[Pharo-project] about vm dropping privileges
Hi all I was rereading our excellent forthcoming seaside book :) And lukas wrote "To listen on port 80, the standard port used by the HTTP protocol, the web server needs to run as root. Running a public service as root is a huge security issue. Dedicated web servers such as Apache drop their root privileges after startup. This allows them to listen to port 80 while not being root. Unfortunately this is not something that can be easily done from within the Smalltalk VM. " And I was wondering what is the exact problem? Stef
I was rereading our excellent forthcoming seaside book :)
*lol*
And lukas wrote
"To listen on port 80, the standard port used by the HTTP protocol, the web server needs to run as root. Running a public service as root is a huge security issue. Dedicated web servers such as Apache drop their root privileges after startup. This allows them to listen to port 80 while not being root. Unfortunately this is not something that can be easily done from within the Smalltalk VM. "
And I was wondering what is the exact problem?
Unix blocks port 1 - 1024 for non root users. Running a Smalltalk image as root is obviously a very bad idea, especially when used for web services. Smalltalk is full of security holes (for example Object class>>#readFrom: uses the compiler) that would allow a smart person to gain root rights. It is always good idea to run anything that is publicly reachable in some sort of a sandbox, even if this is just by using a non-privileged user. Cheers, Lukas -- Lukas Renggli http://www.lukas-renggli.ch
my question was more how can the VM be fixed :) Stef On Dec 2, 2008, at 10:00 PM, Lukas Renggli wrote:
I was rereading our excellent forthcoming seaside book :)
*lol*
And lukas wrote
"To listen on port 80, the standard port used by the HTTP protocol, the web server needs to run as root. Running a public service as root is a huge security issue. Dedicated web servers such as Apache drop their root privileges after startup. This allows them to listen to port 80 while not being root. Unfortunately this is not something that can be easily done from within the Smalltalk VM. "
And I was wondering what is the exact problem?
Unix blocks port 1 - 1024 for non root users. Running a Smalltalk image as root is obviously a very bad idea, especially when used for web services. Smalltalk is full of security holes (for example Object class>>#readFrom: uses the compiler) that would allow a smart person to gain root rights. It is always good idea to run anything that is publicly reachable in some sort of a sandbox, even if this is just by using a non-privileged user.
Cheers, Lukas
-- Lukas Renggli http://www.lukas-renggli.ch
_______________________________________________ Pharo-project mailing list Pharo-project@lists.gforge.inria.fr http://lists.gforge.inria.fr/cgi-bin/mailman/listinfo/pharo-project
my question was more how can the VM be fixed :)
That's not a VM issue. It's not even a Smalltalk issue. It is just common sense to not run anything reachable in public as root. There is nothing to be fixed. As a developer you usually want to be able to freely interact with the rest of the world (FFI, Aliens, OSProcess, etc), but keep the risk of a system break-in as low as possible. Also see the recent discussion in the Squeak mailing-list about that: <http://lists.squeakfoundation.org/pipermail/squeak-dev/2008-November/132679....>. Lukas -- Lukas Renggli http://www.lukas-renggli.ch
Unix blocks port 1 - 1024 for non root users. Running a Smalltalk image as root is obviously a very bad idea, especially when used for web services. Smalltalk is full of security holes (for example Object class>>#readFrom: uses the compiler) that would allow a smart person to gain root rights. It is always good idea to run anything that is publicly reachable in some sort of a sandbox, even if this is just by using a non-privileged user.
Hi Lukas, I read the thread you mentioned. Isn't it feasible to make the port 80 accessible for a non-root process? This is probably hardcoded in the kernel, but since this problem has been around for years in most communities, but not to fix this in the kernel? Just a very naive question :-) Cheers, Alexandre -- _,.;:~^~:;._,.;:~^~:;._,.;:~^~:;._,.;:~^~:;._,.;: Alexandre Bergel http://www.bergel.eu ^~:;._,.;:~^~:;._,.;:~^~:;._,.;:~^~:;._,.;:~^~:;.
reading about how unix programs drop privs it seems they can use seteuid() to alter the state of the calling process. Not that the VM needs to be 'fixed' but could the application be enhanced, using OSProcess perhaps?, to drop privs in this way once port 80 has been bound to? I read somewhere else that some applications spawn child processes with modified privs. i don't know much about the details, just interested. Mike On Tue, Dec 2, 2008 at 9:30 PM, Lukas Renggli <renggli@gmail.com> wrote:
my question was more how can the VM be fixed :)
That's not a VM issue. It's not even a Smalltalk issue. ...
Alexandre Bergel wrote:
Unix blocks port 1 - 1024 for non root users. Running a Smalltalk image as root is obviously a very bad idea, especially when used for web services. Smalltalk is full of security holes (for example Object class>>#readFrom: uses the compiler) that would allow a smart person to gain root rights. It is always good idea to run anything that is publicly reachable in some sort of a sandbox, even if this is just by using a non-privileged user.
Hi Lukas,
I read the thread you mentioned. Isn't it feasible to make the port 80 accessible for a non-root process? This is probably hardcoded in the kernel, but since this problem has been around for years in most communities, but not to fix this in the kernel? Just a very naive question :-)
From recent thread on squeak-dev you can see that we actually came to the solution of how to run on port 80 without being root. And solution is as Apache is doing: starting with root then dropping the privilege level to the normal user. [squeak-dev] smalltalk and Web stuff http://www.nabble.com/-squeak-dev--smalltalk-and-Web-stuff-td20643881.html Best regards Janko -- Janko Mivšek AIDA/Web Smalltalk Web Application Server http://www.aidaweb.si
Yes, I read that. But is there any conceptual implication to have the port 80 accessible only by root? This looks like to be very arbitrary no? Alexandre On 2 Dec 2008, at 18:59, Janko Mivšek wrote:
Alexandre Bergel wrote:
Unix blocks port 1 - 1024 for non root users. Running a Smalltalk image as root is obviously a very bad idea, especially when used for web services. Smalltalk is full of security holes (for example Object class>>#readFrom: uses the compiler) that would allow a smart person to gain root rights. It is always good idea to run anything that is publicly reachable in some sort of a sandbox, even if this is just by using a non-privileged user.
Hi Lukas, I read the thread you mentioned. Isn't it feasible to make the port 80 accessible for a non-root process? This is probably hardcoded in the kernel, but since this problem has been around for years in most communities, but not to fix this in the kernel? Just a very naive question :-)
From recent thread on squeak-dev you can see that we actually came to the solution of how to run on port 80 without being root. And solution is as Apache is doing: starting with root then dropping the privilege level to the normal user.
[squeak-dev] smalltalk and Web stuff http://www.nabble.com/-squeak-dev--smalltalk-and-Web-stuff-td20643881.html
Best regards Janko
-- Janko Mivšek AIDA/Web Smalltalk Web Application Server http://www.aidaweb.si
_______________________________________________ Pharo-project mailing list Pharo-project@lists.gforge.inria.fr http://lists.gforge.inria.fr/cgi-bin/mailman/listinfo/pharo-project
-- _,.;:~^~:;._,.;:~^~:;._,.;:~^~:;._,.;:~^~:;._,.;: Alexandre Bergel http://www.bergel.eu ^~:;._,.;:~^~:;._,.;:~^~:;._,.;:~^~:;._,.;:~^~:;.
On Dec 2, 2008, at 23:04 , Alexandre Bergel wrote:
Yes, I read that. But is there any conceptual implication to have the port 80 accessible only by root? This looks like to be very arbitrary no?
