- Dillo-dev - lists.mailman3.com

Updated unveil patch

by a1ex＠dismail.de

Hi, Here is a new patch. I have done quite a bit more work on this and think it may be close to completion. The '~/Downloads' directory has been unveiled to match the behavior of Firefox and Chromium on OpenBSD, but Dillo's default of '/tmp' continues to work as well. I have also made sure everything works fine when there is no ~/.dillo directory, Dillo can create it, and also can access the system defaults in '/usr/local/etc/dillo'. dpid is also now unveiled, as well as all of the stock plugins except hello.dpi, I didn't see any point to that. Here are some other tests which I have run: - Regular browsing works fine - Connect to an FTP site and download a file, also view a text file and view an image - Open a text and image file from /tmp and ~/Downloads - Add/remove bookmarks - Download a file to /tmp and ~/Downloads - Save a page to /tmp and ~/Downloads - View source still works - Fonts and cursor icons are working correctly - data: uri works correctly with text and images So far everything seems to be fine. I will keep testing, but would really appreciate some help with reviewing this, there could be some edge-cases which I missed. Regards, Alex diff -upr a/dpi/bookmarks.c b/dpi/bookmarks.c --- a/dpi/bookmarks.c Sat Jun 29 16:33:08 2024 +++ b/dpi/bookmarks.c Sun Jul 28 16:21:05 2024 @@ -25,6 +25,7 @@ #include <stddef.h> #include <string.h> #include <unistd.h> +#include <err.h> #include <errno.h> #include <ctype.h> #include <sys/socket.h> @@ -1616,6 +1617,16 @@ int main(void) { socklen_t address_size; char *tok; Dsh *sh; + + /* Use unveil on OpenBSD */ + #ifdef __OpenBSD__ + char *dil_loc = dStrconcat(dGethomedir(), "/.dillo", NULL); + if (unveil(dil_loc, "rwc") == -1) { + err(1, "unveil failed"); + } + dFree(dil_loc); + unveil(NULL, NULL); + #endif /* Arrange the cleanup function for terminations via exit() */ atexit(cleanup); diff -upr a/dpi/cookies.c b/dpi/cookies.c --- a/dpi/cookies.c Sat Jun 29 16:33:08 2024 +++ b/dpi/cookies.c Sun Jul 28 16:21:05 2024 @@ -39,6 +39,7 @@ int main(void) #include <fcntl.h> #include <unistd.h> #include <errno.h> +#include <err.h> #include <stddef.h> #include <string.h> #include <stdlib.h> @@ -1643,6 +1644,16 @@ int main(void) { int sock_fd, code; char *buf; Dsh *sh; + + /* Use unveil on OpenBSD */ + #ifdef __OpenBSD__ + char *dil_loc = dStrconcat(dGethomedir(), "/.dillo", NULL); + if (unveil(dil_loc, "rwc") == -1) { + err(1, "unveil failed"); + } + dFree(dil_loc); + unveil(NULL, NULL); + #endif /* Arrange the cleanup function for terminations via exit() */ atexit(cleanup); diff -upr a/dpi/datauri.c b/dpi/datauri.c --- a/dpi/datauri.c Sat Jun 29 16:33:08 2024 +++ b/dpi/datauri.c Sun Jul 28 16:21:05 2024 @@ -12,6 +12,7 @@ */ #include <unistd.h> +#include <err.h> #include <stdio.h> #include <stdlib.h> #include <string.h> @@ -289,6 +290,19 @@ int main(void) unsigned char *data; int rc; size_t data_size = 0; + + /* Use unveil on OpenBSD */ + #ifdef __OpenBSD__ + if (unveil("/tmp", "rwc") == -1) { + err(1, "unveil failed"); + } + char *dil_loc = dStrconcat(dGethomedir(), "/.dillo", NULL); + if (unveil(dil_loc, "rwc") == -1) { + err(1, "unveil