From mboxrd@z Thu Jan 1 00:00:00 1970 Path: news.gmane.io!.POSTED.blaine.gmane.org!not-for-mail From: Jim Porter Newsgroups: gmane.emacs.bugs Subject: bug#51327: 28.0.60; emacsclient warns about XDG_RUNTIME_DIR when starting daemon on demand Date: Fri, 5 Nov 2021 11:38:48 -0700 Message-ID: References: <238ece9e-df13-a604-ba3a-36b346857423@gmail.com> Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit Injection-Info: ciao.gmane.io; posting-host="blaine.gmane.org:116.202.254.214"; logging-data="10695"; mail-complaints-to="usenet@ciao.gmane.io" Cc: 51327@debbugs.gnu.org, Paul Eggert To: Ulrich Mueller Original-X-From: bug-gnu-emacs-bounces+geb-bug-gnu-emacs=m.gmane-mx.org@gnu.org Fri Nov 05 19:39:48 2021 Return-path: Envelope-to: geb-bug-gnu-emacs@m.gmane-mx.org Original-Received: from lists.gnu.org ([209.51.188.17]) by ciao.gmane.io with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1mj47v-0002ef-Uu for geb-bug-gnu-emacs@m.gmane-mx.org; Fri, 05 Nov 2021 19:39:47 +0100 Original-Received: from localhost ([::1]:59028 helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1mj47u-0003F9-Eu for geb-bug-gnu-emacs@m.gmane-mx.org; Fri, 05 Nov 2021 14:39:46 -0400 Original-Received: from eggs.gnu.org ([2001:470:142:3::10]:37904) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1mj47D-0002qh-5M for bug-gnu-emacs@gnu.org; Fri, 05 Nov 2021 14:39:03 -0400 Original-Received: from debbugs.gnu.org ([209.51.188.43]:35667) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1mj47C-0003DC-2x for bug-gnu-emacs@gnu.org; Fri, 05 Nov 2021 14:39:02 -0400 Original-Received: from Debian-debbugs by debbugs.gnu.org with local (Exim 4.84_2) (envelope-from ) id 1mj47B-0008F0-JC for bug-gnu-emacs@gnu.org; Fri, 05 Nov 2021 14:39:01 -0400 X-Loop: help-debbugs@gnu.org Resent-From: Jim Porter Original-Sender: "Debbugs-submit" Resent-CC: bug-gnu-emacs@gnu.org Resent-Date: Fri, 05 Nov 2021 18:39:01 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: followup 51327 X-GNU-PR-Package: emacs X-GNU-PR-Keywords: security Original-Received: via spool by 51327-submit@debbugs.gnu.org id=B51327.163613753631666 (code B ref 51327); Fri, 05 Nov 2021 18:39:01 +0000 Original-Received: (at 51327) by debbugs.gnu.org; 5 Nov 2021 18:38:56 +0000 Original-Received: from localhost ([127.0.0.1]:47213 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1mj476-0008Eg-Hq for submit@debbugs.gnu.org; Fri, 05 Nov 2021 14:38:56 -0400 Original-Received: from mail-pj1-f45.google.com ([209.85.216.45]:40553) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1mj474-0008ES-Jq for 51327@debbugs.gnu.org; Fri, 05 Nov 2021 14:38:54 -0400 Original-Received: by mail-pj1-f45.google.com with SMTP id n36-20020a17090a5aa700b0019fa884ab85so3934295pji.5 for <51327@debbugs.gnu.org>; Fri, 05 Nov 2021 11:38:54 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=subject:to:cc:references:from:message-id:date:mime-version :in-reply-to:content-language:content-transfer-encoding; bh=MiGhWH2j2cw0qmwxsbOuzZgpDIVPmATTk7VWONWWAl8=; b=dWH8QyARvmI1e3A9KnClEt85wfvsoRQRHojFr8Z28CQpwPtWY7va2e/+pU5J22IoHp