OpenBSD's new file(1) is now priv-separated
1–10 of 32 posts
Re: OpenBSD's new file(1) is now priv-separated
#2Here are the other two related commits:
https://marc.info/?l=openbsd-cvs&m=143014212727213&w=2
https://marc.info/?l=openbsd-cvs&m=143014250427343&w=2
There are unfortunately a lot of people who depend on file(1); and many of them also run it as root.
Also previous HN discussion: https://news.ycombinator.com/item?id=9439778
Re: OpenBSD's new file(1) is now priv-separated
#3From my understanding file is a pretty simple program, why does it need to care about privilege separation?
Re: OpenBSD's new file(1) is now priv-separated
#4From my understanding file is a pretty simple program, why does it need to care about privilege separation?
file is indeed a pretty simple program. Why allow it to do more than it needs to?
Re: OpenBSD's new file(1) is now priv-separated
#5From my understanding file is a pretty simple program, why does it need to care about privilege separation?
It has a history of vulnerability to maliciously constructed input files. It's often used as a validator ("is this file.jpg actually a jpg or an executable?") and/or run as root.
Re: OpenBSD's new file(1) is now priv-separated
#6From my understanding file is a pretty simple program, why does it need to care about privilege separation?
[deleted]
Re: OpenBSD's new file(1) is now priv-separated
#7From my understanding file is a pretty simple program, why does it need to care about privilege separation?
From what I remember, it's actually does quite complicated things internally. It does some heuristics on the file content based on some rule to determine the file format. You can also add new file formats this way, there is a 'magic' file you can add somewhere in /usr/share for that (I don't remember exactly where). And there is literally thousands of file types to test. Anyway, if you have ever coded in C you know what might happen with complex-byte manipulation...
Re: OpenBSD's new file(1) is now priv-separated
#8From my understanding file is a pretty simple program, why does it need to care about privilege separation?
Here are three bug reports for file(1): https://www.freebsd.org/security/advisories/FreeBSD-SA-07%3A... , https://www.freebsd.org/security/advisories/FreeBSD-SA-14%3A... , https://www.freebsd.org/security/advisories/FreeBSD-SA-14%3A... .
Quoting from the first:
> An attacker who can cause file(1) to be run on a maliciously constructed input can cause file(1) to crash. It may be possible for such an attacker to execute arbitrary code with the privileges of the user running file(1). ...
> No workaround is available, but systems where file(1) and other libmagic(3)-using applications are never run on untrusted input are not vulnerable.
And from the third:
> There are a number of denial of service issues in the ELF parser used by file(1). ...
> An attacker who can cause file(1) or any other applications using the libmagic(3) library to be run on a maliciously constructed input can cause the application to crash or consume excessive CPU resources, resulting in a denial-of-service.
Re: OpenBSD's new file(1) is now priv-separated
#9How easy is privilege separation nowadays? Are there any cross-platform libraries (well, cross-unix at least)?
Most programs I write I would be happy, fairly soon after startup, to drop to "just read and write handles I've already got". It would make me feel much better about my badly written parsers!
Re: OpenBSD's new file(1) is now priv-separated
#10Separation is done. 1/3 points done: https://news.ycombinator.com/item?id=9441262
I didn't realise openbsd had a seccomp equivalent, but I'm happy it does! (And it did make the news again)