Discussion:
[oss-security] Using quilt on untrusted RPM spec files
Matthias Gerstner
2018-09-27 15:59:34 UTC
Permalink
Hello list,

in the SUSE security team we have been recently looking into the security of
using quilt on untrusted RPM spec files and patches. The openSUSE distribution
is RPM based and uses the open build service (OBS) [1] for collaboration with
the community. Packagers, contributors and interested people can host their
packages in personal home projects and can become maintainers of development
packages that are targeted for inclusion in SUSE distributions.

Once packages are submitted into an actual SUSE distribution like openSUSE
Tumbleweed human and automated reviews of the package contents will take
place for quality assurance and security. One of the typical workflows for
many people concerned with managing the openSUSE distribution is to checkout
a (possible not yet reviewed) OBS package and run `quilt setup` on the RPM
spec file for extracting the package sources and applying any specified
patches. When building an RPM package on server or client side then this
happens in an isolated environment (e.g. a chroot [2] or in a virtual
machine). The `quilt setup` invocation, however, typically happens
interactively on client machines without special security measures.

It turns out that running `quilt setup` on untrusted sources is not a good
idea:

- The statements in the `%prep` section of the RPM spec file are
plainly executed in the context of the calling user.
- Arbitrary flags can be passed to `patch` via `%define _default_patch_flags
...` in the spec file. By embedding semicolons into the flags also arbitrary
commands can be injected this way.
- By combining the available vectors, difficult to spot malicious code can be
hidden in RPM spec files. For example patch can be caused to follow
symlinks, thereby "patching" files in a user's home directory as demonstrated
in [3].

Now we would be interested in discussing this topic with the community. Do
other distributions have similar workflows and therefore similar attack
surface as we do? What would be viable countermeasures?

Our current assessment is that most people that use quilt this way are
probably not aware of the potential dangers involved. Furthermore we think
that in order to fix this a simple to use default protection mechanism
would be required. While running `quilt setup` e.g. in a docker
container would provide fair security against such scenarios it would
introduce quite some dependencies and complexities that make it not well
suited for a default approach.

We are currently testing isolation of quilt with nsjail [4]. A first result,
the wrapper "squilt" [5], can confine quilt's execution to a package
directory, thereby reducing the attack surface significantly.

[1]: https://openbuildservice.org
[2]: https://build.opensuse.org/package/show/openSUSE:Tools/build
[3]: https://build.opensuse.org/package/show/home:mgerstner/surprise
[4]: http://nsjail.com
[5]: https://github.com/jsegitz/squilt
--
Matthias Gerstner <***@suse.de>
Dipl.-Wirtsch.-Inf. (FH), Security Engineer
https://www.suse.com/security
Telefon: +49 911 740 53 290
GPG Key ID: 0x14C405C971923553

SUSE Linux GmbH
GF: Felix Imendörffer, Jane Smithard, Graham Norton
HRB 21284 (AG Nuernberg)
Randy Barlow
2018-09-28 02:39:17 UTC
Permalink
Post by Matthias Gerstner
Now we would be interested in discussing this topic with the
community. Do<br>
other distributions have similar workflows and therefore similar
attack<br>
surface as we do? What would be viable countermeasures?
Hey Matthias!

In Fedora we have similar challenges. We've got a tool called fedora-
review[0] that is maybe kinda similar to quilt. It uses mock[1] to
build the source RPM (and mock does this in a chroot to help with the
problems you described) and then it does some basic quality checks on
the RPM afterwards.

I'm not sure how generic mock is, but maybe it would be helpful to you.
Its wiki page describes it as being used by Mageia, so it might be
extensible for SUSE as well.

Happy coding!


[0] https://pagure.io/FedoraReview
[1] https://github.com/rpm-software-management/mock
Jakub Wilk
2018-10-18 14:57:29 UTC
Permalink
Post by Randy Barlow
In Fedora we have similar challenges. We've got a tool called
fedora-review[0] that is maybe kinda similar to quilt.
Quilt is a tool to manage patch series, so maybe not that similar. :-)
Post by Randy Barlow
It uses mock[1] to build the source RPM (and mock does this in a chroot
to help with the problems you described)
If it's really just chroot, then I'm afraid that's not a sufficient
protection. One can easily escape the chroot with ptrace(2).
--
Jakub Wilk
Stuart D. Gathman
2018-10-23 03:42:21 UTC
Permalink
Post by Jakub Wilk
Post by Randy Barlow
In Fedora we have similar challenges. We've got a tool called
fedora-review[0] that is maybe kinda similar to quilt.
Quilt is a tool to manage patch series, so maybe not that similar. :-)
mock can run quilt also
Post by Jakub Wilk
Post by Randy Barlow
It uses mock[1] to build the source RPM (and mock does this in a
chroot to help with the problems you described)
If it's really just chroot, then I'm afraid that's not a sufficient
protection. One can easily escape the chroot with ptrace(2).
Doesn't that escape require root? Or at least a ptraceable process
(i.e. with the same uid) outside the chroot?

Not that I'd stake anything really important on current container
security... (And even VMs are vulnerable to the latest round of
hardware bugs.)

Jakub Wilk
2018-10-22 18:26:38 UTC
Permalink
Post by Matthias Gerstner
It turns out that running `quilt setup` on untrusted sources is not a
Debian largely avoids this problem by having a source package format
with built-in patch system[0]. Most of the time the unpacked source
package will have patches applied, so there's no need for the reviewer
to run untrusted code to prepare the source.

(That said, dpkg-source had quite a few path traversal bugs in the
past[1] and I have a hunch there's more to be found...)

While debian/rules can have optional "patch" target[2] (which is a bit
like RPM's %prep), it felt to disuse these days. A developer wouldn't
call "debian/rules patch" against a random not-yet-reviewed package,
because it would be unusual to have this target implemented.

[0] https://manpages.debian.org/stretch/dpkg-dev/dpkg-source.1.en.html#Format:_3.0_%28quilt%29
[1] https://security-tracker.debian.org/tracker/source-package/dpkg
[2] https://www.debian.org/doc/debian-policy/ch-source.html#main-building-script-debian-rules
--
Jakub Wilk
Stuart D. Gathman
2018-10-23 03:33:38 UTC
Permalink
Fedora avoids the problem by running rpmbuild in a chroot mini
container (provided by systemd) as the mockbuild user with no network
access - this extracts source, does %prep, etc. This is done with the
'mock' utility. The reviewer can still examine the prepped source in
the host filesystem. The reviewer can also run commands inside the
mock chroot container, install additional packages (like vim), get a
shell inside the container, etc.
Loading...