failed"); + } + dFree(dil_loc); + unveil(NULL, NULL); + #endif /* Initialize the SockHandler */ sh = a_Dpip_dsh_new(STDIN_FILENO, STDOUT_FILENO, 8*1024); diff -upr a/dpi/downloads.cc b/dpi/downloads.cc --- a/dpi/downloads.cc Sat Jun 29 16:33:08 2024 +++ b/dpi/downloads.cc Sun Jul 28 16:21:05 2024 @@ -18,6 +18,7 @@ #include <stdlib.h> #include <string.h> #include <unistd.h> +#include <err.h> #include <errno.h> #include <fcntl.h> #include <ctype.h> @@ -1104,6 +1105,38 @@ static void custLabelMeasure(const Fl_Label* o, int& W int main() { int ww = 420, wh = 85; + + /* Use unveil on OpenBSD */ + #ifdef __OpenBSD__ + if (unveil("/tmp", "rwc") == -1) { + err(1, "unveil failed"); + } + if (unveil("/etc/fonts", "r") == -1) { + err(1, "unveil failed"); + } + if (unveil("/usr/local/bin/wget", "x") == -1) { + err(1, "unveil failed"); + } + char *xauth_loc = dStrconcat(dGethomedir(), "/.Xauthority", NULL); + if (unveil(xauth_loc, "r") == -1) { + err(1, "unveil failed"); + } + dFree(xauth_loc); + if (unveil("/usr/local/share/fonts", "r") == -1) { + err(1, "unveil failed"); + } + char *dil_loc = dStrconcat(dGethomedir(), "/.dillo", NULL); + if (unveil(dil_loc, "rwc") == -1) { + err(1, "unveil failed"); + } + dFree(dil_loc); + char *dl_loc = dStrconcat(dGethomedir(), "/Downloads", NULL); + if (unveil(dl_loc, "rwc") == -1) { + err(1, "unveil failed"); + } + dFree(dl_loc); + unveil(NULL, NULL); + #endif Fl::lock(); diff -upr a/dpi/file.c b/dpi/file.c --- a/dpi/file.c Sat Jun 29 16:33:08 2024 +++ b/dpi/file.c Sun Jul 28 16:21:05 2024 @@ -22,6 +22,7 @@ #include <stdlib.h> #include <string.h> #include <unistd.h> +#include <err.h> #include <sys/select.h> #include <sys/socket.h> #include <sys/stat.h> @@ -1070,6 +1071,23 @@ int main(void) socklen_t sin_sz; int sock_fd, c_st, st = 1; + /* Use unveil on OpenBSD */ + #ifdef __OpenBSD__ + if (unveil("/tmp", "rw") == -1) { + err(1, "unveil failed"); + } + char *dl_loc = dStrconcat(dGethomedir(), "/Downloads", NULL); + if (unveil(dl_loc, "rw") == -1) { + err(1, "unveil failed"); + } + dFree(dl_loc); + char *dil_loc = dStrconcat(dGethomedir(), "/.dillo", NULL); + if (unveil(dil_loc, "rwc") == -1) { + err(1, "unveil failed"); + } + unveil(NULL, NULL); + #endif + /* Arrange the cleanup function for abnormal terminations */ if (signal (SIGINT, termination_handler) == SIG_IGN) diff -upr a/dpi/ftp.c b/dpi/ftp.c --- a/dpi/ftp.c Sat Jun 29 16:33:08 2024 +++ b/dpi/ftp.c Sun Jul 28 16:21:05 2024 @@ -29,6 +29,7 @@ */ #include <unistd.h> +#include <err.h> #include <sys/types.h> #include <sys/socket.h> #include <sys/un.h> @@ -281,6 +282,28 @@ int main(int argc, char **argv) char *dpip_tag = NULL, *cmd = NULL, *url = NULL, *url2 = NULL; int st, rc; char *p, *d_cmd; + + /* Use unveil on OpenBSD */ + #ifdef __OpenBSD__ + if (unveil("/tmp", "rwc") == -1) { + err(1, "unveil failed"); + } + if (unveil("/usr/local/bin/wget", "x") == -1) { + err(1, "unveil failed"); + } + char *dil_loc = dStrconcat(dGethomedir(), "/.dillo", NULL); + if (unveil(dil_loc, "rwc") == -1) { + err(1, "unveil failed"); + } + dFree(dil_loc); + char *dl_loc = dStrconcat(dGethomedir(), "/Downloads", NULL); + if (unveil(dl_loc, "rwc") == -1) { + err(1, "unveil failed"); + } + dFree(dl_loc); + unveil(NULL, NULL); + #endif + /* wget may need to write a temporary file... */ rc = chdir("/tmp"); diff -upr a/dpi/vsource.c b/dpi/vsource.c --- a/dpi/vsource.c Sat Jun 29 16:33:08 2024 +++ b/dpi/vsource.c Sun Jul 28 16:21:05 2024 @@ -13,6 +13,7 @@ */ #include <unistd.h> +#include <err.h> #include <sys/types.h> #include <stdio.h> #include <stdlib.h> @@ -172,6 +173,16 @@ int main(void) int data_size; char *dpip_tag, *cmd = NULL, *cmd2 = NULL, *url = NULL, *size_str = NULL; char *d_cmd; + + /* Use unveil on OpenBSD */ + #ifdef __OpenBSD__ + char *dil_loc = dStrconcat(dGethomedir(), "/.dillo", NULL); + if (unveil(dil_loc, "r") == -1) { + err(1, "unveil failed"); + } + dFree(dil_loc); + unveil(NULL, NULL); + #endif _MSG("starting...\n"); //sleep(20); diff -upr a/dpid/main.c b/dpid/main.c --- a/dpid/main.c Sat Jun 29 16:33:08 2024 +++ b/dpid/main.c Sun Jul 28 16:21:30 2024 @@ -19,6 +19,7 @@ #include <errno.h> /* for ckd_write */ #include <unistd.h> /* for ckd_write */ +#include <err.h> #include <stdlib.h> /* for exit */ #include <assert.h> /* for assert */ #include <sys/stat.h> /* for umask */ @@ -236,6 +237,21 @@ int main(void) services_list = NULL; //daemon(0,0); /* Use 0,1 for feedback */ /* TODO: call setsid() ?? */ + + /* Use unveil on OpenBSD */ + #ifdef __OpenBSD__ + if (unveil("/usr/local/lib/dillo", "rx") == -1) { + err(1, "unveil failed"); + } + if (unveil("/usr/local/etc/dillo", "r") == -1) { + err(1, "unveil failed"); + } + char *dil_loc = dStrconcat(dGethomedir(), "/.dillo", NULL); + if (unveil(dil_loc, "rwc") == -1) { + err(1, "unveil failed"); + } + unveil(NULL, NULL); + #endif /* Allow read and write access, but only for the user. * TODO: can this cause trouble with umount? */ diff -upr a/src/dillo.cc b/src/dillo.cc --- a/src/dillo.cc Sat Jun 29 16:33:08 2024 +++ b/src/dillo.cc Sun Jul 28 16:33:29 2024 @@ -23,6 +23,7 @@ #include <stdio.h> #include <unistd.h> +#include <err.h> #include <stdlib.h> #include <time.h> #include <sys/types.h> @@ -396,6 +397,47 @@ int main(int argc, char **argv) srand((uint_t)(time(0) ^ getpid())); + // unveil() + #ifdef __OpenBSD__ + if (unveil("/usr/local/share/fonts", "r") == -1) { + err(1, "unveil failed"); + } + if (unveil("/usr/local/etc/dillo", "r") == -1) { + err(1, "unveil failed"); + } + if (unveil("/tmp", "rwc") == -1) { + err(1, "unveil failed"); + } + if (unveil("/usr/local/bin/dpid", "x") == -1) { + err(1, "unveil failed"); + } + if (unveil("/etc/fonts", "r") == -1) { + err(1, "unveil failed"); + } + if (unveil("/etc/resolv.conf", "r") == -1) { + err(1, "unveil failed"); + } + if (unveil("/etc/ssl/cert.pem", "r") == -1) { + err(1, "unveil failed"); + } + char *dl_loc = dStrconcat(dGethomedir(), "/Downloads", NULL); + if (unveil(dl_loc, "rwc") == -1) { + err(1, "unveil failed"); + } + dFree(dl_loc); + char *dil_loc = dStrconcat(dGethomedir(), "/.dillo", NULL); + if (unveil(dil_loc, "rwc") == -1) { + err(1, "unveil failed"); + } + dFree(dil_loc); + char *xauth_loc = dStrconcat(dGethomedir(), "/.Xauthority", NULL); + if (unveil(xauth_loc, "r") == -1) { + err(1, "unveil failed"); + } + dFree(xauth_loc); + unveil(NULL, NULL); + #endif + // Some OSes exit dillo without this (not GNU/Linux). signal(SIGPIPE, SIG_IGN); // Establish our custom SIGCHLD handler