I don't think so. The lower port numbers are used for common services like http or mail for which always the same ports are used by convention. You wouldn't want to allow potentially highjacked processes to be able to bind to such a ports (e.g., pretending to be your mail server). Adrian
Alexandre
On 2 Dec 2008, at 18:59, Janko Mivšek wrote:
Alexandre Bergel wrote:
Unix blocks port 1 - 1024 for non root users. Running a Smalltalk image as root is obviously a very bad idea, especially when used for web services. Smalltalk is full of security holes (for example Object class>>#readFrom: uses the compiler) that would allow a smart person to gain root rights. It is always good idea to run anything that is publicly reachable in some sort of a sandbox, even if this is just by using a non-privileged user.
Hi Lukas, I read the thread you mentioned. Isn't it feasible to make the port 80 accessible for a non-root process? This is probably hardcoded in the kernel, but since this problem has been around for years in most communities, but not to fix this in the kernel? Just a very naive question :-)
From recent thread on squeak-dev you can see that we actually came to the solution of how to run on port 80 without being root. And solution is as Apache is doing: starting with root then dropping the privilege level to the normal user.
[squeak-dev] smalltalk and Web stuff http://www.nabble.com/-squeak-dev--smalltalk-and-Web-stuff-td20643881.html
Best regards Janko
-- Janko Mivšek AIDA/Web Smalltalk Web Application Server http://www.aidaweb.si
_______________________________________________ Pharo-project mailing list Pharo-project@lists.gforge.inria.fr http://lists.gforge.inria.fr/cgi-bin/mailman/listinfo/pharo-project
-- _,.;:~^~:;._,.;:~^~:;._,.;:~^~:;._,.;:~^~:;._,.;: Alexandre Bergel http://www.bergel.eu ^~:;._,.;:~^~:;._,.;:~^~:;._,.;:~^~:;._,.;:~^~:;.
_______________________________________________ Pharo-project mailing list Pharo-project@lists.gforge.inria.fr http://lists.gforge.inria.fr/cgi-bin/mailman/listinfo/pharo-project
This looks like to be very arbitrary no?
I don't think so. The lower port numbers are used for common services like http or mail for which always the same ports are used by convention. You wouldn't want to allow potentially highjacked processes to be able to bind to such a ports (e.g., pretending to be your mail server).
But we could imagine that the root password is necessary to open the port. Now, the root password is necessary to give all permissions to the process, whereas only opening once the port 80 is necessary. I am sure a better design could be done. Capabilities maybe... Alexandre
Alexandre
On 2 Dec 2008, at 18:59, Janko Mivšek wrote:
Alexandre Bergel wrote:
Unix blocks port 1 - 1024 for non root users. Running a Smalltalk image as root is obviously a very bad idea, especially when used for web services. Smalltalk is full of security holes (for example Object class>>#readFrom: uses the compiler) that would allow a smart person to gain root rights. It is always good idea to run anything that is publicly reachable in some sort of a sandbox, even if this is just by using a non-privileged user.
Hi Lukas, I read the thread you mentioned. Isn't it feasible to make the port 80 accessible for a non-root process? This is probably hardcoded in the kernel, but since this problem has been around for years in most communities, but not to fix this in the kernel? Just a very naive question :-)
From recent thread on squeak-dev you can see that we actually came to the solution of how to run on port 80 without being root. And solution is as Apache is doing: starting with root then dropping the privilege level to the normal user.
[squeak-dev] smalltalk and Web stuff http://www.nabble.com/-squeak-dev--smalltalk-and-Web-stuff-td20643881.html
Best regards Janko
-- Janko Mivšek AIDA/Web Smalltalk Web Application Server http://www.aidaweb.si
_______________________________________________ Pharo-project mailing list Pharo-project@lists.gforge.inria.fr http://lists.gforge.inria.fr/cgi-bin/mailman/listinfo/pharo-project
-- _,.;:~^~:;._,.;:~^~:;._,.;:~^~:;._,.;:~^~:;._,.;: Alexandre Bergel http://www.bergel.eu ^~:;._,.;:~^~:;._,.;:~^~:;._,.;:~^~:;._,.;:~^~:;.
