Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

You might want to stop running atop

rachelbythebay.com

Post reply on HN
Print view View original

131–140 of 155 posts

Re: You might want to stop running atop

#131

Post by cesarb »

grayfaced wrote: post #92
vanc_cefepime wrote: post #68

Linux newbie here. Jumped into the Linux world after getting tired of Microsoft's BS with Win 11. Running Linux mint on my laptop and desktop. Looks like 'atop' is not installed by default, but regular 'top'. Anyone know which distros I should be worried about that have it? Also I have been dabbling with proxmox, I checked and looks like 'top' is the default there too.

You're probably not running either unless you know what they are. Top is an equivalent of windows taskmanager, most often to used identify "top" processes using memory/cpu (and other resources) and only ran briefly. Atop is a different long-running version used to create logs of the same data to understand trends.

> [...] and only ran briefly. Atop is a different long-running version used to create logs of the same data to understand trends.

atop is also normally only ran briefly. It has an optional mode (enabled by default in some, but not all distributions) in which it runs as a service and saves a snapshot of the system state every few seconds; atop can read and show these snapshots when ran briefly.

Re: You might want to stop running atop

#132

Post by DanHulton »

LadyCailin wrote: post #126
bigstrat2003 wrote: post #54

Earlier quoted context omitted.

I would disagree and still say that this is bad vagueposting. It doesn't matter how reputable the source is: if you say "don't do X" but don't give a reason why, I'm not inclined to listen. Granted I don't use atop anyways, but I don't think a vague blog post - even one from a respected person - is sufficient justification to change what software one uses.

That seems.. whatever the opposite of pragmatic is, but not in a good way, as in “principled”. There are very good reasons one would be required to be vague in a situation like this, but still know about a very serious issue. It’s like seeing a road sign that says “danger ahead” and ignoring it because it wasn’t very specific. It’s just.. not a sensible move.

Yeah, this is the behavior of the stuffy administrator in an 80's sci-fi comedy, minutes before the horror the heroes are trying to warn him from is unleashed.

The only question left is "who is going to deliver the quippy one-liner afterwards?"

Re: You might want to stop running atop

#133

Post by Macha »

LinuxBender wrote: post #74
Macha wrote: post #67

Earlier quoted context omitted.

Google's AI has just given you a plausible sounding but mostly wrong list of distros - it's not in the enterprise distros, elementary or pop os

Missing from their output is an upvote and downvote button. Or a debug function that forces it to divulge where it obtained the data. Wait, now that I think about it why are there Fact Checkers for humans and not for AI?

The data source seems pretty obvious here. It doesn't know much about atop, but your question has led it to believe that it's something available on Linux distros, so it spat out a likely list of Linux distros based on the weighted average of linux distros listed by other projects in its training set.

Re: You might want to stop running atop

#134

Post by crmrc114 »

Well that ansible job was quickly ran, buhbye atop. Very concerning coming from Rachel and not some rando. I know a number of fortune 5's that use atop for troubleshooting as well. So as others have commented if you had this baked into images or loaded with puppet etc than now may be the time to cleanup.

Re: You might want to stop running atop

#135

Post by TheDong »

lnxdork wrote: post #125
TheDong wrote: post #108

No one else seems to have run 'grep system(', so I will: https://github.com/Atoptool/atop/blob/037a6d3e4ace6c7be6c5dc... > system ("gunzip -c %s > %s", tmpname1, tmpname2") tmpname2 is hardcoded as "/tmp/atopwrkXXXXXX", so that's fine. tmpname1 is '$irawname.gz'. '$irawname' is set by the '-r' flag. So, presumably if you can get the rest of the code to play nice and get you there, you can escalate from having shell a…

Agree as a basic example. tmpname1 = "/tmp/file.txt; rm -rf /"; becomes gunzip -c /tmp/file.txt; rm -rf / > /tmp/atopwrkXXXXXX Also tmpname2 could be symlinked to /etc/passwd before it is unlinked..

> Also tmpname2 could be symlinked to /etc/passwd before it is unlinked..

Yeah, sure, but only if you run atop as root, otherwise it'll just get a "permission denied", and if you can run atop as root with whatever flags you like, you might as well just run 'rm' instead.

It's not a suid binary, so while it's bad code and a smell, I don't think the TOCTOU is a security issue in how it's commonly run (i.e. as an interactive CLI running as your user).

Re: You might want to stop running atop

#136

Post by LinuxBender »

Macha wrote: post #133
LinuxBender wrote: post #74

Earlier quoted context omitted.

Missing from their output is an upvote and downvote button. Or a debug function that forces it to divulge where it obtained the data. Wait, now that I think about it why are there Fact Checkers for humans and not for AI?

The data source seems pretty obvious here. It doesn't know much about atop, but your question has led it to believe that it's something available on Linux distros, so it spat out a likely list of Linux distros based on the weighted average of linux distros listed by other projects in its training set.

That's called guessing. It should start the output with "Just guessing, but maybe ..."

Re: You might want to stop running atop

#137

Post by devoopsies »

AlexClickHouse wrote: post #104

I vaguely remember an old bug in atop, leading to a very unusual consequence. Atop will do an invalid memory write and crash with a segfault. But this writing is performed on a memory page mapped to a hardware timer. Despite not being able to write into that page, just touching it somehow changes how this hardware timer works. Then, the OS detects that this timer is inaccurate and switches to a different clock source…

This was found by the very same Rachel that's sounding the alarm here

https://rachelbythebay.com/w/2014/03/02/sync/

Re: You might want to stop running atop

#138

Post by zveyaeyv3sfye »

bigstrat2003 wrote: post #54
plorkyeran wrote: post #17

Earlier quoted context omitted.

Yeah, from a rando this would be just bad vagueposting but Rachel is absolutely someone who could know about a very good reason why we should uninstall atop but be unable to legally say why. I would heed her warning.

I would disagree and still say that this is bad vagueposting. It doesn't matter how reputable the source is: if you say "don't do X" but don't give a reason why, I'm not inclined to listen. Granted I don't use atop anyways, but I don't think a vague blog post - even one from a respected person - is sufficient justification to change what software one uses.

That's not how reputation works.

Re: You might want to stop running atop

#139

Post by pledess »

TheDong wrote: post #135
lnxdork wrote: post #125

Earlier quoted context omitted.

Agree as a basic example. tmpname1 = "/tmp/file.txt; rm -rf /"; becomes gunzip -c /tmp/file.txt; rm -rf / > /tmp/atopwrkXXXXXX Also tmpname2 could be symlinked to /etc/passwd before it is unlinked..

> Also tmpname2 could be symlinked to /etc/passwd before it is unlinked.. Yeah, sure, but only if you run atop as root, otherwise it'll just get a "permission denied", and if you can run atop as root with whatever flags you like, you might as well just run 'rm' instead. It's not a suid binary, so while it's bad code and a smell, I don't think the TOCTOU is a security issue in how it's commonly run (i.e. as an interac…

The TOCTOU is relevant (without suid) if someone can quickly make the right prediction of the tmpname2 value that's generated by the PRNG used by mkstemp, and create a symlink with that value before gunzip is executed. After calling mkstemp, the code should use the returned file descriptor, and thereby eliminate all TOCTOU risk. However, on (perhaps?) most devices that would realistically use atop, the PRNG works well enough that that prediction would fail.
Post reply on HN