9 ms·

Tame() – bad kitty, no socket for you

151 points by elchief 11y ago

arianvanp 11y ago
It seems really fragile that tame takes a string as argument that is tokenized and parsed? Why not just pass an array of pre-defined constants.
- gecko 11y ago
  Because an array wouldn't be any safer than the string (still would be null-terminated or risk buffer overruns if you passed the length incorrectly), and using a string means you don't have to import a pile of constants if you want to use tame from languages other than C.
  - michaelmior 11y ago
    You could use bit flags to avoid the array issue. Your point about constants is reasonable although given that it's a one-time cost and there are already automated tools to do this for many popular languages, I don't think it presents a real barrier. Edit: I see they originally use a bit mask and then changed to the space-separated string. http://www.tedunangst.com/flak/post/string-interfaces http://www.tedunangst.com/flak/post/string-interfaces
- cremno 11y ago
  http://www.tedunangst.com/flak/post/string-interfaces http://www.tedunangst.com/flak/post/string-interfaces
chipuni 11y ago
I got to the twentieth slide, and I still wonder: What does tame() itself DO?
- kuschku 11y ago
  Instantly kill your process if it tries to use any syscall but the ones you have requested.
  - fidget 11y ago
    The ones _it_ has requested.
- masklinn 11y ago
  http://www.openbsd.org/cgi-bin/man.cgi/OpenBSD-current/man2/tame.2 http://www.openbsd.org/cgi-bin/man.cgi/OpenBSD-current/man2/... Whitelist syscalls. Any non-whitelisted syscall being invoked causes the process to be terminated with SIGKILL (or a non-blockable SIGABRT if `abort` it set). Further tame(2) calls can only further restrict the whitelist. The whitelisting can get down to just _exit(2).
  - mmastrac 11y ago
    I was wondering why you'd ever want to just limit yourself to _exit, but the man page answers that: A request value of "" restricts the process to the _exit(2) system call. This can be used for pure computation operating on memory shared with another process.
    - 0xcde4c3db 11y ago
      "The man page answers that" could probably be the OpenBSD motto.
      - xiaq 11y ago
        It was the Unix motto. Before GNU ruined man pages...
ianphughes 11y ago
That font makes reading difficult.
- logicallee 11y ago
  with that font and words like seperation, priviledge .... and the navigation! (would it have killed you to add just a tiny bit of javascript for a right and left arrow, or space, or page-down or...something) - it just comes off as just too unpolished. I rarely complain about form over substance but I didn't make it all the way through.
  - tobz 11y ago
    The OpenBSD folks are notorious for presenting extremely basic formatting on their sites, articles, presentations, etc. I think the Comic Sans is most likely a troll of other websites where the formatting, UI, etc, look like they got more polish than the content itself. Move your mouse button, and keep clicking. Not really the biggest deal. If not having a JS-based presentation kept you from reading all the way through, you're probably the person who will never use tame() anyways, so... it is what it is. :P
    - logicallee 11y ago
      No, I read through until I saw "priviledge" two or three times; along with "seperate" it was too much. It's 2015, a spell-check is not beyond anyone's editor.
    - sanderjd 11y ago
      It's likely I'll use tame() at some point, and I found the presentation annoying enough to read that I went to google and searched for information about it in an easier to digest format. Still though, point proved: if content is interesting enough, poor presentation won't entirely turn people off from learning about it.
    - Gigablah 11y ago
      "I think the Comic Sans is most likely a troll of other websites where the formatting, UI, etc, look like they got more polish than the content itself." This issue has come up multiple times. At this point they're only trolling their own users.
SwellJoe 11y ago
Reminds me of Perl's taint mode. It is not the same in terms of implementation or the types of limits imposed, of course, but it has some of the same basic ideas...you have to work really hard to make some kinds of stupid mistakes when the code is tainted, and I think the same sort of idea is at play here. I really like it when tools do the work of preventing me from doing dumb stuff. Security, in particular, is such a difficult task with so much knowledge required (particularly in a language like C) that it's almost surprising that software has as few vulnerabilities as it does. I'm unlikely to ever start a new project in C again, but if I do find myself in a networked C project maintenance or patching situation, I certainly would consider pulling this in.
- joosters 11y ago
  Perl's taint checking really was ahead of its time (introduced in 1988, according to Wikipedia!) Are there other languages that have this feature? (wiki only mentions Ruby)
  - pmarin 11y ago
    Tcl has a safe interpreter mode https://www.tcl.tk/man/tcl/TclCmd/safe.htm https://www.tcl.tk/man/tcl/TclCmd/safe.htm
  - jameshart 11y ago
    Taint checking offers a false sense of safety. Sure, data that originates in a request is unsafe, but does that means data retrieved from storage is safe? The right thing to do is to move away from plain string concatenation/interpolation: don't build dynamic SQL, don't hack together strings into JavaScript or HTML - use smart, format-aware templating tools (like golang's HTML templates) and parameterization.
    - joosters 11y ago
      Data read from files is also tainted. I disagree with the 'false sense of security' as well - just like every other security feature from any system or technique you care to name, taint checking improves security but makes absolutely no claim that it magically makes your code completely secure.
falcolas 11y ago
A bit meta, but... Part of me appreciates that there is no magic javascript which mucks with the browser and makes the slideshow a real pain in the butt to navigate. However, this is going too far in the opposite direction. Each slide as its own page? Navigation is slow, all-but requires the mouse, and creates a N-length list of sites to go "back" through to return here. Can we just come to a compromise: one page with each slide below the last? Allow us to take advantage of parallel fetching of assets, use native scrolling to progress, and you can even create anchors to link to a particular slide! Even better, you could easily write some basic javascript and to turn such a page into the former version of a slideshow if you're so inclined.
