1 |
On Tue, 2020-06-30 at 16:51 -0500, Sid Spry wrote: |
2 |
> On Tue, Jun 30, 2020, at 2:29 PM, Michał Górny wrote: |
3 |
> > On Tue, 2020-06-30 at 12:50 -0500, Sid Spry wrote: |
4 |
> > > On Tue, Jun 30, 2020, at 2:28 AM, Michał Górny wrote: |
5 |
> > > > Dnia June 30, 2020 2:13:43 AM UTC, Sid Spry <sid@××××.us> napisał(a): |
6 |
> > > > > Hello, |
7 |
> > > > > |
8 |
> > > > > I have some runnable pseudocode outlining a faster tree verification |
9 |
> > > > > algorithm. |
10 |
> > > > > Before I create patches I'd like to see if there is any guidance on |
11 |
> > > > > making the |
12 |
> > > > > changes as unobtrusive as possible. If the radical change in algorithm |
13 |
> > > > > is |
14 |
> > > > > acceptable I can work on adding the changes. |
15 |
> > > > > |
16 |
> > > > > Instead of composing any kind of structured data out of the portage |
17 |
> > > > > tree my |
18 |
> > > > > algorithm just lists all files and then optionally batches them out to |
19 |
> > > > > threads. |
20 |
> > > > > There is a noticeable speedup by eliding the tree traversal operations |
21 |
> > > > > which |
22 |
> > > > > can be seen when running the algorithm with a single thread and |
23 |
> > > > > comparing it to |
24 |
> > > > > the current algorithm in gemato (which should still be discussed |
25 |
> > > > > here?). |
26 |
> > > > |
27 |
> > > > Without reading the code: does your algorithm correctly detect extraneous files? |
28 |
> > > > |
29 |
> > > |
30 |
> > > Yes and no. |
31 |
> > > |
32 |
> > > I am not sure why this is necessary. If the file does not appear in a manifest it is |
33 |
> > > ignored. It makes the most sense to me to put the burden of not including |
34 |
> > > untracked files on the publisher. If the user puts an untracked file into the tree it |
35 |
> > > will be ignored to no consequence; the authored files don't refer to it, after all. |
36 |
> > |
37 |
> > This is necessary because a malicious third party can MITM you an rsync |
38 |
> > tree with extraneous files (say, -r1 baselayout ebuild) that do horrible |
39 |
> > things on your system. If you don't reject files not in Manifest, you |
40 |
> > open a huge security hole. |
41 |
> > |
42 |
> |
43 |
> Ok, I will refer to https://www.gentoo.org/glep/glep-0074.html and implement the |
44 |
> checks in detail, but will still need to spend some time looking for the best place |
45 |
> to insert the code. |
46 |
> |
47 |
> I think it best to address this from two fronts. On one hand rejecting extra files |
48 |
> seems to have immediate benefit but the larger issue is portage exposing |
49 |
> untracked potentially malicious files to the user. |
50 |
|
51 |
I've pushed two branches with two exploits I could think of. Please |
52 |
test your tools against them. In both cases, the directory should be |
53 |
rejected without any ill effects. |
54 |
|
55 |
https://github.com/mgorny/glep74-test-cases |
56 |
|
57 |
> |
58 |
> Has anything like a verity loopback filesystem been explored? It might reduce |
59 |
> duplication of work. |
60 |
|
61 |
I don't understand what a 'verity loopback filesystem' is. Could you elaborate? |
62 |
|
63 |
-- |
64 |
Best regards, |
65 |
Michał Górny |