[25839] in Perl-Users-Digest
Perl-Users Digest, Issue: 8075 Volume: 10
daemon@ATHENA.MIT.EDU (Perl-Users Digest)
Thu May 12 18:05:33 2005
Date: Thu, 12 May 2005 15:05:07 -0700 (PDT)
From: Perl-Users Digest <Perl-Users-Request@ruby.OCE.ORST.EDU>
To: Perl-Users@ruby.OCE.ORST.EDU (Perl-Users Digest)
Perl-Users Digest Thu, 12 May 2005 Volume: 10 Number: 8075
Today's topics:
Re: Alternatives to Safe.pm (not full of security holes <salvafg@terra.es>
Re: Alternatives to Safe.pm (not full of security holes <ignoramus18353@NOSPAM.18353.invalid>
Re: Alternatives to Safe.pm (not full of security holes <mikeh@perusion.net>
Re: Alternatives to Safe.pm (not full of security holes <ignoramus18353@NOSPAM.18353.invalid>
Re: Alternatives to Safe.pm (not full of security holes <tadmc@augustmail.com>
Re: Alternatives to Safe.pm (not full of security holes <mikeh@perusion.net>
Re: Extracting strings delimited by other strings <tadmc@augustmail.com>
Digest Administrivia (Last modified: 6 Apr 01) (Perl-Users-Digest Admin)
----------------------------------------------------------------------
Date: Thu, 12 May 2005 18:44:17 GMT
From: Salvador Fandino <salvafg@terra.es>
Subject: Re: Alternatives to Safe.pm (not full of security holes)?
Message-Id: <5uNge.543659$I96.659636@telenews.teleline.es>
Ignoramus18353 wrote:
> I own website algebra.com, and am right now working on a feature where
> my users can submit their own algebra solvers.
>
> These solvers can either be written in a simple markup language (not
> interesting), or in perl.
>
> I first chose Safe.pm to run user submitted code in a safe
> compartment. Now I realize that Safe.pm is so full of holes that it
> is not funny.
>
> Is there some other alternative to safe.pm that would let me run perl
> code in a compartment?
no, your only possibility is doing it at the OS level, for example
running a child process in a chroot jail, and using ulimit to limit the
resources it can take... but even this is not completelly safe, security
holes allowing local exploits are not so rare. Check also User Space Linux.
Cheers,
- Salvador.
------------------------------
Date: 12 May 2005 19:20:08 GMT
From: Ignoramus18353 <ignoramus18353@NOSPAM.18353.invalid>
Subject: Re: Alternatives to Safe.pm (not full of security holes)?
Message-Id: <d60a98$3gg$0@pita.alt.net>
On Thu, 12 May 2005 18:44:17 GMT, Salvador Fandino <salvafg@terra.es> wrote:
> Ignoramus18353 wrote:
>> I own website algebra.com, and am right now working on a feature where
>> my users can submit their own algebra solvers.
>>
>> These solvers can either be written in a simple markup language (not
>> interesting), or in perl.
>>
>> I first chose Safe.pm to run user submitted code in a safe
>> compartment. Now I realize that Safe.pm is so full of holes that it
>> is not funny.
>>
>> Is there some other alternative to safe.pm that would let me run perl
>> code in a compartment?
>
> no, your only possibility is doing it at the OS level, for example
> running a child process in a chroot jail, and using ulimit to limit the
> resources it can take... but even this is not completelly safe, security
> holes allowing local exploits are not so rare. Check also User Space Linux.
Salvador, that's what I will do, yes. Every apache process will have a
companion process for perl calculators only. The companion process
will run in its own chrooted jail. It will receive calculator
definitions from apache children, and execute them inside Safe. So, I
will have security of Safe plus chrooted jail.
i
------------------------------
Date: Thu, 12 May 2005 19:32:23 -0000
From: Mike Heins <mikeh@perusion.net>
Subject: Re: Alternatives to Safe.pm (not full of security holes)?
Message-Id: <slrnd87bq6.npn.mikeh@bill.heins.net>
On 2005-05-12, Ignoramus18353 <ignoramus18353@NOSPAM.18353.invalid> wrote:
> On 12 May 2005 16:36:32 GMT, Christopher Nehren <apeiron+usenet@coitusmentis.info> wrote:
>> On 2005-05-12, Ignoramus18353 scribbled these
>> curious markings:
>>> I first chose Safe.pm to run user submitted code in a safe
>>> compartment. Now I realize that Safe.pm is so full of holes that it
>>> is not funny.
>>
>> How about, instead of just whining about a situation that (considering
>> the popularity of Safe) is extremely serious and doing *absolutely
>> nothing* about it, you submit bug reports of these holes to the author
>> so that they can be fixed so that you *can* use it?
>
> I did not discover these bugs, I read about them from various bug list
> archives. So they are all already known. Safe.pm is no longer
> supported by its author due to all the holes. My understanding is that
> it basically cannot be made to work right.
