Security considerations #99
Comments
|
As observed by @mewmew, right now, Goa is used by a small circle of mutually trusting people. But even today, I already ran into the situation where the goarc file that comes with @jschlatow's https://github.com/jschlatow/goa-projects contains settings (like This is of course not a Goa-specific issue. The same attack vector exists for any Makefile originating from a potentially malicious 3rd part. But Goa is in a good position to take measures against such risks.
Until these measures are in place, it is probably best to use a "disposable" development VM when dealing Goa projects of untrusted origin. |
|
Thanks @mewmew and @nfeske for raising the discussion.
Tcl is actually able to create safe child interpreters. There is also some example code that we could use for reference. Using a safe interpreter would prevent any exec and file operations in goarc files. However, it might still be possible to trick Goa into performing harmful file system operations. For instance, any goarc file may set |
This reduces the use of global variables and renders bin/goa easier to grasp. Moreover, this change paves the way for eliminating config variables from the global namespace without the need to adapt every line that uses such a variable. Within procedures, we can easily import namespace variables. #99
|
In preparation of using a child interpreter to load goarc files, I had a longer cleanup session. Commit bdee6c6 moves the main program logic into a goa namespace and separate procedures, and paves the way for moving config variables into a config namespace. |
TCL's safe interpreter hides file operations, source, and exec commands. Loading goarc files with a safe slave interpreter is a basic security measure. This change also moves all config variables into a separate namespace. Our interpreter additionally hides the set command in order to make sure that goarc files are only able to set predefined variables in the config namespace. genodelabs#99
TCL's safe interpreter hides file operations, source, and exec commands. Loading goarc files with a safe slave interpreter is a basic security measure. This change also moves all config variables into a separate namespace. Our interpreter additionally hides the set command in order to make sure that goarc files are only able to set predefined variables in the config namespace. genodelabs#99
Restrict path variables to working directory and project directory. The set of allowed paths can be extended by adding `lappend allowed_paths ...` commands to _~/goarc_ or _/goarc_. genodelabs#99
|
Commit c271490 implements the idea of using a safe TCL interpreter for goarc loading. Moreover, commit 00a2559 adds the policy that path variables must refer to paths inside the working directory or project directory. The policy can be extended by appending to the list |
|
That's amazing! |
|
I further reviewed Goa w.r.t. sensitive commands (exec, spawn, file, glob). There are a few obvious and less obvious issues that we need to address:
|
Restrict tool paths to PATH, Goa-internal tools and the default Genode tool-chain path. The set of allowed tool paths can be extended by adding `lappend allowed_tools ...` commands to _~/goarc_ or _/goarc_. This commit prevents malicious configuration of cross_dev_prefix. genodelabs#99
In order to prevent that the presence of malicious symlinks can be used to escape the allowed_paths, we replace the file command with an alias. This allows validation of paths during `file normalize` and `file link` operations, which both resolve symlinks. genodelabs#99
TCL's safe interpreter hides file operations, source, and exec commands. Loading goarc files with a safe slave interpreter is a basic security measure. This change also moves all config variables into a separate namespace. Our interpreter additionally hides the set command in order to make sure that goarc files are only able to set predefined variables in the config namespace. genodelabs#99
Restrict path variables to working directory and project directory. The set of allowed paths can be extended by adding `lappend allowed_paths ...` commands to _~/goarc_ or _/goarc_. genodelabs#99
Restrict tool paths to PATH, Goa-internal tools and the default Genode tool-chain path. The set of allowed tool paths can be extended by adding `lappend allowed_tools ...` commands to _~/goarc_ or _/goarc_. This commit prevents malicious configuration of cross_dev_prefix. genodelabs#99
In order to prevent that the presence of malicious symlinks can be used to escape the allowed_paths, we replace the file command with an alias. This allows validation of paths during `file normalize` and `file link` operations, which both resolve symlinks. genodelabs#99
In order to prevent untrusted goarc files to execute malicious commands via target_opt(sculpt-cmd), users must confirm the command execution interactively. genodelabs#99
This is addressed by 838c084 |
Fixed by 94a73be |
|
Commit b6f2b11 further adds an |
|
With commit 9675bdc, Goa now intercepts Tcl's file operations in order to check arguments against the |
The command downloads and installs the current Genode toolchain (if unavailable) and converts it into a squashfs. The squashfs is mounted via squashfuse and bind mounted into the bubblewrapped build environment. genodelabs#99
Resolves conflicts between ro-bind options. Binds of existing subdirectories in a parent directory tree are valid. However, if that subdirectory is not present, it cannot be created (because the bind is read-only). In this case, the parent bind is split into its subdirectories, which are then individually mounted. genodelabs#99
TCL's safe interpreter hides file operations, source, and exec commands. Loading goarc files with a safe slave interpreter is a basic security measure. This change also moves all config variables into a separate namespace. Our interpreter additionally hides the set command in order to make sure that goarc files are only able to set predefined variables in the config namespace. genodelabs#99
Restrict path variables to working directory and project directory. The set of allowed paths can be extended by adding `lappend allowed_paths ...` commands to _~/goarc_ or _/goarc_. genodelabs#99
Restrict tool paths to PATH, Goa-internal tools and the default Genode tool-chain path. The set of allowed tool paths can be extended by adding `lappend allowed_tools ...` commands to _~/goarc_ or _/goarc_. This commit prevents malicious configuration of cross_dev_prefix. genodelabs#99
In order to prevent that the presence of malicious symlinks can be used to escape the allowed_paths, we replace the file command with an alias. This allows validation of paths during `file normalize` and `file link` operations, which both resolve symlinks. genodelabs#99
In order to prevent untrusted goarc files to execute malicious commands via target_opt(sculpt-cmd), users must confirm the command execution interactively. genodelabs#99
This is in preparation of moving the tool chain into a squashfs image. genodelabs#99
The command downloads and installs the current Genode toolchain (if unavailable) and converts it into a squashfs. The squashfs is mounted via squashfuse and bind mounted into the bubblewrapped build environment. genodelabs#99
In issue #98, @mewmew raised a fairly important topic that deserves a dedicated issue. It is not urgent but we should keep the topic in eyesight and eventually address it. Here is @mewmew's original text:
The text was updated successfully, but these errors were encountered: