5 ms·
Disclaimer: Unpopular opinion ahead. I am not a fan of binfmt_misc. Please hear me out.. This introduces the same framework for future vulnerabilities that Mi
by LinuxBender 8y ago
Disclaimer: Unpopular opinion ahead.
I am not a fan of binfmt_misc. Please hear me out.. This introduces the same framework for future vulnerabilities that Microsoft introduced long ago by having the system interrogate file type associations. This turned into easy mode for attackers to trick people into executing malicious files on their system. This has not happened _yet_ in Linux AFAIK, but this sets the framework for it.
In Windows, you can see this mapping by opening a command prompt and typing:
assoc
It was common practice for some time to change VBS mapping to text, along with several other file types.
In my opinion, we are bringing a dangerous behavior into systems that could one day be commonly used as desktops.
- jxy 8y agoI was wondering why no one finds it scary in terms of security and integrity of the system.
- jwilk 8y ago"Modern" desktop environments of course do have file type associations, but this is unrelated to binfmt_misc. I can't think of any realistic threat model in which binfmt_misc would reduce security. If you are running untrusted code, it doesn't matter it's an ELF, a shell script, or a VBS script ran through Wine. It's game over anyway.
- peterwwillis 8y agoYou don't know if you're running any code at all. You double click on a .jpeg file, and suddenly a python script is running. There are many ways to trick systems and users into running something when they didn't want to run anything, but binfmt_misc makes this easier for the attacker.
- Spivak 8y agoWe're talking about a very specific situation where the attacker has enough privilege to add an association but not enough privilege to just run the malicious program.
- chungy 8y agoDoesn't actually happen though. GUI file managers prompt whether you want to execute a script or display it in a text editor. If you're on the terminal and do ./vegas.jpeg though... it's your own fault :P
- beojan 8y agoGenerally the file managers on Linux use "magic" to determine file type rather than extensions, so even if it would run you should know it's really a Python script.
- gizmo686 8y agoThe point is that binfmt_misc could allow you to run unstrusted code in a context where you were not expecting to run any code. For instance, if I do "./budget.pdf", I expect it to run the code from my pdf reader. In this case, an attack would require exploiting a vulnerability in the pdf reader. That is to say, budget.pdf is not untrusted code, but rather untrusted data. However, in this case the unstrusted data can claim that it is code; in which case it would be executed as such. In contrast, when I do `evince budget.pdf`, the only way for budget.pdf to become code is to trick the pdf reader into thinking it is code. Granted, this is largely a moot point as most people would be using a GUI file manager; which already has a common interface for running programs and opening data files; and already automatically determines which action to take.
- laumars 8y ago> For instance, if I do "./budget.pdf", I expect it to run the code from my pdf reader. In this case, an attack would require exploiting a vulnerability in the pdf reader. That is to say, budget.pdf is not untrusted code, but rather untrusted data. You cannot simply do ./budget.pdf. If you don't have the executable bit set you'd get a permission denied error (since that file doesn't have permission to execute). And even if you did have the execution bit set, it would fail because there isn't an interpreter configured to execute a pdf (which is the point of binfmt_misc in this context). The executable bit is what Linux / UNIX / et al use to set whether something is executable code or not. Not the file extension (like in Windows). > However, in this case the unstrusted data can claim that it is code; in which case it would be executed as such. Not without setting the executable bit first. (eg chmod +x budget.pdf) > In contrast, when I do `evince budget.pdf`, the only way for budget.pdf to become code is to trick the pdf reader into thinking it is code. Two points: 1/ PDFs technically are code though. They're Turing complete. 2/ running `evince budget.pdf` is exactly the same as running `./budget.pdf` where PDF's are mapped to evince via binfmt_misc. Just as running `./my-script.sh` is literally the same as running `/bin/sh ./my-script.sh` (where the shebang is /bin/sh). So your example and counter-example are actually the same process getting called by the kernel. It's the same thing with binaries that don't have a shebang, such as ELFs. There is a magic header (which the article mentions so I wont reiterate that) and if the binary is identified as an ELF binary so the kernel runs it by calling the ld loader, eg: /lib64/ld-linux-x86-64.so.2 /bin/sleep 10 (you can actually run this yourself from Bash too)
- laumars 8y agoInteresting point - one I hadn't considered. While I'm not trying to discount your valid concerns, Linux does have one other thing in it's favour and that is that files still need an executable bit to be set in order for binfmt_misc to even get called. Whereas on Windows the only requirement for something to be executable is the file extension to have an association with an interpreter. So on Linux you wouldn't have the same default behaviour because that executable bit isn't set by default. Moreover, if you can get around that executable bit problem then you're no worse of with binfmt_misc than you would be without since you could legitimately create a text file called "cat.jpg" with a Bash shebang and that would launch Bash in the same was a somescript.sh might. Of course, you could take things one step further and say if a malicious actor has access to your system then they might get around the execution bit problem by just calling the interpreter directly (eg "bash somescript.sh" or the /lib64/ld-linux-x86-64.so.2 /bin/sleep 30 example in the article). But that requires the actor has remote code execution rights rather than just permissions to write to the file system. And honestly by that point you've already lost the game anyway.