(adding back other people in Cc)

On Tue, Jul 16, 2024 at 01:29:43PM -0400, Boris Lukashev wrote:

Wouldn't count those shell chickens - awk alone is enough and we can
use ssh and openssl clients (all in metasploit public code). As one of
the people who makes novel shell types, I can assure you that this
effort is only going to slow skiddies and only until the rest of us
publish mitigations for this mitigation :)

Security is not binary. :)

Not all Linux systems are equals. Some hardened systems need this kind
of feature and they can get guarantees because they fully control and
trust their executable binaries (e.g. CLIP OS, chromeOS) or they
properly sandbox them.  See context in the cover letter.

awk is a script interpreter that should be patched too, like other Linux
tools.

-Boris (RageLtMan)

On July 16, 2024 12:12:49 PM EDT, James Bottomley [off-list ref] wrote:

quoted

On Tue, 2024-07-16 at 17:57 +0200, Roberto Sassu wrote:

quoted

But the Clip OS 4 patch does not cover the redirection case:

# ./bash < /root/test.sh
Hello World

Do you have a more recent patch for that?

How far down the rabbit hole do you want to go?  You can't forbid a
shell from executing commands from stdin because logging in then won't
work.  It may be possible to allow from a tty backed file and not from
a file backed one, but you still have the problem of the attacker
manually typing in the script.

The saving grace for this for shells is that they pretty much do
nothing on their own (unlike python) so you can still measure all the
executables they call out to, which provides reasonable safety.

James