- tedunangst 11y ago
  Feel free to submit patches to magicpoont...
  - e12e 11y ago
    I was actually reply to gp along the lines of "blame your user agent for not providing navigation help with rel="next"[1] links" -- but having a look at the html-source, apparently magicpoint doesn't generate rel="next" links anyway... And the link to magicpoint[2] is broken -- so where would one submit patches? The first one should probably be a new "generated by"-link that actually works... [1] http://microformats.org/wiki/rel-next http://microformats.org/wiki/rel-next [2] http://www.mew.org/mgp/ http://www.mew.org/mgp/
    - ngoldbaum 11y ago
      Magicpoint is located here: http://member.wide.ad.jp/wg/mgp/ http://member.wide.ad.jp/wg/mgp/ I've no idea how one would submit a patch though.
      - tedunangst 11y ago
        Fix all the bugs, upload to github, announce "magicpoint-ng is here!" Very simple. :)
phpnode 11y ago
tame() is one of those things that is so simple and obvious in retrospect that it's flabbergasting that it took so long to be invented/(re)discovered.
- vezzy-fnord 11y ago
  Probably because it's theoretically inelegant. A lot of people are quite absolutist when it comes to security, and shun solutions that aren't entirely robust to all possible edge cases. Yet in practice, tame(2) makes privilege dropping such a trivial activity that it will quite likely influence far more programmers than a more capable but also more grueling and complex mechanism like seccomp-bpf. Speaking of which, here's a tame(2)-like wrapper over libseccomp: https://github.com/dimkr/libwaive https://github.com/dimkr/libwaive
  - gnuvince 11y ago
    Quoting myself from the lobste.rs thread[0]: >> No matter how good the interface is, it’s almost certain this will never hit Linux in the next 5-10 years. It’s not because the interface is bad, but because the glibc-devs and other people are scared of simple and straight-forward interfaces, rather not doing anything than implementing an interface which handles the general case rather than trying to cover the 0.5% of edge cases, being complex and bloated. > This is such a tough lesson to learn and to apply. I still fail at it most of the time in my own code, thinking up the weirdest edge cases possible that I need to handle rather than making the 99% case nice and simple. I'm a CS grad student, I've worked in the industry before, and I am 100% guilty of sometimes dismissing a nice and simple solution because the perfectionist in me is annoyed that an edge case takes O(n^2) or that the algorithm won't give the optimal answer in some pretty rare circumstances. [0] https://lobste.rs/s/4jlaod/tame_-_bad_kitty_no_socket_for_you https://lobste.rs/s/4jlaod/tame_-_bad_kitty_no_socket_for_yo...
- binarycrusader 11y ago
  Solaris has had this capability for many years: http://docs.oracle.com/cd/E23824_01/html/821-1456/prbac-2.html http://docs.oracle.com/cd/E23824_01/html/821-1456/prbac-2.ht... https://blogs.oracle.com/casper/entry/solaris_privileges https://blogs.oracle.com/casper/entry/solaris_privileges http://www.oracle.com/technetwork/systems/hands-on-labs/s11-security-1408641.html http://www.oracle.com/technetwork/systems/hands-on-labs/s11-...
zdw 11y ago
Even though this is mentioned as being "OpenBSD only - not a stable interface!" on slide 25... As OpenBSD's userland and libc is used extensively in Android, I wonder what the chances are of Google embracing tame() in future versions of Android.
- brynet 11y ago
  While it's true that Android's C library (bionic) uses code from OpenBSD libc.. tame(2) is a system call, in the kernel.
- koenigdavidmj 11y ago
  This is a system call requiring significant changes in the kernel. It also hardcodes a lot of weird implementation details into the kernel, like this description of the 'dns' request: "Subsequent to a successful open(2) of /etc/resolv.conf, a few system calls become able to allow DNS network transactions: sendto(2), recvfrom(2), socket(2), connect(2)." That's acceptable when the same people are building the kernel and the userland, like on a BSD, but it wouldn't work on Linux where the userspace is controlled by a bunch of separate parties that like changing implementation details.
- thinkmoore 11y ago
  Folks at Google are already working on a Linux port of Capsicum. I think its far more likely they would go with that.
ajdlinux 11y ago
http://www.openbsd.org/papers/tame-fsec2015/mgp00007.html http://www.openbsd.org/papers/tame-fsec2015/mgp00007.html "Optional security is irrelevant (in the long term). Mitigation technologies which can be disabled -> fade into history" This this this this this. As much as I like having control over my system and the ability to disable things, I've seen enough examples of users and corporate sysadmins taking years to fix basic security issues because there exists a quick and dirty workaround.
- AceJohnny2 11y ago
  Yeah, this was, to me, the most insightful slide of the whole talk.
- aexaey 11y ago
  That is by far the best summary of selinux's history to date.
openbsd-usr 11y ago
Theo mentions a hackathon in Croatia in the second slide, and some might not know this, but the OpenBSD project actually invented the concept of a hackathon in 1999 as a way of gathering their global developer community together in one place to hack on OpenBSD in a festive atmosphere. Sixteen years later, the concept has been completely co-opted by (often VC-backed) tech companies as a means of promoting their products and extracting unpaid labor from developers.
- pgeorgi 11y ago
  The tech company hackathons are about the same age. It's two concepts that sprung up at about the same time, using the same name for superficially similar activities. See https://en.wikipedia.org/wiki/Hackathon https://en.wikipedia.org/wiki/Hackathon. The unsourced claim on Sun is explained in more detail on https://en.wikipedia.org/wiki/JavaOne https://en.wikipedia.org/wiki/JavaOne

