Re: FW: Localizing %SIG in Safe.pm 2.{35,36,37} crashes POE::Wheel::Run ...

On 17 July 2013 09:40, Markus Jansen <[email protected]> wrote:
> Hi Rafael,
>
> I agree the signal code in Safe should stay ... however, on both 5.18.0 (=
Linux) and 5.10.1 (Solaris SPARC) I have found
> that the "local %SIG;" code snippet obviously leads to non-execution of t=
he registered signal subroutines,
> and instead to Perl bailing out.

OK, I see what you mean now. What happens in Safe should stay in the
Safe, and that's not true for %SIG, one way or another.

Also, note that this is "local *SIG", not "local %SIG", which won't
work, since the first form is needed to clear magic off %SIG while the
Safe compartment executes. However I did not foresee that this form of
local would also disable all custom signal handlers. That's extremely
inconvenient. Basically either Safe is not safe, or it breaks all
signal handling.

This is a pretty hateful situation and I'll try to find a workaround
that would spare the need for clearing %SIG ... at least with standard
operation masks.

> For which Perl versions do you think stashing %SIG away should work?

None so far.

> Without understanding the details, I can just guess that the CHILD signal=
 hits the process while just performing a Safe::reval ...

Yes, that's also my understanding.


> Best regards,
>         Markus
>
> -----Original Message-----
> From: [email protected] [mailto:[email protected]] On Behalf =
Of Rafael Garcia-Suarez
> Sent: Wednesday, July 17, 2013 9:31 AM
> To: Markus Jansen; [email protected]
> Cc: [email protected]
> Subject: Re: FW: Localizing %SIG in Safe.pm 2.{35,36,37} crashes POE::Whe=
el::Run ...
>
> Hi all
> Breaking out a Safe compartment is all about compiling code that will be =
executed later. It happens that there are working exploits that use a combi=
nation of %SIG and eval inside the safe-evaled block to execute such compil=
ations; then arbitrary commands can be run on any signal received by the pr=
ocess that compiled the safe compartment.
>
> (I repeat it again -- without this fix it's possible to make perl execute=
 `rm -fr /` through code passed to Safe. So the fix stays.)
>
> The fix I put in Safe was to simply wipe out %SIG in the Safe compartment=
. In theory that should not have been necessary, since %SIG is not shared b=
etween %main:: and the Safe root stash, but that's apparently not how the p=
erl internals work; so, to have a fix back-portable to older perls, I did n=
ot found any other way. If someone wants to investigate, I'll be happy to p=
rovide details...
>
> Also I'd like to understand why you need to set signal handlers in a Safe=
 compartment. As far as I can tell this has only ever worked by accident.
>
> On 16 July 2013 18:00, Markus Jansen <[email protected]> wrote:
>> Hi,
>>
>> FYI ... hope none of you wastes time with this really nasty trap ...
>>
>> Best regards,
>>         Markus
>>
>> -----Original Message-----
>> From: Markus Jansen
>> Sent: Tuesday, July 16, 2013 5:57 PM
>> To: [email protected]
>> Cc: Markus Jansen
>> Subject: Localizing %SIG in Safe.pm 2.{35,36,37} crashes POE::Wheel::Run=
 ...
>>
>>
>> This is a bug report for perl from [email protected], generated=
 with the help of perlbug 1.39 running under perl 5.18.0.
>>
>>
