The patch #1 is not a part of Flint, just ChiselApp -- Flint users supply
their own Fossil with their specific requirements, which may not include
safe Tcl.
Attached are the two patches in question.
On Tue, 5 Jun 2018, Eduard wrote:
1. Enable Safe interpreters for Tcl
How did you do that? The flint repository doesn't seem to include the
fossil build script.
2. Enforce that the SSH program cannot be run (by patching popen2()
to return an error)
Are you not using chroot to protect repositories from each other?
3. (Not complete, but started) run each instance of Fossil as a
different UID based on their Flint UID+131072
That's actually the next thing on my TODO list -- I think it's a good
idea!
1. Need to add the domain to the Public Suffix List (otherwise,
you haven't mitigated the issue completely)
I think the only security issue left vis-a-vis untrusted subdomains is
that a malicious repository can insert thousands of junk cookies,
displacing the login cookie on the secure subdomain and thus logging
the user out. I think it's a mild annoyance at most. Feel free to
contradict me on this.
2. Getting a wildcard cert
I also put it off for the longest time. It turned out to be
surprisingly easy to do, and in fact less annoying than http
validation.
Cheers,
Eduard
On 06/04/2018 10:37 PM, Roy Keene wrote:
Other things we do at ChiselApp:
1. Enable Safe interpreters for Tcl
2. Enforce that the SSH program cannot be run (by patching
popen2() to return an error)
3. (Not complete, but started) run each instance of Fossil as a
different UID based on their Flint UID+131072
I thought about putting each repo under their own domain, but doing so
requires a bit more work:
1. Need to add the domain to the Public Suffix List (otherwise,
you haven't mitigated the issue completely)
2. Getting a wildcard cert
On Mon, 4 Jun 2018, Eduard wrote:
I was planning on making a more official announcement, but here goes.
I'm the developer of Hydra, a single-sign-on and manager for fossil
repositories. https://hydra.ecd.space/f/hydra/wiki/hydra
I think this is relevant as people may be looking to GitHub alternatives
for multiproject hosting.
I've recently fixed the XSS/CSRF vulnerabilities inherent to hosting
multiple repositories on the same domain (which also affect chiselapp),
when setup privilege is given to malicious users (for the repositories
they create) and they convince other people to visit their malicious
repository while logged in. I've done this by using a separate subdomain
for each repository, and by patching Fossil itself to receive the CSRF
token from Hydra. More details here:
https://static.ecd.space/x/hydra/doc/build/html/subdomains.html
I've also done some security hardening by dropping each repository in a
separate chroot (to contain damage from a potential arbitrary code
execution vulnerability in fossil itself).
(Sorry drh, I accidentally replied only to you instead of the mailing
list.)
On 06/03/2018 09:28 PM, Richard Hipp wrote:
There is suddenly a big uptick in traffic to fossil-scm.org,
apparently due to the recent GitHub rumor. Unlike that traditional
"slashdot effect", though, the referrals seem to be coming for a large
variety of sources.
So, if anybody sees any last minute tidying up that we need to do to
the website in anticipation of a huge influx of first-time visitors,
please speak up. Quickly.
_______________________________________________
fossil-users mailing list
fossil-users@lists.fossil-scm.org
http://lists.fossil-scm.org:8080/cgi-bin/mailman/listinfo/fossil-users
_______________________________________________
fossil-users mailing list
fossil-users@lists.fossil-scm.org
http://lists.fossil-scm.org:8080/cgi-bin/mailman/listinfo/fossil-users
_______________________________________________
fossil-users mailing list
fossil-users@lists.fossil-scm.org
http://lists.fossil-scm.org:8080/cgi-bin/mailman/listinfo/fossil-users
diff -uNr fossil-2.1.orig/src/th_tcl.c fossil-2.1-safeinterp/src/th_tcl.c
--- fossil-2.1.orig/src/th_tcl.c 2017-03-10 11:07:08.000000000 -0600