July 28, 2024

Re: Does :hover work in 3.1.1?

by Steinar Bang

>>>>> Rodrigo Arias <rodarima(a)gmail.com>: > You may want to check: > https://dillo-browser.github.io/dillo.org.html > And: > https://dillo-browser.github.io/release/3.1.0/ Right! I knew that actually, from the mastodon post that brought dillo back into my attention. But when looking for stuff I am lazy and I google rather than remembering, and google still throw up the old pages. I'll link to the updated dillo doc from the oldalbum README when I release the non-javascript version. That should help the teensiest bit, at least (also it's a place I can click to to get there). >> If :hover doesn't work I will have to do it a different way: maybe with >> a separate settings page containing a form...? > I recommend you just don't use a drop down, just an static navigation > menu which would work fine with CSS disabled. Yup, the simplest way would be to have just two links in the <nav> one for each locale/language. But that would be too much clutter, I think...? > You could also use a <select> input with a form but it looks more > complicated. Yes, it is. But it's the road I've started to travel. :-) (remains to see if I will travel it to the end or cut my losses and do something simpler...:-) ) I have some copy-pastable code. I did the authservice login and basic self-service pages non-javascript (authservice started as a forms based login plugin for nginx, using apache shiro), and I have stuff I can copy paste from there: https://github.com/steinarb/authservice I don't like JSP or JSF (feels complicated and cluttered) so I did a simple DIY templating with jersey and jsoup (I write HTML pages and read them into jersey resources with jsoup and replace elment content and fill forms). I was looking for sort of the same feel I had when using CGI.pm back in the day: the state is contained in the form data and used to populate the form in the returned HTML, and jsoup gave me that. The use of jersey is because JAX-RS gives a convenient API to tailor responses (HTTP headers and stuff).

July 27, 2024

Re: Does :hover work in 3.1.1?

by Rodrigo Arias

Hi, On Fri, Jul 26, 2024 at 07:09:05PM +0200, Steinar Bang wrote: >Does :hover work in 3.1.1? No, its not implemented, only ":link" and ":visited": https://github.com/dillo-browser/dillo/blob/v3.1.1/src/cssparser.cc#L1426-L… >I am trying to write a JavaScript-less dropdown to switch locale as >e.g. outlined here: > https://www.w3schools.com/howto/tryit.asp?filename=tryhow_js_responsive_nav… > >Short story: the dropdown is an ul with "display: none" and hovering >over a parent element (that is displayed) is supposed to switch to >"display: block". > >But nothing happens when I hover over the parent. > >Google found me this, dated August 19 2022, listing pseudo-classes as >Pending, but August 19 2022 is almost two years ago...? > https://dillo.org/css.html >(looks like that "Pending" may be from January 1 2015...?) You may want to check: https://dillo-browser.github.io/dillo.org.html And: https://dillo-browser.github.io/release/3.1.0/ >If :hover doesn't work I will have to do it a different way: maybe with >a separate settings page containing a form...? I recommend you just don't use a drop down, just an static navigation menu which would work fine with CSS disabled. You could also use a <select> input with a form but it looks more complicated. >Here is the HTML of the dropdown: > <li> > <div class="locale-dropdown"> > <a href="">Language</a> > <ul class="locale-dropdown-content"> > <li><a href="">English</a></li> > <li><a href="">norsk bokmål</a></li> > </ul> > </div> > </li> > >(the dropdown is nested in a <li> that is part of the <ul> that forms the <nav>) > >The CSS looks like this: > >.locale-dropdown-content { > display: none; > position: absolute; > background-color: #f9f9f9; > min-width: 160px; > box-shadow: 0px 8px 16px 0px rgba(0,0,0,0.2); > z-index: 1; >} > >.locale-dropdown:hover .locale-dropdown-content { > display: block; >} > >_______________________________________________ >Dillo-dev mailing list -- dillo-dev(a)mailman3.com >To unsubscribe send an email to dillo-dev-leave(a)mailman3.com