151 points by elchief 11y ago

It seems really fragile that tame takes a string as argument that is tokenized and parsed? Why not just pass an array of pre-defined constants.

gecko 11y ago
Because an array wouldn't be any safer than the string (still would be null-terminated or risk buffer overruns if you passed the length incorrectly), and using a string means you don't have to import a pile of constants if you want to use tame from languages other than C.
- michaelmior 11y ago
  You could use bit flags to avoid the array issue. Your point about constants is reasonable although given that it's a one-time cost and there are already automated tools to do this for many popular languages, I don't think it presents a real barrier. Edit: I see they originally use a bit mask and then changed to the space-separated string. http://www.tedunangst.com/flak/post/string-interfaces http://www.tedunangst.com/flak/post/string-interfaces
cremno 11y ago
http://www.tedunangst.com/flak/post/string-interfaces http://www.tedunangst.com/flak/post/string-interfaces

chipuni 11y ago

I got to the twentieth slide, and I still wonder: What does tame() itself DO?

kuschku 11y ago
Instantly kill your process if it tries to use any syscall but the ones you have requested.
- fidget 11y ago
  The ones _it_ has requested.
masklinn 11y ago
http://www.openbsd.org/cgi-bin/man.cgi/OpenBSD-current/man2/tame.2 http://www.openbsd.org/cgi-bin/man.cgi/OpenBSD-current/man2/... Whitelist syscalls. Any non-whitelisted syscall being invoked causes the process to be terminated with SIGKILL (or a non-blockable SIGABRT if `abort` it set). Further tame(2) calls can only further restrict the whitelist. The whitelisting can get down to just _exit(2).
- mmastrac 11y ago
  I was wondering why you'd ever want to just limit yourself to _exit, but the man page answers that: A request value of "" restricts the process to the _exit(2) system call. This can be used for pure computation operating on memory shared with another process.
  - 0xcde4c3db 11y ago
    "The man page answers that" could probably be the OpenBSD motto.
    - xiaq 11y ago
      It was the Unix motto. Before GNU ruined man pages...

ianphughes 11y ago

That font makes reading difficult.

