From: "Ævar Arnfjörð Bjarmason" <avarab@gmail.com>
To: Jeff King <peff@peff.net>
Cc: "brian m. carlson" <sandals@crustytoothpaste.net>, git@vger.kernel.org
Subject: Re: [PATCH 0/2] Generate temporary files using a CSPRNG
Date: Wed, 17 Nov 2021 09:36:43 +0100 [thread overview]
Message-ID: <211117.86a6i387i1.gmgdl@evledraar.gmail.com> (raw)
In-Reply-To: <YZQdRC9nAA/CbMyM@coredump.intra.peff.net>
On Tue, Nov 16 2021, Jeff King wrote:
> On Tue, Nov 16, 2021 at 09:35:59PM +0100, Ævar Arnfjörð Bjarmason wrote:
>
>> I tried testing this codepath real quick now with:
>>
>> diff --git a/wrapper.c b/wrapper.c
>> index 36e12119d76..2f3755886fb 100644
>> --- a/wrapper.c
>> +++ b/wrapper.c
>> @@ -497,6 +497,7 @@ int git_mkstemps_mode(char *pattern, int suffix_len, int mode)
>> v /= num_letters;
>> }
>>
>> + BUG("%s", pattern);
>> fd = open(pattern, O_CREAT | O_EXCL | O_RDWR, mode);
>> if (fd >= 0)
>> return fd;
>>
>> And then doing:
>>
>> grep BUG test-results/*.out
>>
>> And the resulting output is all of the form:
>>
>> .git/objects/9f/tmp_obj_FOzEcZ
>> .git/objects/pack/tmp_pack_fJC0RI
>>
>> And a couple of:
>>
>> .git/info/refs_Lctaew
>>
>> I.e. these are all cases where we're creating in-repo tempfiles, we're
>> not racing someone in /tmp/ for these, except perhaps in some cases I've
>> missed (but you allude to) where we presumably should just move those
>> into .git/tmp/, at least by default.
>
> Your patch is way too aggressive. By bailing via BUG(), most commands
> will fail, so we never get to the interesting ones (e.g., we would not
> ever get to the point of writing out a tag signature for gpg to verify,
> because we'd barf when trying to create the tag in the first place).
>
> Try:
>
> diff --git a/wrapper.c b/wrapper.c
> index 36e12119d7..5218a4b3bd 100644
> --- a/wrapper.c
> +++ b/wrapper.c
> @@ -497,6 +497,10 @@ int git_mkstemps_mode(char *pattern, int suffix_len, int mode)
> v /= num_letters;
> }
>
> + {
> + static struct trace_key t = TRACE_KEY_INIT(TEMPFILE);
> + trace_printf_key(&t, "%s", pattern);
> + }
> fd = open(pattern, O_CREAT | O_EXCL | O_RDWR, mode);
> if (fd >= 0)
> return fd;
>
> And then:
>
> GIT_TRACE_TEMPFILE=/tmp/foo make test
> grep ^/tmp /tmp/foo | wc -l
>
> turns up hundreds of hits.
Thanks, there's a long tail of these, but I came up with this crappy
one-liner one regex at a time while looking at it:
cat /tmp/git_mkstemps_mode.trace | perl -pe 's[/[0-9a-f]{2}/][/HH/]; s[/incoming-\K[^/]+][XXX]; s[/tmp/\K[^_]+][XXX]; s/tmp_(idx|obj|pack)_\K[a-zA-Z0-9]+$/XXX/; s[/objects/\
K../][$1??/]g; s[^/run/user.*/objects/][<systemd run/user>/objects/]; s[(vtag_tmp|pack_|refs_)\K.*][XXX]; '|sort|uniq -c|sort -nr|less
Which gives us:
893 .git/objects/pack/tmp_pack_XXX
836 ./objects/??/tmp_obj_XXX
722 .git/objects/pack/tmp_idx_XXX
401 <systemd run/user>/objects/incoming-XXX/HH/tmp_obj_XXX
366 /run/user/1001/tmp/XXX_pack_XXX
289 <systemd run/user>/objects/??/tmp_obj_XXX
261 .git/info/refs_XXX
258 /tmp/XXX_vtag_tmpXXX
185 clone.git/objects/??/tmp_obj_XXX
77 /tmp/XXX_file
72 marks-test/.git/objects/??/tmp_obj_XXX
71 <systemd run/user>/objects/pack/tmp_pack_XXX
69 <systemd run/user>/objects/pack/tmp_idx_XXX
34 objects/pack/tmp_pack_XXX
34 objects/pack/tmp_idx_XXX
25 /run/user/1001/tmp/XXX.git/objects/??/tmp_obj_XXX
20 info/refs_XXX
12 /tmp/XXX_text
12 foo.git/objects/??/tmp_obj_XXX
I.e. this is stuff that's either already in .git, or a small handful of
special-cases such as "git verify-tag".