>> -----------------------------------------------------------------
>> [Please describe your issue here]
>>
>> Dear Perl5 Porters,
>>
>> localizing %SIG in Safe.pm 2.35 (on CPAN, 2.{35,36,37} in Perl core) may=
 be a great step for security, but it unfortunatately spoils POE::Wheel::Ru=
n (basically POE and all other asynchronous frameworks dealing with externa=
l processes).
>>
>> The symptom experienced is that your application might sooner or later c=
rash (reliably when using POE::Component::Resolver upon exiting a Sidecar s=
ubprocess) with the following famous last words:
>>
>>         Signal SIGCHLD received, but no signal handler set.
>>
>> Please consider a version (also on CPAN) of Safe.pm which has e.g. the l=
ocalization of %SIG as a switchable feature.
>>
>> Best regards,
>>         Markus
>>
>>
>>
>> [Please do not change anything below this line]
>> -----------------------------------------------------------------
>> ---
>> Flags:
>>     category=3Dlibrary
>>     severity=3Dcritical
>>     module=3DSafe
>> ---
>> Site configuration information for perl 5.18.0:
>>
>> Configured by ericsson at Fri Jul 12 19:17:48 CEST 2013.
>>
>> Summary of my perl5 (revision 5 version 18 subversion 0) configuration:
>>
>>   Platform:
>>     osname=3Dlinux, osvers=3D2.6.16.60-0.42.10-smp, archname=3Dx86_64-li=
nux-thread-multi
>>     uname=3D'linux sekix562 2.6.16.60-0.42.10-smp #1 smp tue apr 27 05:1=
1:27 utc 2010 x86_64 x86_64 x86_64 gnulinux '
>>     config_args=3D'-d -e -O -D cc=3Dgcc -D
>> prefix=3D/vobs/cc/CCA-perl01/perl5_Linux_x64__________sixtyfive_char_pat
>> h/prod -D usemultiplicity -U use5005threads -D usedl -D useshrplib -D
>> libperl=3Dlibcmacperl.so -U usemymalloc -D cf_by=3Dericsson -D
>> [email protected] -D
>> [email protected] -D uselargefiles -D usethreads
>> -D useithreads -D use64bitall -D ldcc=3DCC -D optimize=3D-O3 -D
>> locincpth=3D/vobs/cc/CCA-perl01/perl5_Linux_x64__________sixtyfive_char_
>> path/plib/include
>> /vobs/cc/CCA-perl01/perl5_Linux_x64__________sixtyfive_char_path/plib/
>> apache/include -D
>> loclibpth=3D/vobs/cc/CCA-perl01/perl5_Linux_x64__________sixtyfive_char_
>> path/plib/lib
>> /vobs/cc/CCA-perl01/perl5_Linux_x64__________sixtyfive_char_path/plib/
>> apache/lib -D lddlflags=3D-shared -lpthread
>> -Wl,-L/vobs/cc/CCA-perl01/perl5_Linux_x64__________sixtyfive_char_path
>> /prod/lib/5.18.0/x86_64-linux-thread-multi/CORE
>> -Wl,-rpath,/vobs/cc/CCA-perl01/perl5_Linux_x64__________sixtyfive_char
>> _path/prod/lib/5.18.0  /x86_64-linux-thread-multi/CORE
>> -Wl,-L/vobs/cc/CCA-perl01/perl5_Linux_x64__________sixtyfive_char_path
>> /plib/lib
>> -Wl,-rpath,/vobs/cc/CCA-perl01/perl5_Linux_x64__________sixtyfive_char
>> _path/plib/lib
>> -Wl,-L/vobs/cc/CCA-perl01/perl5_Linux_x64__________sixtyfive_char_path
>> /plib/apache/lib
>> -Wl,-rpath,/vobs/cc/CCA-perl01/perl5_Linux_x64__________sixtyfive_char
>> _path/plib/apache/lib -Wl,--enable-new-dtags -D ldflags=3D-lpthread
>> -Wl,-L/vobs/cc/CCA-perl01/perl5_Linux_x64__________sixtyfive_char_path
>> /prod/lib/5.18.0/x86_64-linux-thread-multi/CORE
>> -Wl,-rpath,/vobs/cc/CCA-perl01/perl5_Linux_x64__________sixtyfive_char
>> _path/prod/lib/5.18.0/x86_64-linux-thread-multi/CORE
>> -Wl,-L/vobs/cc/CCA-perl01/perl5_Linux_x64__________sixtyfive_char_path
>> /plib/lib
