_uring ZCRX freelist LPE)

#57

Post by delusional »

PlasmaPower wrote: post #32
stonegray wrote: post #21

> “and is writable with CAP_SYS_ADMIN” Am I reading this wrong or is this just a way of executing an arbitrary binary with uid=0 if you have both CAP_NET_ADMIN and CAP_SYS_ADMIN? If you can write modprobe_path, is it really news that you can find a way to execute code?

No, you can grant yourself this inside an unprivileged user namespace. `unshare -Ur capsh --print` lists the capabilities inside a user namespace and demonstrates that it has both CAP_SYS_ADMIN and CAP_NET_ADMIN. Almost all distros allow unprivileged user namespaces, and in my opinion this is the right decision, because they're important for browser sandboxing which I think is more important than LPEs.

I don't think namepsace CAP_SYS_ADMIM grants you access to write non namespaces sysctls like modprobe_path

Re: You gave me a u32. I gave you root. (io_uring ZCRX freelist LPE)

#58

Post by josephg »

dvt wrote: post #53
ellieh wrote: post #50

Earlier quoted context omitted.

sure, but with unsafe Rust you have a very clear marking for the section of code that requires additional care and attention. it is also customary to include a "SAFETY" comment outlining why using unsafe is OK here

You actually kind of don't, I use like a zillion crates which have unsafe Rust in them and it's not like I'm sitting here reading every single line of their code. I like Rust for various reasons, but its memory safety is (imo) overstated, especially when doing low-level stuff.

Almost all rust (95%) is safe rust. You can opt out of array bounds checks with unsafe { array.get_unchecked(idx) } instead of just typing array[idx]. But I can't remember the last time I saw anyone actually do that in the wild. Its not common practice, even in most low level code.

Rust is bounds checked by default. C is not. Defaults matter because, without a convincing reason, most people program in the default way.

Re: You gave me a u32. I gave you root. (io_uring ZCRX freelist LPE)

#59

Post by greiskul »

Jtsummers wrote: post #56
dvt wrote: post #54

Earlier quoted context omitted.

Let's say you want to call win32 (or Mac) OS functions, all of a sudden you're doing all kinds of wonky pointer stuff because that's how these operating systems have been architected. Doing unsafe stuff is pretty inevitable if you want to do anything non-hello-world-ish.

> Doing unsafe stuff is pretty inevitable if you want to do anything non-hello-world-ish. So the vast majority of Rust projects involve writing at least one unsafe block? Is that really your claim?

And even if you do end up writing an unsafe block, that should be a massive flag that the code in said block should deserve extra comments on why it is safe, and extra unit tests on verifying that it does not blow up.

How do you know the unsafe operation is safe? What are the preconditions the code block has? Write it down, review it, test it.

Post reply on HN