Avoiding arbitrary code execution with macroexpansion

Avoiding arbitrary code execution with macroexpansion

[Wilfred Hughes]

Hi emacs-devel

Today I realised that macroexpand-all isn't safe to call on arbitrary elisp:

(macroexpand-all '(eval-when-compile (debug)))

Using a macro that calls eval, such as eval-when-compile,
eval-and-compile, c-lang-defconst-eval-immediately (undoubtedly others
too), means anything can happen at macroexpansion time.

Unfortunately, some emacs packages assume this is a safe thing to do.
I used to think so, because macroexpand-all only executes macros that
are loaded (and therefore trusted) in the current Emacs instance.
Macros that eval code break this.

Even elisp-mode.el assumes this:

(let ((fooo (eval-when-compile (progn (debug)))))
  foo ;; <- put point here and M-x completion-at-point
  )

This means that I can get arbitrary code execution by you opening and
calling code completion a maliciously crafted elisp file!

Is this a security bug in Emacs?

In any case, is there a safe way to do macroexpansion? The best I can
think of is this:

(let ((macro-whitelist '(when pcase))
      all-macros
      safe-env)
  (mapatoms
   (lambda (sym)
     (when (macrop sym)
       (push sym all-macros))))
  (mapc
   (lambda (sym)
     (unless (memq sym macro-whitelist)
       (push (cons sym (symbol-function 'ignore))
             safe-env)))
   all-macros)

  (macroexpand-all
   arbitrary-form-here
   safe-env))

Thanks
Wilfred

Re: Avoiding arbitrary code execution with macroexpansion

[Paul Eggert]

Wilfred Hughes wrote:
> This means that I can get arbitrary code execution by you opening and
> calling code completion a maliciously crafted elisp file!
> 
> Is this a security bug in Emacs?

Sounds like it. I suggest constructing a complete, self-contained and hopefully 
easy way to reproduce the problem with emacs -Q, and sending it in a bug report 
to bug-gnu-emacs@gnu.org. Thanks.

Re: Avoiding arbitrary code execution with macroexpansion

[Richard Stallman]

[[[ To any NSA and FBI agents reading my email: please consider    ]]]
[[[ whether defending the US Constitution against all enemies,     ]]]
[[[ foreign or domestic, requires you to follow Snowden's example. ]]]

  > Using a macro that calls eval, such as eval-when-compile,
  > eval-and-compile, c-lang-defconst-eval-immediately (undoubtedly others
  > too), means anything can happen at macroexpansion time.

Can we make macroexpand detect these cases and give an error?
It would have to do a codewalk on the macro definition,
but that is doable.

Perhaps doing an flet of eval and apply would work.


-- 
Dr Richard Stallman
President, Free Software Foundation (https://gnu.org, https://fsf.org)
Internet Hall-of-Famer (https://internethalloffame.org)

Re: Avoiding arbitrary code execution with macroexpansion

[Wilfred Hughes]

> Sounds like it. I suggest constructing a complete, self-contained and hopefully easy way to reproduce
> the problem with emacs -Q, and sending it in a bug report to bug-gnu-emacs@gnu.org. Thanks.

Done, #32495.

> Perhaps doing an flet of eval and apply would work.

I tried that, but it would require using flet with every function that
can evaluate code directly (i.e. doesn't itself call eval). I'm not
sure of the full list. I tried this:

(cl-letf (((symbol-function 'eval) #'ignore)
          ((symbol-function 'eval-region) #'ignore)
          ((symbol-function 'eval-buffer) #'ignore)
          ((symbol-function 'backtrace-eval) #'ignore))
  (macroexpand-all some-arbitrary-form-here))

but I know this is missing a few functions, such as load and load-file.

On 20 August 2018 at 04:04, Richard Stallman <rms@gnu.org> wrote:
> [[[ To any NSA and FBI agents reading my email: please consider    ]]]
> [[[ whether defending the US Constitution against all enemies,     ]]]
> [[[ foreign or domestic, requires you to follow Snowden's example. ]]]
>
>   > Using a macro that calls eval, such as eval-when-compile,
>   > eval-and-compile, c-lang-defconst-eval-immediately (undoubtedly others
>   > too), means anything can happen at macroexpansion time.
>
> Can we make macroexpand detect these cases and give an error?
> It would have to do a codewalk on the macro definition,
> but that is doable.
>
> Perhaps doing an flet of eval and apply would work.
>
>
> --
> Dr Richard Stallman
> President, Free Software Foundation (https://gnu.org, https://fsf.org)
> Internet Hall-of-Famer (https://internethalloffame.org)
>
>

Re: Avoiding arbitrary code execution with macroexpansion

[Richard Stallman]

[[[ To any NSA and FBI agents reading my email: please consider    ]]]
[[[ whether defending the US Constitution against all enemies,     ]]]
[[[ foreign or domestic, requires you to follow Snowden's example. ]]]

Perhaps we need a global variable to make it an error to call
any built-in functions that do evaluation.

-- 
Dr Richard Stallman
President, Free Software Foundation (https://gnu.org, https://fsf.org)
Internet Hall-of-Famer (https://internethalloffame.org)