>> -Wl,-rpath,/vobs/cc/CCA-perl01/perl5_Linux_x64__________sixtyfive_char
>> _path/plib/lib
>> -Wl,-L/vobs/cc/CCA-perl01/perl5_Linux_x64__________sixtyfive_char_path
>> /plib/apache/lib
>> -Wl,-rpath,/vobs/cc/CCA-perl01/perl5_Linux_x64__________sixtyfive_char
>> _path/  plib/apache/lib -Wl,--enable-new-dtags -D ccdlflags=3D-Bdynamic
>> -Wl,-L/vobs/cc/CCA-perl01/perl5_Linux_x64__________sixtyfive_char_path/p=
rod/lib/5.18.0/x86_64-linux-thread-multi/CORE -Wl,-rpath,/vobs/cc/CCA-perl0=
1/perl5_Linux_x64__________sixtyfive_char_path/prod/lib/5.18.0/x86_64-linux=
-thread-multi/CORE -Wl,-L/vobs/cc/CCA-perl01/perl5_Linux_x64__________sixty=
five_char_path/plib/lib -Wl,-rpath,/vobs/cc/CCA-perl01/perl5_Linux_x64_____=
_____sixtyfive_char_path/plib/lib -Wl,-L/vobs/cc/CCA-perl01/perl5_Linux_x64=
__________sixtyfive_char_path/plib/apache/lib -Wl,-rpath,/vobs/cc/CCA-perl0=
1/perl5_Linux_x64__________sixtyfive_char_path/plib/apache/lib -D ldlibpthn=
ame=3DLD_LIBRARY_PATH -D cccdlflags=3D-fPIC -D dlsrc=3Ddl_dlopen.xs -D ccfl=
ags=3D-O2 -D_REENTRANT -D_GNU_SOURCE -DTHREADS_HAVE_PIDS -pthread -DPERL_IM=
PLICIT_CONTEXT -DPERL_USE_SAFE_PUTENV -m64 -pipe -D_LARGEFILE_SOURCE -D_FIL=
E_OFFSET_BITS=3D64 -fPIC -D so=3Dso -D libswanted=3Dnsl dl m crypt pthread =
c'
>>     hint=3Drecommended, useposix=3Dtrue, d_sigaction=3Ddefine
>>     useithreads=3Ddefine, usemultiplicity=3Ddefine
>>     useperlio=3Ddefine, d_sfio=3Dundef, uselargefiles=3Ddefine, usesocks=
=3Dundef
>>     use64bitint=3Ddefine, use64bitall=3Ddefine, uselongdouble=3Dundef
>>     usemymalloc=3Dn, bincompat5005=3Dundef
>>   Compiler:
>>     cc=3D'gcc', ccflags =3D'-D_REENTRANT -D_GNU_SOURCE -O2 -D_REENTRANT =
-D_GNU_SOURCE -DTHREADS_HAVE_PIDS -pthread -DPERL_IMPLICIT_CONTEXT -DPERL_U=
SE_SAFE_PUTENV -m64 -pipe -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=3D64 -fPI=
C -fno-strict-aliasing -fstack-protector -I/vobs/cc/CCA-perl01/perl5_Linux_=
x64__________sixtyfive_char_path/plib/include -I/vobs/cc/CCA-perl01/perl5_L=
inux_x64__________sixtyfive_char_path/plib/apache/include -D_LARGEFILE_SOUR=
CE -D_FILE_OFFSET_BITS=3D64',
>>     optimize=3D'-O3',
>>     cppflags=3D'-D_REENTRANT -D_GNU_SOURCE -O2 -D_REENTRANT -D_GNU_SOURC=
E -DTHREADS_HAVE_PIDS -pthread -DPERL_IMPLICIT_CONTEXT -DPERL_USE_SAFE_PUTE=
NV -m64 -pipe -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=3D64 -fPIC -fno-stric=
t-aliasing -fstack-protector -I/vobs/cc/CCA-perl01/perl5_Linux_x64_________=
_sixtyfive_char_path/plib/include -I/vobs/cc/CCA-perl01/perl5_Linux_x64____=
______sixtyfive_char_path/plib/apache/include'
>>     ccversion=3D'', gccversion=3D'4.1.2 20070115 (SUSE Linux)', gccosand=
vers=3D''
>>     intsize=3D4, longsize=3D8, ptrsize=3D8, doublesize=3D8, byteorder=3D=
12345678
>>     d_longlong=3Ddefine, longlongsize=3D8, d_longdbl=3Ddefine, longdblsi=
ze=3D16
>>     ivtype=3D'long', ivsize=3D8, nvtype=3D'double', nvsize=3D8, Off_t=3D=
'off_t', lseeksize=3D8
>>     alignbytes=3D8, prototype=3Ddefine
>>   Linker and Libraries:
>>     ld=3D'gcc', ldflags =3D'-lpthread -Wl,-L/vobs/cc/CCA-perl01/perl5_Li=
nux_x64__________sixtyfive_char_path/prod/lib/5.18.0/x86_64-linux-thread-mu=
lti/CORE -Wl,-rpath,/vobs/cc/CCA-perl01/perl5_Linux_x64__________sixtyfive_=
char_path/prod/lib/5.18.0/x86_64-linux-thread-multi/CORE -Wl,-L/vobs/cc/CCA=