+++ fossil-2.1-safeinterp/src/th_tcl.c 2017-03-16 10:34:59.922893000 -0500
@@ -148,6 +148,9 @@
# ifndef TCL_CREATEINTERP_NAME
# define TCL_CREATEINTERP_NAME "_Tcl_CreateInterp\0"
# endif
+# ifndef TCL_MAKESAFE_NAME
+# define TCL_MAKESAFE_NAME "_Tcl_MakeSafe\0"
+# endif
# ifndef TCL_DELETEINTERP_NAME
# define TCL_DELETEINTERP_NAME "_Tcl_DeleteInterp\0"
# endif
@@ -180,6 +183,7 @@
*/
typedef void (tcl_FindExecutableProc) (const char *);
typedef Tcl_Interp *(tcl_CreateInterpProc) (void);
+typedef int (tcl_MakeSafeProc) (Tcl_Interp *interp);
typedef void (tcl_DeleteInterpProc) (Tcl_Interp *);
typedef void (tcl_FinalizeProc) (void);
@@ -405,6 +409,7 @@
void *hLibrary; /* The Tcl library module handle. */
tcl_FindExecutableProc *xFindExecutable; /* Tcl_FindExecutable() pointer. */
tcl_CreateInterpProc *xCreateInterp; /* Tcl_CreateInterp() pointer. */
+ tcl_MakeSafeProc *xMakeSafe; /* Tcl_MakeSafe() pointer. */
tcl_DeleteInterpProc *xDeleteInterp; /* Tcl_DeleteInterp() pointer. */
tcl_FinalizeProc *xFinalize; /* Tcl_Finalize() pointer. */
Tcl_Interp *interp; /* The on-demand created Tcl interpreter. */
@@ -857,6 +862,7 @@
void **phLibrary,
tcl_FindExecutableProc **pxFindExecutable,
tcl_CreateInterpProc **pxCreateInterp,
+ tcl_MakeSafeProc **pxMakeSafe,
tcl_DeleteInterpProc **pxDeleteInterp,
tcl_FinalizeProc **pxFinalize
){
@@ -865,7 +871,7 @@
char aFileName[] = TCL_LIBRARY_NAME;
#endif /* defined(USE_TCL_STUBS) */
- if( !phLibrary || !pxFindExecutable || !pxCreateInterp ||
+ if( !phLibrary || !pxFindExecutable || !pxCreateInterp || !pxMakeSafe ||
!pxDeleteInterp || !pxFinalize ){
Th_ErrorMessage(interp,
"invalid Tcl loader argument(s)", (const char *)"", 0);
@@ -908,6 +914,7 @@
if( hLibrary ){
tcl_FindExecutableProc *xFindExecutable;
tcl_CreateInterpProc *xCreateInterp;
+ tcl_MakeSafeProc *xMakeSafe;
tcl_DeleteInterpProc *xDeleteInterp;
tcl_FinalizeProc *xFinalize;
const char *procName = TCL_FINDEXECUTABLE_NAME;
@@ -932,6 +939,17 @@
dlclose(hLibrary); hLibrary = 0;
return TH_ERROR;
}
+ procName = TCL_MAKESAFE_NAME;
+ xMakeSafe = (tcl_MakeSafeProc *)dlsym(library, procName + 1);
+ if( !xMakeSafe ){
+ xMakeSafe = (tcl_MakeSafeProc *)dlsym(library, procName);
+ }
+ if( !xMakeSafe ){
+ Th_ErrorMessage(interp,
+ "could not locate Tcl_MakeSafe", (const char *)"", 0);
+ dlclose(library);
+ return TH_ERROR;
+ }
procName = TCL_DELETEINTERP_NAME;
xDeleteInterp = (tcl_DeleteInterpProc *)dlsym(hLibrary, procName+1);
if( !xDeleteInterp ){
@@ -957,6 +975,7 @@
*phLibrary = hLibrary;
*pxFindExecutable = xFindExecutable;
*pxCreateInterp = xCreateInterp;
+ *pxMakeSafe = xMakeSafe;
*pxDeleteInterp = xDeleteInterp;
*pxFinalize = xFinalize;
return TH_OK;
@@ -971,6 +990,7 @@
*phLibrary = 0;
*pxFindExecutable = Tcl_FindExecutable;
*pxCreateInterp = Tcl_CreateInterp;
+ *pxMakeSafe = Tcl_MakeSafe;
*pxDeleteInterp = Tcl_DeleteInterp;
*pxFinalize = Tcl_Finalize;
return TH_OK;
@@ -1113,7 +1133,7 @@
return TH_OK;
}
if( loadTcl(interp, &tclContext->hLibrary, &tclContext->xFindExecutable,
- &tclContext->xCreateInterp, &tclContext->xDeleteInterp,
+ &tclContext->xCreateInterp, &tclContext->xMakeSafe,
&tclContext->xDeleteInterp,
&tclContext->xFinalize)!=TH_OK ){
return TH_ERROR;
}
@@ -1168,6 +1188,7 @@
tclContext->interp = tclInterp = 0;
return TH_ERROR;
}
+ tclContext->xMakeSafe(tclInterp);
/*
** Determine (and cache) if an objProc can be called directly for a Tcl
** command invoked via the tclInvoke TH1 command.
diff -uNr fossil-2.1.orig/src/popen.c fossil-2.1-nossh/src/popen.c
--- fossil-2.1.orig/src/popen.c 2017-03-10 11:07:08.000000000 -0600
+++ fossil-2.1-nossh/src/popen.c 2017-03-16 10:34:41.402893000 -0500
@@ -124,6 +124,10 @@
** Return the number of errors.
*/
int popen2(const char *zCmd, int *pfdIn, FILE **ppOut, int *pChildPid){
+ if (pChildPid) {
+ *pChildPid = 0;
+ }
+ return(1);
#ifdef _WIN32
HANDLE hStdinRd, hStdinWr, hStdoutRd, hStdoutWr, hStderr;
SECURITY_ATTRIBUTES saAttr;
_______________________________________________
fossil-users mailing list
fossil-users@lists.fossil-scm.org
http://lists.fossil-scm.org:8080/cgi-bin/mailman/listinfo/fossil-users