July 26, 2024

Does :hover work in 3.1.1?

by Steinar Bang

Does :hover work in 3.1.1? I am trying to write a JavaScript-less dropdown to switch locale as e.g. outlined here: https://www.w3schools.com/howto/tryit.asp?filename=tryhow_js_responsive_nav… Short story: the dropdown is an ul with "display: none" and hovering over a parent element (that is displayed) is supposed to switch to "display: block". But nothing happens when I hover over the parent. Google found me this, dated August 19 2022, listing pseudo-classes as Pending, but August 19 2022 is almost two years ago...? https://dillo.org/css.html (looks like that "Pending" may be from January 1 2015...?) If :hover doesn't work I will have to do it a different way: maybe with a separate settings page containing a form...? Here is the HTML of the dropdown: <li> <div class="locale-dropdown"> <a href="">Language</a> <ul class="locale-dropdown-content"> <li><a href="">English</a></li> <li><a href="">norsk bokmål</a></li> </ul> </div> </li> (the dropdown is nested in a <li> that is part of the <ul> that forms the <nav>) The CSS looks like this: .locale-dropdown-content { display: none; position: absolute; background-color: #f9f9f9; min-width: 160px; box-shadow: 0px 8px 16px 0px rgba(0,0,0,0.2); z-index: 1; } .locale-dropdown:hover .locale-dropdown-content { display: block; }

July 26, 2024

Re: Is CSS inline-block on <ul> supposed to work

by Steinar Bang

>>>>> Rodrigo Arias <rodarima(a)gmail.com>: >> nav.image-navbar ul li { >> float: left; > Replace this with "display: inline-block;" and should work. Thanks! Moving "display: inline-block;" from <ul> to <li> worked! The <li> elements were displayed horizontally in the navbar I removed "vertical-align: top" since it didn't have any effect that I could see. Here is the full CSS for the <nav> (so far): nav.image-navbar { background-color: lightgray; padding-bottom: 10px; } nav.image-navbar ul { list-style-type: none; margin: 0; padding: 0; } nav.image-navbar ul li { display: inline-block; } Thanks again! - Steinar

July 26, 2024

Re: Is CSS inline-block on <ul> supposed to work

by Rodrigo Arias

Hi, >nav.image-navbar ul li { > float: left; Replace this with "display: inline-block;" and should work. Rodrigo.

July 26, 2024

Is CSS inline-block on <ul> supposed to work

by Steinar Bang

dillo 3.1.1, debian 12.6 "bookworm", amd64 I am trying to create a <nav> "powered by" an <ul>: <nav class="image-navbar"> <ul> <li><a href="blah">item 1</a></li> <li><a href="bluh">item 2</a></li> </ul> </nav> But I am unable to make the <ul> render horizontally. Is "display: inline-bloc" supposed to work on dillo 3.1.1? Here's the CSS I've tried: nav.image-navbar { background-color: lightgray; padding-bottom: 10px; } nav.image-navbar ul { list-style-type: none; display: inline-block; vertical-align: top; margin: 0; padding: 0; } nav.image-navbar ul li { float: left; } Thanks! - Steinar

