Re: Bugs involving maliciously crafted file system

["Theodore Y. Ts'o" <tytso@mit.edu>]

On Thu, May 24, 2018 at 10:49:31AM +1000, Dave Chinner wrote:
> 
> We've learnt this lesson the hard way over and over again: don't
> parse untrusted input in privileged contexts. How many times do we
> have to make the same mistakes before people start to learn from
> them?

Good question.  For how many years (or is it decades, now) has Fedora
auto-mounted USB sticks?  :-) Let me know when you successfully get
Fedora to turn of a feature which appears to have great user appeal.

And I'll note that Eric Beiderman just posted a patch series allowing
unprivileged processes to mount file systems in containers.

And remember the mantra which the containner people keep chanting.
Containers are just as secure as VM's.   Hahahaha.....

> User automounting of removable storage should be done via a
> privilege separation mechanism and hence avoid this whole class of
> security problems. We can get this separation by using FUSE in these
> situations, right?

FUSE is a pretty terrible security boundary.  And not all file systems
have FUSE support.  As I had suggested earlier, probably better to use
9P, and mount the file system in a VM.

> Bugs don't have to be exploitable to be a "security issue". Detected
> filesystem corruptions on a errors=panic mount, or undetected
> problems that cause a x/NULL deref are still a user-triggerable
> kernel crash (i.e. a DOS) and therefore considered a security
> problem.

I disagree here.  I think it's worth it to disambiguate the two.  If
you have physical access to the machine, you can also apply AC mains
voltage to the USB port, which will likely cause the system to crash.
And at least for Chrome OS, it reboots really quickly.  :-)

If someone can gain control of the system so they can exfiltrate data,
or be able to modify files owned as root, that's a much bigger deal
that crashing the machcine in my view.

							- Ted