logicallee 11y ago
with that font and words like seperation, priviledge .... and the navigation! (would it have killed you to add just a tiny bit of javascript for a right and left arrow, or space, or page-down or...something) - it just comes off as just too unpolished. I rarely complain about form over substance but I didn't make it all the way through.
- tobz 11y ago
  The OpenBSD folks are notorious for presenting extremely basic formatting on their sites, articles, presentations, etc. I think the Comic Sans is most likely a troll of other websites where the formatting, UI, etc, look like they got more polish than the content itself. Move your mouse button, and keep clicking. Not really the biggest deal. If not having a JS-based presentation kept you from reading all the way through, you're probably the person who will never use tame() anyways, so... it is what it is. :P
  - logicallee 11y ago
    No, I read through until I saw "priviledge" two or three times; along with "seperate" it was too much. It's 2015, a spell-check is not beyond anyone's editor.
  - sanderjd 11y ago
    It's likely I'll use tame() at some point, and I found the presentation annoying enough to read that I went to google and searched for information about it in an easier to digest format. Still though, point proved: if content is interesting enough, poor presentation won't entirely turn people off from learning about it.
  - Gigablah 11y ago
    "I think the Comic Sans is most likely a troll of other websites where the formatting, UI, etc, look like they got more polish than the content itself." This issue has come up multiple times. At this point they're only trolling their own users.

SwellJoe 11y ago

Reminds me of Perl's taint mode. It is not the same in terms of implementation or the types of limits imposed, of course, but it has some of the same basic ideas...you have to work really hard to make some kinds of stupid mistakes when the code is tainted, and I think the same sort of idea is at play here. I really like it when tools do the work of preventing me from doing dumb stuff. Security, in particular, is such a difficult task with so much knowledge required (particularly in a language like C) that it's almost surprising that software has as few vulnerabilities as it does. I'm unlikely to ever start a new project in C again, but if I do find myself in a networked C project maintenance or patching situation, I certainly would consider pulling this in.

joosters 11y ago
Perl's taint checking really was ahead of its time (introduced in 1988, according to Wikipedia!) Are there other languages that have this feature? (wiki only mentions Ruby)
- pmarin 11y ago
  Tcl has a safe interpreter mode https://www.tcl.tk/man/tcl/TclCmd/safe.htm https://www.tcl.tk/man/tcl/TclCmd/safe.htm
- jameshart 11y ago
  Taint checking offers a false sense of safety. Sure, data that originates in a request is unsafe, but does that means data retrieved from storage is safe? The right thing to do is to move away from plain string concatenation/interpolation: don't build dynamic SQL, don't hack together strings into JavaScript or HTML - use smart, format-aware templating tools (like golang's HTML templates) and parameterization.
  - joosters 11y ago
    Data read from files is also tainted. I disagree with the 'false sense of security' as well - just like every other security feature from any system or technique you care to name, taint checking improves security but makes absolutely no claim that it magically makes your code completely secure.

falcolas 11y ago

A bit meta, but... Part of me appreciates that there is no magic javascript which mucks with the browser and makes the slideshow a real pain in the butt to navigate. However, this is going too far in the opposite direction. Each slide as its own page? Navigation is slow, all-but requires the mouse, and creates a N-length list of sites to go "back" through to return here. Can we just come to a compromise: one page with each slide below the last? Allow us to take advantage of parallel fetching of assets, use native scrolling to progress, and you can even create anchors to link to a particular slide! Even better, you could easily write some basic javascript and to turn such a page into the former version of a slideshow if you're so inclined.

tedunangst 11y ago
Feel free to submit patches to magicpoont...
- e12e 11y ago
  I was actually reply to gp along the lines of "blame your user agent for not providing navigation help with rel="next"[1] links" -- but having a look at the html-source, apparently magicpoint doesn't generate rel="next" links anyway... And the link to magicpoint[2] is broken -- so where would one submit patches? The first one should probably be a new "generated by"-link that actually works... [1] http://microformats.org/wiki/rel-next http://microformats.org/wiki/rel-next [2] http://www.mew.org/mgp/ http://www.mew.org/mgp/
  - ngoldbaum 11y ago
    Magicpoint is located here: http://member.wide.ad.jp/wg/mgp/ http://member.wide.ad.jp/wg/mgp/ I've no idea how one would submit a patch though.
    - tedunangst 11y ago
      Fix all the bugs, upload to github, announce "magicpoint-ng is here!" Very simple. :)

phpnode 11y ago

tame() is one of those things that is so simple and obvious in retrospect that it's flabbergasting that it took so long to be invented/(re)discovered.

