6 ms·

The problem with macros in Rust is that they have full access to your computer. This is literally an invitation for exploitation. I think we will see the attack

The problem with macros in Rust is that they have full access to your computer. This is literally an invitation for exploitation. I think we will see the attacks based on this vulnerability once Rust becomes more popular.

cmrx64 2y ago
There’s already a runtime for sandboxing macros with wasm: https://github.com/dtolnay/watt https://github.com/dtolnay/watt
- deleted 2y ago
  [deleted]
- codedokode 2y ago
  So you need to use hacks, like compiling code into a web-browser language and messing with config files instead of having security out-of-box? But thank you for letting me learn something useful.
  - cmrx64 2y ago
    It’s a demonstration. wasm is a portable ISA more than a “language”. Surely it makes sense to build things incrementally, in layers? https://internals.rust-lang.org/t/pre-rfc-sandboxed-deterministic-reproducible-efficient-wasm-compilation-of-proc-macros https://internals.rust-lang.org/t/pre-rfc-sandboxed-determin... But go off, king.
jkelleyrtp 2y ago
`make myfile.mk` -> pwned I do share the sentiment - and complain about this frequently - but any environment with build scripts can wreck your computer. Encrypt what you can, I guess, but software engineering is an extremely dangerous job wrt security.
- zamalek 2y ago
  Its slightly more insidious: merely opening it in a text editor (assuming it has some form of lsp) could pwn you. Rust definitely isn't alone in this. Quite a few of the editors I know will run in a dumbed down mode when opening an unknown repo.
  - sieabahlpark 2y ago
    [dead]
  - kibwen 2y ago
    It's even more insidious than that! Even navigating to a directory in a checkout of a hostile git repo can run arbitrary code if your shell displays git info (what branch you're on, etc).
hypeatei 2y ago
Do other languages have a security model for this? I've always assumed that building arbitrary code could execute something in most languages. I think using something like the pledge syscall from OpenBSD in the compiler could be useful. That way, it's controlled at the process level which things can be accessed on the system.
- codedokode 2y ago
  C macros and gcc do not allow to run arbitrary code during compilation.
  - fulafel 2y ago
    The C standard is accomodating as always: https://feross.org/gcc-ownage/ https://feross.org/gcc-ownage/
  - kibwen 2y ago
    In practice every C build system already does.
treyd 2y ago
Proc macros. Declarative macros do not.

cmrx64 2y ago

There’s already a runtime for sandboxing macros with wasm: https://github.com/dtolnay/watt https://github.com/dtolnay/watt

deleted 2y ago
[deleted]
codedokode 2y ago
So you need to use hacks, like compiling code into a web-browser language and messing with config files instead of having security out-of-box? But thank you for letting me learn something useful.
- cmrx64 2y ago
  It’s a demonstration. wasm is a portable ISA more than a “language”. Surely it makes sense to build things incrementally, in layers? https://internals.rust-lang.org/t/pre-rfc-sandboxed-deterministic-reproducible-efficient-wasm-compilation-of-proc-macros https://internals.rust-lang.org/t/pre-rfc-sandboxed-determin... But go off, king.

jkelleyrtp 2y ago

`make myfile.mk` -> pwned I do share the sentiment - and complain about this frequently - but any environment with build scripts can wreck your computer. Encrypt what you can, I guess, but software engineering is an extremely dangerous job wrt security.

zamalek 2y ago
Its slightly more insidious: merely opening it in a text editor (assuming it has some form of lsp) could pwn you. Rust definitely isn't alone in this. Quite a few of the editors I know will run in a dumbed down mode when opening an unknown repo.
- sieabahlpark 2y ago
  [dead]
- kibwen 2y ago
  It's even more insidious than that! Even navigating to a directory in a checkout of a hostile git repo can run arbitrary code if your shell displays git info (what branch you're on, etc).

hypeatei 2y ago

Do other languages have a security model for this? I've always assumed that building arbitrary code could execute something in most languages. I think using something like the pledge syscall from OpenBSD in the compiler could be useful. That way, it's controlled at the process level which things can be accessed on the system.

codedokode 2y ago
C macros and gcc do not allow to run arbitrary code during compilation.
- fulafel 2y ago
  The C standard is accomodating as always: https://feross.org/gcc-ownage/ https://feross.org/gcc-ownage/
- kibwen 2y ago
  In practice every C build system already does.

treyd 2y ago

Proc macros. Declarative macros do not.