hPPmx4Iev4To1UdsB5wyFySeWsQiH0+jofVVU8KIVe/oMGOapJEwPllPE4e7GSJ+FiLQ BJjXTIJX6/Oa7x4U0Na4eAwBFPmIcMZaZJogzuX9RwHkukWX5m5YJZ2UYN2R2oMlYWgT nL4LjSqOaaCo+Uz2WpEkkcmXSSOoJ7Adf0oUP6Wa5L0aV79jvBkdxhTdbN4pGXe3k+gY 4CKx2/bx5X+Aln+NEm1vkT3PKAhuAQ7jCiD+yC+/ndIEzW1DDjo8eivSiQ4zbkLt9kcN NYiw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:subject:to:cc:references:from:message-id:date :mime-version:in-reply-to:content-language:content-transfer-encoding; bh=MiGhWH2j2cw0qmwxsbOuzZgpDIVPmATTk7VWONWWAl8=; b=WiDD2ONKW+vimcRCQpRWYd7Nud/RQGkOdsgzcetIAomM7HUt3ouCnIuzKJKNUVbnNY LD/eSJVOAxDCUYDXj8CM23nJxWj1kvWI4tRHaOXpgJVWTSjBrR2EnA1Wtn8rLdcrUr3w zJoaSpIfF1UC7keBnb9sPBUC5XzVa/ZDvzScXdjzoHZEKDjSo7+1J9GAOKwLXIZCvkuL wEoqqIbJamiFlJm0TlUlrRVSLFap8VSPq845ccjxXxEyXFkVJ2ihqsX/3ekSw3+dxmDO oh2n5XfQJ/VdrGrHtdYERTooLzzq0pigH1LUa2EtBnRaOkqhix7QiddpwWFFodd0VKuM lX/w== X-Gm-Message-State: AOAM533/RR1Z6dRPJCZ0VOCaOwFv82ZVvcAQLXWbXm/Bjt4tY3ZcAnWT CA62bAnaZ37hpfGmcA8w+jM= X-Google-Smtp-Source: ABdhPJxSJwPrWaUmRcOh1IHisZNTmnoG/d8FsQ9RVjOkGX0bUh81GWnUfkOMI31KRwkm9ahl1ctdUw== X-Received: by 2002:a17:90a:4586:: with SMTP id v6mr32394936pjg.43.1636137528658; Fri, 05 Nov 2021 11:38:48 -0700 (PDT) Original-Received: from [192.168.1.2] (cpe-76-168-148-233.socal.res.rr.com. [76.168.148.233]) by smtp.googlemail.com with ESMTPSA id e6sm6444806pgf.59.2021.11.05.11.38.47 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Fri, 05 Nov 2021 11:38:48 -0700 (PDT) In-Reply-To: Content-Language: en-US X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list X-BeenThere: bug-gnu-emacs@gnu.org List-Id: "Bug reports for GNU Emacs, the Swiss army knife of text editors" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: bug-gnu-emacs-bounces+geb-bug-gnu-emacs=m.gmane-mx.org@gnu.org Original-Sender: "bug-gnu-emacs" Xref: news.gmane.io gmane.emacs.bugs:219017 Archived-At: (Cc'ing Paul Eggert, who can probably answer more confidently than me.) On 11/5/2021 11:05 AM, Ulrich Mueller wrote: > Can someone please explain to me how an exploit on the _client_ side > would look like? > > When starting the server, I can believe that there may be some surface > for a symlink attack. But once the daemon is running? What is the > security issue for the client checking TMPDIR? I'm not an expert on this kind of attack, but my understanding is that it could go something like this: 1. Attacker runs `evil-daemon' which puts its socket in /tmp/evil 2. Attacker runs `ln -s /tmp/evil /tmp/emacs1000/server' 3. User runs `emacsclient --alternate-editor=""' 4. emacsclient doesn't see a socket in XDG_RUNTIME_DIR, checks TMPDIR 5. emacsclient connects to evil-daemon The evil-daemon probably can't get access to the user's files, but might be able to trick a user into entering some secret. I'll let others chime in too though, since like I said, I'm not an expert. If I'm wrong and this isn't an a problem, then I agree that all we need to do here is silence the warning.