GNU bug report logs - #4291
23.1; doc-view-mode temporary directory vulnerable to denial of service

Previous Next

To add a comment to this bug, you must first unarchive it, by sending
a message to control AT debbugs.gnu.org, with unarchive 4291 in the body.
You can then email your comments to 4291 AT debbugs.gnu.org in the normal way.

Toggle the display of automated, internal messages from the tracker.

Message #5 received at submit <at> emacsbugs.donarmstrong.com (full text, mbox):

From: David Bremner <bremner <at> unb.ca>
To: bug-gnu-emacs <at> gnu.org
Subject: 23.1;
	doc-view-mode temporary directory vulnerable to denial of service
Date: Sat, 29 Aug 2009 21:02:07 -0300

By default doc-view-mode makes a directory /tmp/docview$uid .  Since
this is easily predictable, a malicious person could cause docview to
fail simply by creating a directory with the same name. 

In GNU Emacs 23.1.1 (i486-pc-linux-gnu, X toolkit, Xaw3d scroll bars)
 of 2009-08-03 on raven, modified by Debian
Windowing system distributor `The X.Org Foundation', version 11.0.10603000
configured using `configure  '--build=i486-linux-gnu' '--host=i486-linux-gnu' '--prefix=/usr' '--sharedstatedir=/var/lib' '--libexecdir=/usr/lib' '--localstatedir=/var/lib' '--infodir=/usr/share/info' '--mandir=/usr/share/man' '--with-pop=yes' '--enable-locallisppath=/etc/emacs23:/etc/emacs:/usr/local/share/emacs/23.1/site-lisp:/usr/local/share/emacs/site-lisp:/usr/share/emacs/23.1/site-lisp:/usr/share/emacs/site-lisp:/usr/share/emacs/23.1/leim' '--with-x=yes' '--with-x-toolkit=athena' '--with-toolkit-scroll-bars' 'build_alias=i486-linux-gnu' 'host_alias=i486-linux-gnu' 'CFLAGS=-DDEBIAN -g -O2' 'LDFLAGS=-g' 'CPPFLAGS=''

Important settings:
  value of $LC_ALL: nil
  value of $LC_COLLATE: nil
  value of $LC_CTYPE: nil
  value of $LC_MESSAGES: nil
  value of $LC_MONETARY: nil
  value of $LC_NUMERIC: nil
  value of $LC_TIME: nil
  value of $LANG: en_CA.UTF-8
  value of $XMODIFIERS: nil
  locale-coding-system: utf-8-unix
  default-enable-multibyte-characters: t

Major mode: Fundamental

Minor modes in effect:
  diff-auto-refine-mode: t
  tool-bar-mode: t
  mouse-wheel-mode: t
  menu-bar-mode: t
  file-name-shadow-mode: t
  global-font-lock-mode: t
  font-lock-mode: t
  blink-cursor-mode: t
  global-auto-composition-mode: t
  auto-encryption-mode: t
  auto-compression-mode: t
  line-number-mode: t
  transient-mark-mode: t

Recent input:
M-x C-g C-x C-f t e a SPC c s SPC 2 SPC SPC w i SPC 
c SPC SPC SPC SPC <return> M-x r e p SPC o SPC SPC 
r SPC SPC SPC <return>

Recent messages:
Loading /home/bremner/.emacs-custom.el (source)...
Loading epa-mail...done
Loading /home/bremner/.emacs-custom.el (source)...done
Loading /usr/share/emacs/site-lisp/haskell-mode/haskell-site-file.el (source)...done
For information about GNU Emacs and the GNU system, type C-h C-a.
Quit
Making completion list... [2 times]
File mode specification error: (file-error "Doing chmod" "operation not permitted" "/tmp/docview1000")
Loading vc-git...done
Making completion list... [3 times]

Message #8 received at 4291 <at> emacsbugs.donarmstrong.com (full text, mbox):

From: Glenn Morris <rgm <at> gnu.org>
To: David Bremner <bremner-dated-1252800134.2fccb3 <at> pivot.cs.unb.ca>
Cc: 4291 <at> debbugs.gnu.org
Subject: Re: bug#4291: 23.1; doc-view-mode temporary directory vulnerable to denial of service
Date: Sun, 30 Aug 2009 21:42:51 -0400

David Bremner wrote:

> By default doc-view-mode makes a directory /tmp/docview$uid .  Since
> this is easily predictable, a malicious person could cause docview to
> fail simply by creating a directory with the same name. 

Couldn't they do the same thing by simply filling /tmp with junk, no
matter what filename is used?

(Emacs server also uses the same name every time AFAIK.)