July 26, 2024

Unveil Dillo (new patch)

by a1ex＠dismail.de

Hi list, Here is an updated patch which now just does unveil (no pledge). I have tightened up the permissions so that Dillo only has the minimum of filesystem access, just enough so that everything still (hopefully) works. Testers and comments welcome. There probably aren't many OpenBSD users on this list, so I will eventually submit this to the OpenBSD ports list for further review. --- a/src/dillo.cc Thu Jul 25 21:21:14 2024 +++ b/src/dillo.cc Thu Jul 25 21:28:54 2024 @@ -23,6 +23,7 @@ #include <stdio.h> #include <unistd.h> +#include <err.h> #include <stdlib.h> #include <time.h> #include <sys/types.h> @@ -396,6 +397,41 @@ int main(int argc, char **argv) srand((uint_t)(time(0) ^ getpid())); + // unveil() + if (unveil("/usr/local/share/fonts", "r") == -1) { + err(1, "unveil failed"); + } + if (unveil("/tmp", "rw") == -1) { + err(1, "unveil failed"); + } + if (unveil("/usr/local/bin/dpid", "x") == -1) { + err(1, "unveil failed"); + } + if (unveil("/etc/fonts", "r") == -1) { + err(1, "unveil failed"); + } + if (unveil("/etc/resolv.conf", "r") == -1) { + err(1, "unveil failed"); + } + if (unveil("/etc/ssl/cert.pem", "r") == -1) { + err(1, "unveil failed"); + } + char *dl_loc = dStrconcat(dGethomedir(), "/Downloads", NULL); + if (unveil(dl_loc, "rw") == -1) { + err(1, "unveil failed"); + } + dFree(dl_loc); + char *dil_loc = dStrconcat(dGethomedir(), "/.dillo", NULL); + if (unveil(dil_loc, "rwc") == -1) { + err(1, "unveil failed"); + } + dFree(dil_loc); + char *xauth_loc = dStrconcat(dGethomedir(), "/.Xauthority", NULL); + if (unveil(xauth_loc, "r") == -1) { + err(1, "unveil failed"); + } + dFree(xauth_loc); + // Some OSes exit dillo without this (not GNU/Linux). signal(SIGPIPE, SIG_IGN); // Establish our custom SIGCHLD handler The only small issue I see so far is that the ~/Downloads directory is now hardcoded, and so the 'save_dir' preference in dillorc will need to match. Also note that in order to be able to use Rodrigo's multiple-actions patch with this, or my external link handler patch, you will also need to add: if (unveil("/bin/sh", "x") == -1) { err(1, "unveil failed"); } But that's not really advisable if you are looking for maximum security. EDIT: I just realized we may need to unveil dpid as well. Since it's a separate process, I don't think it inherits the unveil from dillo.cc. For example, when I use the 'Open file...' dialog, I am unable to see the restricted directories. However, when I load 'file:/home/user' in the browser, the contents still show up. Back to the drawing board! I will try to look at that in the next few days if possible. Regards, Alex

