Path: csiph.com!optima2.xanadu-bbs.net!xanadu-bbs.net!news.glorb.com!usenet.stanford.edu!not-for-mail
From: Stephane Chazelas <stephane.chazelas@gmail.com>
Newsgroups: gnu.bash.bug
Subject: Re: SHELLOPTS=xtrace security hardening
Date: Tue, 15 Dec 2015 11:16:27 +0000
Lines: 34
Approved: bug-bash@gnu.org
Message-ID: <mailman.2146.1450178195.31583.bug-bash@gnu.org>
References: <20151210201649.126444eionzfsam8@webmail.alunos.dcc.fc.up.pt> <566DAFC6.4040407@case.edu> <20151213220817.GC7138@chaz.gmail.com> <20151214180113.169546iutu72yw9k@webmail.alunos.dcc.fc.up.pt> <20151214173231.GA6524@chaz.gmail.com> <20151215003016.598611ow5f3lw4qo@webmail.alunos.dcc.fc.up.pt>
NNTP-Posting-Host: lists.gnu.org
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Cc: bug-bash@gnu.org, Chet Ramey <chet.ramey@case.edu>
To: up201407890@alunos.dcc.fc.up.pt
Envelope-to: bug-bash@gnu.org
Content-Disposition: inline
In-Reply-To: <20151215003016.598611ow5f3lw4qo@webmail.alunos.dcc.fc.up.pt>
User-Agent: Mutt/1.5.21 (2010-09-15)
Precedence: list
Xref: csiph.com gnu.bash.bug:12018

2015-12-15 00:30:16 +0100, up201407890@alunos.dcc.fc.up.pt:
[...]
> >Should we also block SHELLOPTS=history
> >HISTFILE=/some/file like /proc/$pid/fd/$fd and
> >TZ=/proc/$pid/fd/$fd (like for your /bin/date command) as that
> >allows DoS on other processes (like where those fds are for
> >pipes).
> 
> Mind explaining this one?
> I can't seem to write to HISTFILE in a non-interactive shell, or am
> i missing something?
[...]

I don't know if you can make a non-interactive bash write to the
$HISTFILE, but bash, even when non-interactive, even when called
as sh, with SHELLOPTS=history will *read* the HISTFILE.

And if HISTFILE is for instance a /proc/$pid/fd/$fd which
identifies the reading end of a pipe (like for instance the
pipes used by sshd), then you're going to have root read the
content of that pipe under the feet of the process that content
was intended to, causing at best a DoS. Same for /dev/pts/x or
some /dev/input/x. Your example had the same problem with $TZ.

sudo sanitizes $TZ (http://www.sudo.ws/alerts/tz.html) and
blocks SHELLOPTS and PS4 even when env_reset is unset.

If a bash script called in that context calls "read -e", that
allows reading arbitrary files (read -e allows executing any
command via shell-expand-line anyway).

-- 
Stephane