>
> I am interested in real solutions. I am not a perl security expert and
> I cannot expect to know all potential holes in safe.pm.
>
I would like to know about any *existing* holes. Are you sure you
aren't reading material from years ago?
I am author of a large Perl project that uses Safe every day, with
excellent results. We have seen zero real-world security breaches because of
it, and the software serves hundreds or thousands of ecommerce sites
that have taken billions of dollars in orders. Certainly if it was
hackable, it would have been done by now. 8-)
--
Mike Heins
Perusion -- Expert Interchange Consulting http://www.perusion.com/
Be patient. God isn't finished with me yet. -- unknown
------------------------------
Date: 12 May 2005 19:54:43 GMT
From: Ignoramus18353 <ignoramus18353@NOSPAM.18353.invalid>
Subject: Re: Alternatives to Safe.pm (not full of security holes)?
Message-Id: <d60ca3$5p4$0@pita.alt.net>
On Thu, 12 May 2005 19:32:23 -0000, Mike Heins <mikeh@perusion.net> wrote:
> On 2005-05-12, Ignoramus18353 <ignoramus18353@NOSPAM.18353.invalid> wrote:
>> On 12 May 2005 16:36:32 GMT, Christopher Nehren <apeiron+usenet@coitusmentis.info> wrote:
>>> On 2005-05-12, Ignoramus18353 scribbled these
>>> curious markings:
>>>> I first chose Safe.pm to run user submitted code in a safe
>>>> compartment. Now I realize that Safe.pm is so full of holes that it
>>>> is not funny.
>>>
>>> How about, instead of just whining about a situation that (considering
>>> the popularity of Safe) is extremely serious and doing *absolutely
>>> nothing* about it, you submit bug reports of these holes to the author
>>> so that they can be fixed so that you *can* use it?
>>
>> I did not discover these bugs, I read about them from various bug list
>> archives. So they are all already known. Safe.pm is no longer
>> supported by its author due to all the holes. My understanding is that
>> it basically cannot be made to work right.
>>
>> I am interested in real solutions. I am not a perl security expert and
>> I cannot expect to know all potential holes in safe.pm.
>>
>
> I would like to know about any *existing* holes. Are you sure you
> aren't reading material from years ago?
I refer you to
http://www.codecomments.com/archive233-2004-5-187827.html
and this exploit:
sub forbidden { print "forbidden\n"; }
my $eval = '@{my $x="main::forbidden"; $x=\&$x; $x->(); []}';
my $output = $s->reval("sub{qq\0$eval\0}", 1);
die $@ if $@;
$output->(); # calls &main::forbidden
Basically, you define sub forbidden in the main namespace, and you can
call it from your perl code inside the Safe compartment by doing this:
@{my $x="main::forbidden"; $x=\&$x; $x->(); []}
I tried it myself, unfortunately, it still breaches security, with the
latest Safe.pm and all. I was extremely upset, as I already wrote all
code using Safe.pm and liked what I had.
Using a similar technique, the attacher could easily get access to my
database handle, for example, with full access.
> I am author of a large Perl project that uses Safe every day, with
> excellent results. We have seen zero real-world security breaches because of
> it, and the software serves hundreds or thousands of ecommerce sites
> that have taken billions of dollars in orders. Certainly if it was
> hackable, it would have been done by now. 8-)
Tell me what those ecommerce sites are <VEBG>
Is your product called I*t*r*h*n*e?
I am obviously not going to do anything bad, just kidding. If you tell
me some input box where people can enter evaluatable code, we can try
breaking it together.
i
------------------------------
Date: Thu, 12 May 2005 15:35:36 -0500
From: Tad McClellan <tadmc@augustmail.com>
Subject: Re: Alternatives to Safe.pm (not full of security holes)?
Message-Id: <slrnd87fgo.m2n.tadmc@magna.augustmail.com>
A. Sinan Unur <1usa@llenroc.ude.invalid> wrote:
> Ignoramus18353 <ignoramus18353@NOSPAM.18353.invalid> wrote in news:d5vusm
> $f1f$0@pita.alt.net:
> Why do you have X-No-Archive set?
Oh.
That explains why I'm seeing a thread with no 1st post in it...
--
Tad McClellan SGML consulting
tadmc@augustmail.com Perl programming
Fort Worth, Texas
------------------------------
Date: Thu, 12 May 2005 21:39:35 -0000
From: Mike Heins <mikeh@perusion.net>
Subject: Re: Alternatives to Safe.pm (not full of security holes)?
Message-Id: <slrnd87j8m.qd6.mikeh@bill.heins.net>
On 2005-05-12, Ignoramus18353 <ignoramus18353@NOSPAM.18353.invalid> wrote:
> On Thu, 12 May 2005 19:32:23 -0000, Mike Heins <mikeh@perusion.net> wrote:
>> On 2005-05-12, Ignoramus18353 <ignoramus18353@NOSPAM.18353.invalid> wrote:
>>> On 12 May 2005 16:36:32 GMT, Christopher Nehren <apeiron+usenet@coitusmentis.info> wrote:
>>>> On 2005-05-12, Ignoramus18353 scribbled these
>>>> curious markings:
>>>>> I first chose Safe.pm to run user submitted code in a safe
>>>>> compartment. Now I realize that Safe.pm is so full of holes that it
>>>>> is not funny.
