Bugs Ex Ante - Kristaps Dzonsons
Channel: EuroBSDcon
Date: 2019-10-13

Abstract:

Application sandboxes allow developers to take an unusual stance: not that our systems will be bug-free, and that bugs should be considered the corner-case; but that in fact there will be bugs, bugs as the rule, bugs that will be exploited in the messiest, ugliest way.(I won’t mention current events. But we’ll know what they are…)For this talk, I propose speaking about the design of a CGI framework that assumes exactly that: that its network-touching components will be exploited.After all, CGI frameworks have a celestially vast attack surface: URL query strings; cookies and HTTP headers; and beneath and beyond it all, form parsing. Combine these attack vectors with validation–at best validation of simple types, and then more terrifyingly (and normally) via external libraries such as libpng.In reviewing CGI frameworks in C for some recent work, I noticed less a lack of security focus than a parade committee for exploits. Even given my own small demands for CGI security, I was led to asked myself: can I do better than this?The topic would necessarily focus on available sandbox techniques (e.g., systrace, Capsicum) and their practical pros and cons (portability, ease of implementation, documentation, etc.). After all, if we make mistakes in deploying our sandbox, it’s just more ticker-tape for the parade.The CGI framework in question, kcgi, is one I use for my own small purposes. Obviously it’s ISC-licensed, well-documented C code, and will be mentioned as little as possible beyond as an exemplar of how easy (or hard!) it can be to write portable sandboxes. In short, this isn’t about kcgi, but about systrace, Capsicum, Darwin’s sandbox, and so on.

Speaker biography:

Most of my open-source work focusses on UNIX documentation, e.g., the mandoc suite (now captained by schwarze@) and its constellation of related tools, such as pod2mdoc, docbook2mdoc, etc. Earlier work focussed more on security, from the experimental mult kernel container on OpenBSD and NetBSD to sysjail. In general, I dislike computers and enjoy the sea.