vezzy-fnord 11y ago
Probably because it's theoretically inelegant. A lot of people are quite absolutist when it comes to security, and shun solutions that aren't entirely robust to all possible edge cases. Yet in practice, tame(2) makes privilege dropping such a trivial activity that it will quite likely influence far more programmers than a more capable but also more grueling and complex mechanism like seccomp-bpf. Speaking of which, here's a tame(2)-like wrapper over libseccomp: https://github.com/dimkr/libwaive https://github.com/dimkr/libwaive
- gnuvince 11y ago
  Quoting myself from the lobste.rs thread[0]: >> No matter how good the interface is, it’s almost certain this will never hit Linux in the next 5-10 years. It’s not because the interface is bad, but because the glibc-devs and other people are scared of simple and straight-forward interfaces, rather not doing anything than implementing an interface which handles the general case rather than trying to cover the 0.5% of edge cases, being complex and bloated. > This is such a tough lesson to learn and to apply. I still fail at it most of the time in my own code, thinking up the weirdest edge cases possible that I need to handle rather than making the 99% case nice and simple. I'm a CS grad student, I've worked in the industry before, and I am 100% guilty of sometimes dismissing a nice and simple solution because the perfectionist in me is annoyed that an edge case takes O(n^2) or that the algorithm won't give the optimal answer in some pretty rare circumstances. [0] https://lobste.rs/s/4jlaod/tame_-_bad_kitty_no_socket_for_you https://lobste.rs/s/4jlaod/tame_-_bad_kitty_no_socket_for_yo...
binarycrusader 11y ago
Solaris has had this capability for many years: http://docs.oracle.com/cd/E23824_01/html/821-1456/prbac-2.html http://docs.oracle.com/cd/E23824_01/html/821-1456/prbac-2.ht... https://blogs.oracle.com/casper/entry/solaris_privileges https://blogs.oracle.com/casper/entry/solaris_privileges http://www.oracle.com/technetwork/systems/hands-on-labs/s11-security-1408641.html http://www.oracle.com/technetwork/systems/hands-on-labs/s11-...

zdw 11y ago

Even though this is mentioned as being "OpenBSD only - not a stable interface!" on slide 25... As OpenBSD's userland and libc is used extensively in Android, I wonder what the chances are of Google embracing tame() in future versions of Android.

brynet 11y ago
While it's true that Android's C library (bionic) uses code from OpenBSD libc.. tame(2) is a system call, in the kernel.
koenigdavidmj 11y ago
This is a system call requiring significant changes in the kernel. It also hardcodes a lot of weird implementation details into the kernel, like this description of the 'dns' request: "Subsequent to a successful open(2) of /etc/resolv.conf, a few system calls become able to allow DNS network transactions: sendto(2), recvfrom(2), socket(2), connect(2)." That's acceptable when the same people are building the kernel and the userland, like on a BSD, but it wouldn't work on Linux where the userspace is controlled by a bunch of separate parties that like changing implementation details.
thinkmoore 11y ago
Folks at Google are already working on a Linux port of Capsicum. I think its far more likely they would go with that.

ajdlinux 11y ago

http://www.openbsd.org/papers/tame-fsec2015/mgp00007.html http://www.openbsd.org/papers/tame-fsec2015/mgp00007.html "Optional security is irrelevant (in the long term). Mitigation technologies which can be disabled -> fade into history" This this this this this. As much as I like having control over my system and the ability to disable things, I've seen enough examples of users and corporate sysadmins taking years to fix basic security issues because there exists a quick and dirty workaround.

AceJohnny2 11y ago
Yeah, this was, to me, the most insightful slide of the whole talk.
aexaey 11y ago
That is by far the best summary of selinux's history to date.

openbsd-usr 11y ago

Theo mentions a hackathon in Croatia in the second slide, and some might not know this, but the OpenBSD project actually invented the concept of a hackathon in 1999 as a way of gathering their global developer community together in one place to hack on OpenBSD in a festive atmosphere. Sixteen years later, the concept has been completely co-opted by (often VC-backed) tech companies as a means of promoting their products and extracting unpaid labor from developers.

pgeorgi 11y ago
The tech company hackathons are about the same age. It's two concepts that sprung up at about the same time, using the same name for superficially similar activities. See https://en.wikipedia.org/wiki/Hackathon https://en.wikipedia.org/wiki/Hackathon. The unsourced claim on Sun is explained in more detail on https://en.wikipedia.org/wiki/JavaOne https://en.wikipedia.org/wiki/JavaOne