> Recently I saw a tweet where someone mentioned that you can include /dev/stdin in C code compiled with gcc. This is, to say the very least, surprising.
You can also call something to read from stdin in your Makefile, or read from stdin in your executable.
> But is it equally obvious that the compiler also needs to be sandboxed?
Yes. Why wouldn't it be sandboxed?!
> I even found one service that ... showed me the hash of the root password.
Wow. That's bad. Of course, that's not a compiler issue, but rather a system administration issue. /etc/shadow should not be world-readable.
> This effectively means this service is running compile tasks as root.
That's quite a leap from 'I can read /etc/shadow' to 'I am root'.
> Interestingly, including pseudo-files from /proc does not work. It seems gcc treats them like empty files.
More accurately, it seems the system treats them like empty files. gcc does a stat on the file, which returns 'regular file' and 'size=0'. gcc therefore calls read() with a length of 0 bytes.
> That's quite a leap from 'I can read /etc/shadow' to 'I am root'.
Of all the leaps in that post, that's the least leapy thing. `shadow` exists precisely so that only `root` can read its content, whereas before said content resided in `passwd` which _needs_ to be readable by all.
I see only two possibilities here. Either the people who set up that compile service are complete morons and run said compile as actual root in an actual VM; OR, more likely, shit runs in a container with an _apparent_ id of 0 but no actual privilege outside its temporary environment.
Running as actual root in a VM would be my preferred design. There are lots of times a user might need to apt-get some dependencies for their compile job. Let an attacker do whatever they like in the VM. Then delete the VM between users.
Docker containers aren't really a good security barrier, and a VM is much better (although VM escape vulnerabilities aren't unheard of).
> I did not see any relevant content on the websites you mention in your HN profile
At least I have a filled out profile, unlike you.
Besides that, and the cheap personal attacks, you seem to be completely missing the point so let me spell it out for you: VMs, containers, chroot jails and all those other tools with which we can try to isolate two pieces of software running on the same hardware all have exploits, past, current and future ones. Any piece of software of even moderate complexity will have bugs, any isolation method should be considered fallible and leaky and you best defenses will take that into consideration when architecting your setup.
If you don't then sooner or later someone with more patience, a larger budget or more knowledge than you will get the better of you with all the consequences that may have.
The idea is that virtualization escape vulnerabilities are quite frequent. An attacker might not have one on hand at any given moment and you might patch your system frequently when they become known.
But this only means a determinated attacker that has emulated root needs only patience. Good security always means stacked independent layers, betting the farm only on the guarantees of your VM is very unsafe.
Running in a VM is good. Running in a VM as a non-priv user is better. Ideally you'd want multiple layers of defense in case of undiscovered gaps, human error and 0-days.
>That's quite a leap from 'I can read /etc/shadow' to 'I am root'.
Is it? There are alternatives of course but I would say that without further clues that seems the most likely explanation.
I agree with the rest of your points though. In general it seems fairly obvious that build systems should be sandboxed if they're building "foreign" code, after all if you can mess with the source code you can probably affect the build system as well, and from there you can basically do anything you want.
> More accurately, it seems the system treats them like empty files.
The reason is that the content is generated by a callback that the kernel calls, and the kernel does not want the content to be generated just in order to stat(2) the file, so it shows a zero length, and assumes that things like /bin/cat will just read(2) until EOF is returned, without trying to be too smart.
If that was my server I would of course put a joke in /etc/shadow - did you try to brute force the hashes? It would not be a great surprise to find some obvious funny content if you try?
That's a pretty long passphrase, so someone would have to have put it in the word list directly to ever guess something that long. Would be fun though.
You can also call something to read from stdin in your Makefile, or read from stdin in your executable.
> But is it equally obvious that the compiler also needs to be sandboxed?
Yes. Why wouldn't it be sandboxed?!
> I even found one service that ... showed me the hash of the root password.
Wow. That's bad. Of course, that's not a compiler issue, but rather a system administration issue. /etc/shadow should not be world-readable.
> This effectively means this service is running compile tasks as root.
That's quite a leap from 'I can read /etc/shadow' to 'I am root'.
> Interestingly, including pseudo-files from /proc does not work. It seems gcc treats them like empty files.
More accurately, it seems the system treats them like empty files. gcc does a stat on the file, which returns 'regular file' and 'size=0'. gcc therefore calls read() with a length of 0 bytes.