Quoting from the first:
> An attacker who can cause file(1) to be run on a maliciously constructed input can cause file(1) to crash. It may be possible for such an attacker to execute arbitrary code with the privileges of the user running file(1). ...
> No workaround is available, but systems where file(1) and other libmagic(3)-using applications are never run on untrusted input are not vulnerable.
And from the third:
> There are a number of denial of service issues in the ELF parser used by file(1). ...
> An attacker who can cause file(1) or any other applications using the libmagic(3) library to be run on a maliciously constructed input can cause the application to crash or consume excessive CPU resources, resulting in a denial-of-service.
Welcome to the joys of parsing.
I didn't realise openbsd had a seccomp equivalent, but I'm happy it does! (And it did make the news again)
It's too bad, I think system calls are a very good place to apply security policies. I think the issue is that one can modify the memory structures pointed to by a system call after it has been "approved" by systrace policy, but before the kernel acts on it. While the ownership of such data structures are in userspace, its perfectly fine to modify such regions.
It's too bad, I think its possibly the most straight-forward approach compared to SELinux or MAC
https://marc.info/?l=openbsd-cvs&m=143014212727213&w=2
https://marc.info/?l=openbsd-cvs&m=143014250427343&w=2
There are unfortunately a lot of people who depend on file(1); and many of them also run it as root.
Also previous HN discussion: https://news.ycombinator.com/item?id=9439778
Most programs I write I would be happy, fairly soon after startup, to drop to "just read and write handles I've already got". It would make me feel much better about my badly written parsers!
If you want to go a step further and sandbox, use setrlimit(2)/chroot(2). And if it's appropriate, use technologies like systrace(4) or Linux seccomp(2).
There are many examples of this in OpenBSD's base system, including some most people don't know about.. like tcpdump(8)