_______________________________________________ Pharo-project mailing list Pharo-project@lists.gforge.inria.fr http://lists.gforge.inria.fr/cgi-bin/mailman/listinfo/pharo-project
_______________________________________________ Pharo-project mailing list Pharo-project@lists.gforge.inria.fr http://lists.gforge.inria.fr/cgi-bin/mailman/listinfo/pharo-project
-- _,.;:~^~:;._,.;:~^~:;._,.;:~^~:;._,.;:~^~:;._,.;: Alexandre Bergel http://www.bergel.eu ^~:;._,.;:~^~:;._,.;:~^~:;._,.;:~^~:;._,.;:~^~:;.
2008/12/3 Adrian Lienhard <adi@netstyle.ch>:
On Dec 2, 2008, at 23:04 , Alexandre Bergel wrote:
Yes, I read that. But is there any conceptual implication to have the port 80 accessible only by root? This looks like to be very arbitrary no?
I don't think so. The lower port numbers are used for common services like http or mail for which always the same ports are used by convention. You wouldn't want to allow potentially highjacked processes to be able to bind to such a ports (e.g., pretending to be your mail server).
what if your mail server bound to port 9999? :) i don't see how disallowing binding a non-root process to ports less than 1024 improves security much. As well, as i don't see why squeak vm should care about such details.
Adrian
Alexandre
On 2 Dec 2008, at 18:59, Janko Mivšek wrote:
Alexandre Bergel wrote:
Unix blocks port 1 - 1024 for non root users. Running a Smalltalk image as root is obviously a very bad idea, especially when used for web services. Smalltalk is full of security holes (for example Object class>>#readFrom: uses the compiler) that would allow a smart person to gain root rights. It is always good idea to run anything that is publicly reachable in some sort of a sandbox, even if this is just by using a non-privileged user.
Hi Lukas, I read the thread you mentioned. Isn't it feasible to make the port 80 accessible for a non-root process? This is probably hardcoded in the kernel, but since this problem has been around for years in most communities, but not to fix this in the kernel? Just a very naive question :-)
From recent thread on squeak-dev you can see that we actually came to the solution of how to run on port 80 without being root. And solution is as Apache is doing: starting with root then dropping the privilege level to the normal user.
[squeak-dev] smalltalk and Web stuff
http://www.nabble.com/-squeak-dev--smalltalk-and-Web-stuff-td20643881.html
Best regards Janko
-- Janko Mivšek AIDA/Web Smalltalk Web Application Server http://www.aidaweb.si
_______________________________________________ Pharo-project mailing list Pharo-project@lists.gforge.inria.fr http://lists.gforge.inria.fr/cgi-bin/mailman/listinfo/pharo-project
-- _,.;:~^~:;._,.;:~^~:;._,.;:~^~:;._,.;:~^~:;._,.;: Alexandre Bergel http://www.bergel.eu ^~:;._,.;:~^~:;._,.;:~^~:;._,.;:~^~:;._,.;:~^~:;.
_______________________________________________ Pharo-project mailing list Pharo-project@lists.gforge.inria.fr http://lists.gforge.inria.fr/cgi-bin/mailman/listinfo/pharo-project
_______________________________________________ Pharo-project mailing list Pharo-project@lists.gforge.inria.fr http://lists.gforge.inria.fr/cgi-bin/mailman/listinfo/pharo-project
-- Best regards, Igor Stasenko AKA sig.
On Wed, Dec 3, 2008 at 02:19, Alexandre Bergel <alexandre@bergel.eu> wrote:
But we could imagine that the root password is necessary to open the port. Now, the root password is necessary to give all permissions to the process, whereas only opening once the port 80 is necessary. I am sure a better design could be done. Capabilities maybe...