Message #13 received at 4291 <at> emacsbugs.donarmstrong.com (full text, mbox):

From: Stefan Monnier <monnier <at> iro.umontreal.ca>
To: Glenn Morris <rgm <at> gnu.org>
Cc: 4291 <at> debbugs.gnu.org,
        David Bremner <bremner-dated-1252800134.2fccb3 <at> pivot.cs.unb.ca>
Subject: Re: bug#4291: 23.1; doc-view-mode temporary directory vulnerable to denial of service
Date: Mon, 31 Aug 2009 10:55:40 -0400

>> By default doc-view-mode makes a directory /tmp/docview$uid .  Since
>> this is easily predictable, a malicious person could cause docview to
>> fail simply by creating a directory with the same name.
> Couldn't they do the same thing by simply filling /tmp with junk, no
> matter what filename is used?

Yes, tho it's a bit different: your case can be avoided by appropriate
use of quotas on /tmp (yes, I realize this is highly unlikely), and your
case cannot be obtained without impacting the system as a whole
(i.e. it's less discrete).

> (Emacs server also uses the same name every time AFAIK.)

Yes, and Emacs server needs this name to be predictable (an "ls /tmp"
shows that other services, such as `orbit', are similarly vulnerable).

IIRC /tmp/docview$uid is predictable because doc-view tries to reuse
previouly-rendered pages.  I'm not convinced this is really a good
feature, but obviously the author thought it was important, so I'd
rather not drop it without a discussion.


        Stefan

Message #16 received at 4291 <at> emacsbugs.donarmstrong.com (full text, mbox):

From: Glenn Morris <rgm <at> gnu.org>
To: Stefan Monnier <monnier <at> iro.umontreal.ca>
Cc: 4291 <at> debbugs.gnu.org,
        David Bremner <bremner-dated-1252800134.2fccb3 <at> pivot.cs.unb.ca>,
        tassilo <at> member.fsf.org
Subject: Re: bug#4291: 23.1; doc-view-mode temporary directory vulnerable to denial of service
Date: Tue, 01 Sep 2009 17:15:54 -0400

Stefan Monnier wrote:

> Yes, tho it's a bit different: your case can be avoided by appropriate
> use of quotas on /tmp (yes, I realize this is highly unlikely), and your
> case cannot be obtained without impacting the system as a whole
> (i.e. it's less discrete).

The original scenario doesn't seem likely (or discreet). I suggest
just making docview give an explicit error if its cache dir: a) cannot
be created; or b) exists but cannot be read or written to.

Message #21 received at 4291 <at> debbugs.gnu.org (full text, mbox):

From: Lars Magne Ingebrigtsen <larsi <at> gnus.org>
To: Stefan Monnier <monnier <at> iro.umontreal.ca>
Cc: Glenn Morris <rgm <at> gnu.org>,
	David Bremner <bremner-dated-1252800134.2fccb3 <at> pivot.cs.unb.ca>,
	4291 <at> debbugs.gnu.org
Subject: Re: bug#4291: 23.1;
	doc-view-mode temporary directory vulnerable to denial of service
Date: Tue, 12 Jul 2011 23:18:43 +0200

Stefan Monnier <monnier <at> iro.umontreal.ca> writes:

> IIRC /tmp/docview$uid is predictable because doc-view tries to reuse
> previouly-rendered pages.  I'm not convinced this is really a good
> feature, but obviously the author thought it was important, so I'd
> rather not drop it without a discussion.

It could just stash the directory name in a variable, and use the normal
`make-temp-file' to create the directory, couldn't it?

-- 
(domestic pets only, the antidote for overdose, milk.)
  bloggy blog http://lars.ingebrigtsen.no/

Message #24 received at 4291 <at> debbugs.gnu.org (full text, mbox):

From: Glenn Morris <rgm <at> gnu.org>
To: Lars Magne Ingebrigtsen <larsi <at> gnus.org>
Cc: David Bremner <bremner-dated-1252800134.2fccb3 <at> pivot.cs.unb.ca>,
	Stefan Monnier <monnier <at> iro.umontreal.ca>, 4291 <at> debbugs.gnu.org
Subject: Re: bug#4291: 23.1;
	doc-view-mode temporary directory vulnerable to denial of service
Date: Tue, 12 Jul 2011 17:44:53 -0400

Lars Magne Ingebrigtsen wrote:

> Stefan Monnier <monnier <at> iro.umontreal.ca> writes:
>
>> IIRC /tmp/docview$uid is predictable because doc-view tries to reuse
>> previouly-rendered pages.  I'm not convinced this is really a good
>> feature, but obviously the author thought it was important, so I'd
>> rather not drop it without a discussion.
>
> It could just stash the directory name in a variable, and use the normal
> `make-temp-file' to create the directory, couldn't it?

I think the idea referred to above is to potentially re-use pages
converted by a previous Emacs instance (which seems like a bad feature
to me too).

