Will Dormann
Back when I was poking around with filesystem fuzzing stuff years back, I noticed something odd:
An EXT filesystem can tell the Linux OS how it should behave "if" the filesystem is corrupt, including triggering a kernel panic. In a world where USB thumb drives exist, this seems... not ideal.
Let's see what happens if we plug such a mass storage device into a fully patched Chromebook in 2024...
Oh.
Rich Felker
@wdormann ext filesystems also have file ownership, suid capability, etc. The worst of this can be mitigated with mount options (maybe panic on error can too?) but ultimately it's not a suitable fs for external media and should not be auto mounted by anything unless you have a sandboxed FUSE driver for it in place of the kernel one.
Will Dormann
The man page for tune2fs is pretty clear about this capability.
The person who writes the data to the USB mass storage device can specify that both:
1) The OS that reads the device should panic if the filesystem has an error.
2) The filesystem has an error.
🤦♂️
chort ↙️↙️↙️
@wdormann It's funny (and rather cringe-inducing) to us infosec folks, but to 99% of developers they will always say "why would anyone do that?"
The vast majority just truly have no concept that anyone might want to act maliciously. If the engineer themself wouldn't perform a malicious action, they cannot conceive that anyone else would.
I have run into this issue so many times during my career. I now assume that no engineer will ever consider possible malicious actions taken against their code. To the extent that they do consider malicious actions, it will only be things that they themselves would do.
AmbianceAsunder
@chort @wdormann infosec folk here, however I am asking myself the same question - not as in “who cares, who would do this” but moreso “what how where and when does this break stuff leading to potential compromise outside of the obvious FUBAR case for the system itself?” In other words, what specifically is this a precursor to or does this actually keep a system down? I’m certain I’m missing something here or am ignorant of a topic
David Zaslavsky
@chort @wdormann Funnily enough, my first thought was indeed "why would anyone do that" but with "that" being "allow the filesystem to trigger a kernel panic" 😂
Rich Felker
Leonard Ritter
@chort @wdormann i'm a software engineer. if i were considering at every point how any of my designs could be used to produce malicious behavior, then i would cease to be a software engineer and instead work in infosec.
Rich Felker
@lritter @chort @wdormann Sorry for being terse. Really tho we need genuine software engineers committed to producing stuff that's safe and robust not just halfway working under favorable conditions. We don't need them getting sucked away into infosec.
Leonard Ritter
@dalias @chort @wdormann as a good C librarian it better should be your duty to believe that this take of mine is irresponsible.
Rich Felker
@wdormann Indeed, -o errors=continue fixes this. ChromeOS is being bad automounting ext fs on external media without it. Same as mounting without -o nosuid would be a bug.
翠星石
GNU social JP is a social network, courtesy of GNU social JP管理人. It runs on GNU social, version 2.0.2-dev, available under the GNU Affero General Public License.
All GNU social JP content and data are available under the Creative Commons Attribution 3.0 license.