Opened 13 years ago
Closed 5 years ago
#453 closed defect (duplicate)
WHIZARD Web services
| Reported by: | Christian Speckner | Owned by: | Christian Speckner |
|---|---|---|---|
| Priority: | P4 | Milestone: | v4.0 |
| Component: | configure | Version: | 2.0.6 |
| Severity: | minor | Keywords: | |
| Cc: |
Description
For improved security, i.e. in environments where WHIZARD runs SINDARIN supplied by users without shell access, it is desireable to deactivate the execution of external programs. I suggest implementing a security command line flag which deactivates exec (and maybe other functionality) on requrest, the default of which could be modified at configure time. If noone objects, I would implement this.
Change History (11)
comment:1 Changed 13 years ago by
comment:2 Changed 13 years ago by
| Milestone: | v2.0.7 → v2.1.0 |
|---|
As long as this does not apply for the internal programs like O'Mega, Gamelan etc. I am fine with that. But I think this is not top priority right now.
comment:3 Changed 13 years ago by
We should discuss this once again. How it is ranked, what is intended, and who is going to do it when!
comment:4 Changed 13 years ago by
| Milestone: | v2.1.0 → v2.2.0 |
|---|
Okay, I believe this ticket will never be addressed....
comment:6 Changed 10 years ago by
| Component: | core → configure |
|---|---|
| Milestone: | v2.3.0 → v3.0 |
| Summary: | Disable exec functionality at configure / runtime → WHIZARD Web services |
THis includes: Disable exec functionality at configure / runtime.
comment:7 Changed 10 years ago by
Should we set up a WHIZARD web server, we should remember to take care of exec traps.
comment:8 Changed 8 years ago by
Should we actually bury this project, or does anyone think this will ever happen?
comment:10 Changed 7 years ago by
| Milestone: | v3.0.0 → v4.0 |
|---|
comment:11 Changed 5 years ago by
| Resolution: | → duplicate |
|---|---|
| Status: | new → closed |
Transferred to Gitlab issue 339.
Yes, agreed. I would even turn the logic around:
WHIZARD maintains a list of allowed programs, which is checked against the argument of the 'exec' command (which should execute one program at a time). The list is given to WHIZARD on the command line (analogous to --user-lib; the array can reside in the 'global' record of rt_data_t). Furthermore, if the user doesn't want to give fully qualified paths as programs names, he has to provide the search path explicitly, also on the command line. Otherwise, the 'exec' command uses an empty search path for the spawned shell.
The idea is that the 'exec' feature should be used sparingly. The Sindarin file, by itself, should not be able to raise privileges.