Message #27 received at 4291 <at> debbugs.gnu.org (full text, mbox):

From: Lars Magne Ingebrigtsen <larsi <at> gnus.org>
To: Glenn Morris <rgm <at> gnu.org>
Cc: David Bremner <bremner-dated-1252800134.2fccb3 <at> pivot.cs.unb.ca>,
	Stefan Monnier <monnier <at> iro.umontreal.ca>, 4291 <at> debbugs.gnu.org
Subject: Re: bug#4291: 23.1;
	doc-view-mode temporary directory vulnerable to denial of service
Date: Tue, 12 Jul 2011 23:46:27 +0200

Glenn Morris <rgm <at> gnu.org> writes:

>>> IIRC /tmp/docview$uid is predictable because doc-view tries to reuse
>>> previouly-rendered pages.  I'm not convinced this is really a good
>>> feature, but obviously the author thought it was important, so I'd
>>> rather not drop it without a discussion.
>>
>> It could just stash the directory name in a variable, and use the normal
>> `make-temp-file' to create the directory, couldn't it?
>
> I think the idea referred to above is to potentially re-use pages
> converted by a previous Emacs instance (which seems like a bad feature
> to me too).

Oh, I see.  Hm.  Sounds like a bad idea to me, too.  :-)

-- 
(domestic pets only, the antidote for overdose, milk.)
  bloggy blog http://lars.ingebrigtsen.no/

Message #30 received at 4291 <at> debbugs.gnu.org (full text, mbox):

From: Chong Yidong <cyd <at> stupidchicken.com>
To: Lars Magne Ingebrigtsen <larsi <at> gnus.org>
Cc: Glenn Morris <rgm <at> gnu.org>,
	David Bremner <bremner-dated-1252800134.2fccb3 <at> pivot.cs.unb.ca>,
	Stefan Monnier <monnier <at> iro.umontreal.ca>, 4291 <at> debbugs.gnu.org
Subject: Re: bug#4291: 23.1;
	doc-view-mode temporary directory vulnerable to denial of service
Date: Tue, 12 Jul 2011 18:16:06 -0400

Lars Magne Ingebrigtsen <larsi <at> gnus.org> writes:

>>>> IIRC /tmp/docview$uid is predictable because doc-view tries to reuse
>>>> previouly-rendered pages.  I'm not convinced this is really a good
>>>> feature, but obviously the author thought it was important, so I'd
>>>> rather not drop it without a discussion.
>>>
>>> It could just stash the directory name in a variable, and use the normal
>>> `make-temp-file' to create the directory, couldn't it?
>>
>> I think the idea referred to above is to potentially re-use pages
>> converted by a previous Emacs instance (which seems like a bad feature
>> to me too).
>
> Oh, I see.  Hm.  Sounds like a bad idea to me, too.  :-)

I think the idea is that if you view the same pdf N times in Emacs, the
disk space won't increase monotonically (Emacs doesn't delete any of
those files AFAIK).

Message #33 received at 4291 <at> debbugs.gnu.org (full text, mbox):

From: Lars Magne Ingebrigtsen <larsi <at> gnus.org>
To: Chong Yidong <cyd <at> stupidchicken.com>
Cc: Glenn Morris <rgm <at> gnu.org>,
	David Bremner <bremner-dated-1252800134.2fccb3 <at> pivot.cs.unb.ca>,
	Stefan Monnier <monnier <at> iro.umontreal.ca>, 4291 <at> debbugs.gnu.org
Subject: Re: bug#4291: 23.1;
	doc-view-mode temporary directory vulnerable to denial of service
Date: Wed, 13 Jul 2011 00:18:12 +0200

Chong Yidong <cyd <at> stupidchicken.com> writes:

> I think the idea is that if you view the same pdf N times in Emacs, the
> disk space won't increase monotonically (Emacs doesn't delete any of
> those files AFAIK).

If they aren't deleted, then using a single directory per UID seems like
a good choice.  Perhaps the right fix here is to make the error message
better? 

-- 
(domestic pets only, the antidote for overdose, milk.)
  bloggy blog http://lars.ingebrigtsen.no/

Message #36 received at 4291 <at> debbugs.gnu.org (full text, mbox):

From: Lars Magne Ingebrigtsen <larsi <at> gnus.org>
To: Chong Yidong <cyd <at> stupidchicken.com>
Cc: Glenn Morris <rgm <at> gnu.org>,
	David Bremner <bremner-dated-1252800134.2fccb3 <at> pivot.cs.unb.ca>,
	Stefan Monnier <monnier <at> iro.umontreal.ca>, 4291 <at> debbugs.gnu.org
Subject: Re: bug#4291: 23.1;
	doc-view-mode temporary directory vulnerable to denial of service
Date: Sat, 16 Jul 2011 21:38:57 +0200

Lars Magne Ingebrigtsen <larsi <at> gnus.org> writes:

>> I think the idea is that if you view the same pdf N times in Emacs, the
>> disk space won't increase monotonically (Emacs doesn't delete any of
>> those files AFAIK).
>
> If they aren't deleted, then using a single directory per UID seems like
> a good choice.  Perhaps the right fix here is to make the error message
> better? 

I've now done this.

-- 
(domestic pets only, the antidote for overdose, milk.)
  bloggy blog http://lars.ingebrigtsen.no/

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.