>>>>
>>>> How about, instead of just whining about a situation that (considering
>>>> the popularity of Safe) is extremely serious and doing *absolutely
>>>> nothing* about it, you submit bug reports of these holes to the author
>>>> so that they can be fixed so that you *can* use it?
>>>
>>> I did not discover these bugs, I read about them from various bug list
>>> archives. So they are all already known. Safe.pm is no longer
>>> supported by its author due to all the holes. My understanding is that
>>> it basically cannot be made to work right.
>>>
>>> I am interested in real solutions. I am not a perl security expert and
>>> I cannot expect to know all potential holes in safe.pm.
>>>
>>
>> I would like to know about any *existing* holes. Are you sure you
>> aren't reading material from years ago?
>
> I refer you to
>
> http://www.codecomments.com/archive233-2004-5-187827.html
>
> and this exploit:
>
> sub forbidden { print "forbidden\n"; }
>
> my $eval = '@{my $x="main::forbidden"; $x=\&$x; $x->(); []}';
>
> my $output = $s->reval("sub{qq\0$eval\0}", 1);
> die $@ if $@;
> $output->(); # calls &main::forbidden
>
> Basically, you define sub forbidden in the main namespace, and you can
> call it from your perl code inside the Safe compartment by doing this:
>
> @{my $x="main::forbidden"; $x=\&$x; $x->(); []}
>
> I tried it myself, unfortunately, it still breaches security, with the
> latest Safe.pm and all. I was extremely upset, as I already wrote all
> code using Safe.pm and liked what I had.
>
The routine *compiles* under Safe, it doesn't execute there. Have you tried
running it in a compartment?
If you are expecting Safe to compile a subroutine then protect you when
that routine is called outside the compartment, you are expecting
something it cannot deliver.
--
Mike Heins
Perusion -- Expert Interchange Consulting http://www.perusion.com/
Be patient. God isn't finished with me yet. -- unknown
------------------------------
Date: Thu, 12 May 2005 16:06:29 -0500
From: Tad McClellan <tadmc@augustmail.com>
Subject: Re: Extracting strings delimited by other strings
Message-Id: <slrnd87hal.m2n.tadmc@magna.augustmail.com>
Scott Bass <> wrote:
> "Tad McClellan" <tadmc@augustmail.com> wrote in message
> news:slrnd7o9pu.i4j.tadmc@magna.augustmail.com...
>> Scott Bass <> wrote:
>
><snip...>
>
>>> Are there any modules that I could use as a starting point for this?
>
> I didn't know if maybe one of the XML modules could be coaxed to parse this.
But it is not XML data.
It has all kinds of cruft surrounding XML-looking tags.
(but maybe that's what you meant by "coaxed"?)
> Lastly, I have made good progress on my script. However, once finished, it
> would be nice if someone could give pointers on tightening it up. I'm
> tempted to post the entire script (about 100 lines) so it's all in context,
> and identify key areas where I have questions. However, I do want to be a
> good net citizen, and don't want to piss off the other readers of the list
> by not asking specific questions.
>
> I welcome any posting guidelines you may have for this situation.
Include the specific parts in your post, along with a link to
someplace that has the entire program.
--
Tad McClellan SGML consulting
tadmc@augustmail.com Perl programming
Fort Worth, Texas
------------------------------
Date: 6 Apr 2001 21:33:47 GMT (Last modified)
From: Perl-Users-Request@ruby.oce.orst.edu (Perl-Users-Digest Admin)
Subject: Digest Administrivia (Last modified: 6 Apr 01)
Message-Id: <null>
Administrivia:
#The Perl-Users Digest is a retransmission of the USENET newsgroup
#comp.lang.perl.misc. For subscription or unsubscription requests, send
#the single line:
#
# subscribe perl-users
#or:
# unsubscribe perl-users
#
#to almanac@ruby.oce.orst.edu.
NOTE: due to the current flood of worm email banging on ruby, the smtp
server on ruby has been shut off until further notice.
To submit articles to comp.lang.perl.announce, send your article to
clpa@perl.com.
#To request back copies (available for a week or so), send your request
#to almanac@ruby.oce.orst.edu with the command "send perl-users x.y",
#where x is the volume number and y is the issue number.
#For other requests pertaining to the digest, send mail to
#perl-users-request@ruby.oce.orst.edu. Do not waste your time or mine
#sending perl questions to the -request address, I don't have time to
#answer them even if I did know the answer.
------------------------------
End of Perl-Users Digest V10 Issue 8075
***************************************
