Re: FW: [RFC] blacklisted variables

[Richard Purdie <richard.purdie@linuxfoundation.org>]

On Fri, 2014-09-19 at 11:56 +0100, Damian, Alexandru wrote:
> ​Difficult to say; it's in the interest of those who would run toaster
> services open to the public.​
>
> If we would be the ones to host the Toaster service, the effort would
> have to be supported by probably the whole Yocto team; we need to
> look ​into vulnerabilities that can be triggered by setting variables,
> e.g. remote code executions - I guess that Richard and Paul should
> take a look at how variables can be exploited in Bitbake, and then we
> need to audit the core layers too, since basically each recipe can do
> whatever it chooses with variables.

The nature of the way the metadata works is such that if you allow the
user any variable or metadata access, its like giving them a shell
account as the build user. 

I don't see any way to change that and any of these audits are just
going to hide the problem, not solve it since fundamentally, bitbake is
a code execution engine. A simple example is setting a variable to 
${@" ".join(open("/etc/shadow", "r").readlines())}. You could call into
your own function which opens up a socket and starts an ssh server quite
easily.

The structure of any public offering therefore needs to be structured
such that there are accounts and those accounts are controlled in some
way. The actual build slaves need to be monitored and probably
firewalled with the slave user accounts suitably locked down.

Cheers,

Richard