July 25, 2024

Re: Hardening Dillo with unveil and pledge

by Rodrigo Arias

Hi Alex, On Sun, Jul 21, 2024 at 07:31:29PM +0200, a1ex(a)dismail.de wrote: >Hi Rodrigo, > >On Sun, 21 Jul 2024 13:33:32 +0200 >Rodrigo Arias <rodarima(a)gmail.com> wrote: > >> I can see clear benefits on restricting the file system access, but >> do you have in mind which type of attack the pledge() configuration >> would you help mitigate? > >It might reduce the attack surface for exploits in things like image and >compression libraries. Or maybe there could be a bug in FLTK. Or in >Dillo itself. I'm not saying these things are very likely, but they >are possible. Since Dillo is a complicated program, we have to grant it >access to lot of syscalls, which limits how effective pledge can be. >But it still offers a level of protection which can be valuable in >various scenerios. Sorry, I think I didn't explained myself very clearly :-) With "which type of attack the pledge() configuration would you help mitigate?", I meant: if using your current configuration of "stdio rpath wpath cpath inet unix dns tty proc prot_exec" you have in mind an specific attack that we can mitigate, as this is giving Dillo access to a lot of syscalls which can be used to easily exploit any bugs. Also, I think it is very likely we have some exploitable bugs laying around in the parsers and other parts of the code and I don't think we will be able to use pledge effectively until we change the design to be able to split Dillo in more than one process. But maybe there is some exploitation that we can prevent right now with that combination that I'm not aware of. Otherwise I'm not sure if it is worth using pledge(2) as-is, until we change Dillo design so it is more effective. However, I think using unveil(2) is an effective way of restricting a lot of attack surface and doesn't require any design change. Maybe it would be better to start with unveil(2) alone and think later how to approach pledge(2). In Linux there is Landlock[1] (and also a project to implement an API like unveil on top of Landlock[2]), so it should be possible to at least implement support for OpenBSD and Linux to restrict access to the FS. [1]: https://landlock.io/ [2]: https://github.com/marty1885/landlock-unveil >Regarding something you said earlier: > >> I believe it would be nice to move the network facing code away from >> the parsers, so the parser code cannot use the network or read the >> file system. This requires separating them in different processes. > >This sounds like a very reasonable approach which would benefit all >Dillo users and not just the small minority who have access to pledge >and unveil. This is something I'm considering addressing already in RFC-002, as we will have to change the way Dillo exchanges data internally, we can move to a message passing design. While right now we will continue to use a single process, this design could potentially run over different processes, and then we could use pledge(2), seccomp(2) or other OS protection mechanisms for the untrusted code. I think it is important to remember that Dillo is a *multiplatform* browser, and it would be nice if security features are be available in all supported platforms. If you want to add support for unveil(2), I recommend you do that in the Dillo git repository with an #ifdef guard, so it can be enabled only if build for OpenBSD, and with some way to enable/disable it for testing. I can help you with this part if you are not familiar with autoconf. Then we can see how to add similar protection for other operating systems. Best, Rodrigo.

July 25, 2024

Re: Hardening Dillo with unveil and pledge

by a1ex＠dismail.de

Hi Rodrigo, On Sun, 21 Jul 2024 13:33:32 +0200 Rodrigo Arias <rodarima(a)gmail.com> wrote: > I can see clear benefits on restricting the file system access, but > do you have in mind which type of attack the pledge() configuration > would you help mitigate? It might reduce the attack surface for exploits in things like image and compression libraries. Or maybe there could be a bug in FLTK. Or in Dillo itself. I'm not saying these things are very likely, but they are possible. Since Dillo is a complicated program, we have to grant it access to lot of syscalls, which limits how effective pledge can be. But it still offers a level of protection which can be valuable in various scenerios. > I think allowing exec and inet is too permissive and would allow an > attacker to easily spawn a remote shell as soon as a RCE bug is > found. I agree about exec, but right now without inet Dillo fails to start. One drawback to this current implementation is that things like my external link handler patch, and your multiple-actions patch don't work anymore. I ran some tests and confirmed that it causes issues, even with exec pledged. Maybe it would be possible to work around that with an un-pledged process which does the call, which would have to be started by Dillo prior to the pledge call in main. I did some experiments with initializing dpid prior to the pledge call being made, so that it can run un-pledged. It seems possible, but may require other changes which seem to be above my current skill level. > I think is a good idea more OpenBSD people review this part, as I'm > not very familiar with pledge(2). > > However, I'm afraid having this patch only in OpenBSD may cause a > negative effect, as we may start receiving bug reports that are only > happening on OpenBSD with that patch and cannot be reproduced on > Linux or other systems without it. > > Maybe you can make a hardened Dillo port, so people can still test > the non-hardened port to determine if the problem comes from these > changes. I will have to think a bit on that, but maybe I'll start by forwarding this thread to some OpenBSD people and see what kind of response comes back. Really not sure how much interest there will be in this, as I suspect the amount of developers who use Dillo on OpenBSD is not huge. Hopefully I'm wrong. :) Regarding something you said earlier: > I believe it would be nice to move the network facing code away from > the parsers, so the parser code cannot use the network or read the > file system. This requires separating them in different processes. This sounds like a very reasonable approach which would benefit all Dillo users and not just the small minority who have access to pledge and unveil. -Alex

July 21, 2024