Well, you can always try to install GNU/Hurd, build your own capability-based OS on top of L4 or Coyotos, or take part in the posix steering committee if there is such a thing ;) -- Damien Pollet type less, do more [ | ] http://people.untyped.org/damien.pollet
then lukas what you wrote in the book does not describe the correct problem. Because when I read I thought it was a problem of the Smalltalk VM "To listen on port 80, the standard port used by the HTTP protocol, the web server needs to run as root. Running a public service as root is a huge security issue. Dedicated web servers such as Apache drop their root privileges after startup. This allows them to listen to port 80 while not being root. Unfortunately this is not something that can be easily done from within the Smalltalk VM. " You write "Dedicated web servers such as Apache drop their root privileges after startup." So I was wondering why a SMalltalk VM cannot do the same? Stef On Dec 2, 2008, at 10:30 PM, Lukas Renggli wrote:
my question was more how can the VM be fixed :)
That's not a VM issue. It's not even a Smalltalk issue. It is just common sense to not run anything reachable in public as root. There is nothing to be fixed. As a developer you usually want to be able to freely interact with the rest of the world (FFI, Aliens, OSProcess, etc), but keep the risk of a system break-in as low as possible.
Also see the recent discussion in the Squeak mailing-list about that: <http://lists.squeakfoundation.org/pipermail/squeak-dev/2008-November/132679....
.
Lukas
-- Lukas Renggli http://www.lukas-renggli.ch
_______________________________________________ Pharo-project mailing list Pharo-project@lists.gforge.inria.fr http://lists.gforge.inria.fr/cgi-bin/mailman/listinfo/pharo-project
Stéphane Ducasse wrote:
"Dedicated web servers such as Apache drop their root privileges after startup."
So I was wondering why a SMalltalk VM cannot do the same?
Here is how I managed to do that from a workspace after making a class LibC according to recent guidelines from Gerardo Richarte on squeak-dev: from Workspace: "be sure FFI is installed" "sudo ln -s /lib/libc-2.3.5.so /usr/local/lib/squeak/3.10-1/libc.so" "start Swazoo as root" libc := LibC new. libc setruid: 1000 euid: 1000 suid: 1000. "check that user is no more root" LibC code: Object subclass: #LibC instanceVariableNames: '' classVariableNames: '' poolDictionaries: '' category: 'FFI-Unix' ... setruid: realUid euid: effectiveUid suid: savedUid <cdecl: long 'setresuid' (long long long) module: 'libc'> ^ self externalCallFailed ... The only problem is the path to libc library, which must be found linked manually (see sudo ln..). If VM can be modified to use it more directly... I hope this help a bit. Best regards Janko -- Janko Mivšek AIDA/Web Smalltalk Web Application Server http://www.aidaweb.si
Stéphane Ducasse wrote:
"Dedicated web servers such as Apache drop their root privileges after startup."
So I was wondering why a SMalltalk VM cannot do the same?
Here is how I managed to do that from a workspace after making a class LibC according to recent guidelines from Gerardo Richarte on squeak-dev: from Workspace: "be sure FFI is installed" "sudo ln -s /lib/libc-2.3.5.so /usr/local/lib/squeak/3.10-1/libc.so" "start Swazoo as root" libc := LibC new. libc setruid: 1000 euid: 1000 suid: 1000. "check that user is no more root" LibC code: Object subclass: #LibC instanceVariableNames: '' classVariableNames: '' poolDictionaries: '' category: 'FFI-Unix' ... setruid: realUid euid: effectiveUid suid: savedUid <cdecl: long 'setresuid' (long long long) module: 'libc'> ^ self externalCallFailed ... The only problem is the path to libc library, which must be found linked manually (see sudo ln..). If VM can be modified to use it more directly... I hope this help a bit. Best regards Janko -- Janko Mivšek AIDA/Web Smalltalk Web Application Server http://www.aidaweb.si
participants (8)
-
Adrian Lienhard -
Alexandre Bergel -
Damien Pollet -
Igor Stasenko -
Janko Mivšek -
Lukas Renggli -
Michael Roberts -
Stéphane Ducasse