From: Jordan Glover <Golden_Miller83@protonmail.ch>
To: Lonnie Abelbeck <lists@lonnie.abelbeck.com>
Cc: "baines.jacob@gmail.com" <baines.jacob@gmail.com>,
WireGuard mailing list <wireguard@lists.zx2c4.com>
Subject: Re: PostUp/PreUp/PostDown/PreDown Dangerous?
Date: Fri, 22 Jun 2018 18:13:22 -0400 [thread overview]
Message-ID: <WPqGtU0DfSVI-hq2mee5j7VBN3_KVfJjWsf1-2MDe_1z2uIk7dBWnHF733CM6d9dF1dlhC-bEMy7naNqyAOtKnRZnYYoj5B4TZffzAJF6bA=@protonmail.ch> (raw)
In-Reply-To: <296DF757-2B21-4F54-9444-1EEBD4A40BEA@lonnie.abelbeck.com>
On June 22, 2018 9:26 PM, Lonnie Abelbeck <lists@lonnie.abelbeck.com> wrote=
:
> How about not supporting direct execution of commands in the config [Inte=
rface] section but rather support an optional path to where a fixed command=
(ex. wireguard.script) is found...
>=20
>=20
> -------------------------------------------------------------------------=
---------------------------------------------------------------------------=
---------------------------------------
>=20
> ActionScriptDir =3D /usr/local/bin
> --------------------------------
>=20
> Then instead of executing the PostUp/PostDown/PreUp/PreDown data, the wg-=
quick script would call:
>=20
>=20
> -------------------------------------------------------------------------=
----------------------------
>=20
> /usr/local/bin/wireguard.script PRE_UP|PRE_DOWN|POST_UP|POST_DOWN "$INTER=
FACE"
> -------------------------------------------------------------------------=
-----
>=20
> 1. When called, the first argument would be one of: PRE_UP|PRE_DOWN|POST=
_UP|POST_DOWN
> 2. When called, the second argument would be the wireguard interface.
> 3. If ActionScriptDir is not defined, then wireguard.script is not calle=
d.
> =20
> This requires an extra step to be taken to create a wireguard.script =
file with execute permissions and possibly require specific ownership.
> =20
> Lonnie
> =20
But attacker will helpfully provide you customized 'wireguard.script' as w=
ell
and even tell you how to use it by setting 'chmod 4777 wireguard.script'.
Jordan
next prev parent reply other threads:[~2018-06-22 22:08 UTC|newest]
Thread overview: 19+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-06-22 1:34 PostUp/PreUp/PostDown/PreDown Dangerous? Jason A. Donenfeld
2018-06-22 1:35 ` Jason A. Donenfeld
2018-06-22 1:41 ` Jason A. Donenfeld
2018-06-22 1:55 ` logcabin
2018-06-22 1:56 ` Antonio Quartulli
2018-06-22 10:46 ` Jordan Glover
2018-06-22 10:53 ` Antonio Quartulli
2018-06-22 13:08 ` Jacob Baines
2018-06-22 14:47 ` Andy Dorman
2018-06-22 15:14 ` Matthias Urlichs
2018-06-22 17:11 ` Jason A. Donenfeld
2018-06-22 4:01 ` Matthias Urlichs
2018-06-22 5:44 ` Reto Brunner
2018-06-22 14:07 ` Andy Dorman
2018-06-23 19:16 ` Reto Brunner
2018-06-22 19:26 ` Lonnie Abelbeck
2018-06-22 22:13 ` Jordan Glover [this message]
2018-06-23 2:36 ` Antonio Quartulli
2018-06-23 7:02 ` Dario Bosch
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='WPqGtU0DfSVI-hq2mee5j7VBN3_KVfJjWsf1-2MDe_1z2uIk7dBWnHF733CM6d9dF1dlhC-bEMy7naNqyAOtKnRZnYYoj5B4TZffzAJF6bA=@protonmail.ch' \
--to=golden_miller83@protonmail.ch \
--cc=baines.jacob@gmail.com \
--cc=lists@lonnie.abelbeck.com \
--cc=wireguard@lists.zx2c4.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).