Date: Wed, 24 Jan 2024 08:42:35 +0100 From: Hanno Böck <hanno@...eck.de> To: oss-security@...ts.openwall.com Subject: Re: darkhttpd: timing attack and local leak of HTTP basic auth credentials On Tue, 23 Jan 2024 11:39:19 +0100 Matthias Gerstner <mgerstner@...e.de> wrote: > The only way to configure the HTTP basic auth string in darkhttpd is > to pass it via the `--auth` command line parameter. On Linux all local > users can view the parameters of other programs running on the system. I'd like to comment on that. While "on Linux" *in most distros default settings* this is true, the Linux Kernel actually has a mitigation for this since quite a while. This is a feature that I believe was initially introduced by grsecurity, but was lated ported as an option to the mainline kernel. /proc can be mounted with the hidepid option (ideally set to hidepid=2) , with it enabled users cannot see processes of other users. Unfortunately, this has not been widely applied by linux distributions. There is a website by redhat that explicitly discourages its use . it hints to some problems that could show up because daemons could not access information about the clients accessing them. But that sounds very nonspecific and they don't reference any examples, so it's hard to tell what exactly these problems would be. Furthermore, they point out that the same information can be queried via systemd without any access control. That sounds more like a weakness in systemd that should be fixed than an issue with hidepid. I think it would be desirable that Linux distributions start using hidepid and mitigate the whole class of bugs like the one mentioned above.  https://www.kernel.org/doc/html/latest/filesystems/proc.html  https://access.redhat.com/solutions/6704531 -- Hanno Böck https://hboeck.de/
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.