-perl01/perl5_Linux_x64__________sixtyfive_char_path/plib/lib -Wl,-rpath,/v=
obs/cc/CCA-perl01/perl5_Linux_x64__________sixtyfive_char_path/plib/lib -Wl=
,-L/vobs/cc/CCA-perl01/perl5_Linux_x64__________sixtyfive_char_path/plib/ap=
ache/lib -Wl,-rpath,/vobs/cc/CCA-perl01/perl5_Linux_x64__________sixtyfive_=
char_path/plib/apache/lib -Wl,--enable-new-dtags -fstack-protector'
>>     libpth=3D/vobs/cc/CCA-perl01/perl5_Linux_x64__________sixtyfive_char=
_path/plib/lib /vobs/cc/CCA-perl01/perl5_Linux_x64__________sixtyfive_char_=
path/plib/apache/lib /lib/../lib64 /usr/lib/../lib64 /lib /usr/lib /usr/loc=
al/lib /lib64 /usr/lib64 /usr/local/lib64
>>     libs=3D-lnsl -ldl -lm -lcrypt -lpthread -lc
>>     perllibs=3D-lnsl -ldl -lm -lcrypt -lpthread -lc
>>     libc=3D/lib/libc-2.4.so, so=3Dso, useshrplib=3Dtrue, libperl=3Dlibcm=
acperl.so
>>     gnulibc_version=3D'2.4'
>>   Dynamic Linking:
>>     dlsrc=3Ddl_dlopen.xs, dlext=3Dso, d_dlsymun=3Dundef, ccdlflags=3D'-B=
dynamic -Wl,-L/vobs/cc/CCA-perl01/perl5_Linux_x64__________sixtyfive_char_p=
ath/prod/lib/5.18.0/x86_64-linux-thread-multi/CORE -Wl,-rpath,/vobs/cc/CCA-=
perl01/perl5_Linux_x64__________sixtyfive_char_path/prod/lib/5.18.0/x86_64-=
linux-thread-multi/CORE -Wl,-L/vobs/cc/CCA-perl01/perl5_Linux_x64__________=
sixtyfive_char_path/plib/lib -Wl,-rpath,/vobs/cc/CCA-perl01/perl5_Linux_x64=
__________sixtyfive_char_path/plib/lib -Wl,-L/vobs/cc/CCA-perl01/perl5_Linu=
x_x64__________sixtyfive_char_path/plib/apache/lib -Wl,-rpath,/vobs/cc/CCA-=
perl01/perl5_Linux_x64__________sixtyfive_char_path/plib/apache/lib'
>>     cccdlflags=3D'-fPIC', lddlflags=3D'-shared -lpthread -Wl,-L/vobs/cc/=
CCA-perl01/perl5_Linux_x64__________sixtyfive_char_path/prod/lib/5.18.0/x86=
_64-linux-thread-multi/CORE -Wl,-rpath,/vobs/cc/CCA-perl01/perl5_Linux_x64_=
_________sixtyfive_char_path/prod/lib/5.18.0/x86_64-linux-thread-multi/CORE=
 -Wl,-L/vobs/cc/CCA-perl01/perl5_Linux_x64__________sixtyfive_char_path/pli=
b/lib -Wl,-rpath,/vobs/cc/CCA-perl01/perl5_Linux_x64__________sixtyfive_cha=
r_path/plib/lib -Wl,-L/vobs/cc/CCA-perl01/perl5_Linux_x64__________sixtyfiv=
e_char_path/plib/apache/lib -Wl,-rpath,/vobs/cc/CCA-perl01/perl5_Linux_x64_=
_________sixtyfive_char_path/plib/apache/lib -Wl,--enable-new-dtags -fstack=
-protector'
>>
>> Locally applied patches:
>>
>>
>> ---
>> @INC for perl 5.18.0:
>>     /vobs/cc/CCA-perl01/perl5_Linux_x64__________sixtyfive_char_path/pro=
d/lib/site_perl/5.18.0/x86_64-linux-thread-multi
>>     /vobs/cc/CCA-perl01/perl5_Linux_x64__________sixtyfive_char_path/pro=
d/lib/site_perl/5.18.0
>>     /vobs/cc/CCA-perl01/perl5_Linux_x64__________sixtyfive_char_path/pro=
d/lib/5.18.0/x86_64-linux-thread-multi
>>     /vobs/cc/CCA-perl01/perl5_Linux_x64__________sixtyfive_char_path/pro=
d/lib/5.18.0
>>     .
>>
>> ---
>> Environment for perl 5.18.0:
>>     HOME=3D/home/eedmja
>>     LANG=3Den_US.UTF-8
>>     LANGUAGE (unset)
>>     LD_LIBRARY_PATH (unset)
>>     LOGDIR (unset)
>>     PATH=3D/tmp/_cc_CCA-perl01/perl5_Linux_x64__________sixtyfive_char_p=
ath/prod/bin:/tmp/_cc_CCA-perl01/perl5_Linux_x64__________sixtyfive_char_pa=
th/plib/bin:/bin:/usr/bin:/sbin:/usr/sbin:/opt/gnome/bin:/opt/kde3/bin:/usr=
/bin/X11:/home/eedmja/bin:/opt/rational/clearcase/bin
>>     PERL_BADLANG (unset)
>>     SHELL=3D/bin/tcsh