>> If there are cases where we actually need this hardening because we're
>> writing in a shared /tmp/ and not .git/, then surely we're better having
>> those API users call a differently named function, or to move those
>> users to using a .git/tmp/ unless they configure things otherwise?
>
> Assuming you can write to .git/tmp means that conceptually read-only
> operations (like verifying tags) require write access to the repository.
That leaves the "differently named function" which I think we should
really do in either case.
I.e. if I'm verifying lots of tags then I'm better off on a modern
systemd system using /run/user/`id -u`, as opposed to /tmp/ which is
often disk-backed. So being aware of $XDG_RUNTIME_DIR seems like a
sensible thing in either case.
And on those systems the DoS aspect of this becomes a non-issue, that
directory is only writable by one (non-super)user.
I think there's a big advantage to having any tricky CSPRNG-implementing
code in its own corner like that.
It means that e.g. if gpg learns some mode to do this that doesn't
require tempfiles, and we're confident we don't create things in /tmp
otherwise that we could drop it, or users who don't want git shipping a
CSPRNG can compile it out.
But I really don't see why it isn't an acceptable solution for git to
just die here if we fail to create the Nth tempfile in a row.
Or something simpler like having the "git verify-tag" code fall back to
writing in say $HOME/.cache/git, which is another simple way to avoid
the issue entirely in most cases.
prev parent reply other threads:[~2021-11-17 9:19 UTC|newest]
Thread overview: 37+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-11-16 3:35 [PATCH 0/2] Generate temporary files using a CSPRNG brian m. carlson
2021-11-16 3:35 ` [PATCH 1/2] wrapper: add a helper to generate numbers from " brian m. carlson
2021-11-16 15:31 ` Jeff King
2021-11-16 16:01 ` rsbecker
2021-11-16 18:22 ` Taylor Blau
2021-11-16 19:58 ` rsbecker
2021-11-16 22:41 ` brian m. carlson
2021-11-16 23:20 ` rsbecker
2021-11-17 0:47 ` Carlo Arenas
2021-11-17 3:05 ` rsbecker
2021-11-17 1:03 ` brian m. carlson
2021-11-17 1:50 ` Carlo Arenas
2021-11-17 3:04 ` Jeff King
2021-11-17 3:12 ` rsbecker
2021-11-17 3:36 ` Carlo Arenas
2021-11-17 20:01 ` Jeff King
2021-11-17 20:19 ` rsbecker
2021-11-17 23:30 ` brian m. carlson
2021-11-17 23:34 ` rsbecker
2021-11-17 3:03 ` rsbecker
2021-11-17 7:39 ` Junio C Hamano
2021-11-17 23:01 ` brian m. carlson
2021-11-18 7:19 ` Junio C Hamano
2021-11-18 22:16 ` brian m. carlson
2021-11-22 9:10 ` Junio C Hamano
2021-11-16 3:35 ` [PATCH 2/2] wrapper: use a CSPRNG to generate random file names brian m. carlson
2021-11-16 15:36 ` Jeff King
2021-11-16 18:28 ` Taylor Blau
2021-11-16 18:57 ` Junio C Hamano
2021-11-16 19:21 ` Jeff King
2021-11-16 19:33 ` Taylor Blau
2021-11-16 15:44 ` [PATCH 0/2] Generate temporary files using a CSPRNG Jeff King
2021-11-16 22:17 ` brian m. carlson
2021-11-16 22:29 ` rsbecker
2021-11-16 20:35 ` Ævar Arnfjörð Bjarmason
2021-11-16 21:06 ` Jeff King
2021-11-17 8:36 ` Ævar Arnfjörð Bjarmason [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
List information: http://vger.kernel.org/majordomo-info.html
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=211117.86a6i387i1.gmgdl@evledraar.gmail.com \
--to=avarab@gmail.com \
--cc=git@vger.kernel.org \
--cc=peff@peff.net \
--cc=sandals@crustytoothpaste.net \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this public inbox
https://80x24.org/mirrors/git.git
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).