having fun looking inside btrfs-progs. we are finding truly historic concentrations of linux in this filesystem
15
Replies
3
Boosts
This comment is unavailable — it may have been deleted or is not visible to you.
This comment is unavailable — it may have been deleted or is not visible to you.
This comment is unavailable — it may have been deleted or is not visible to you.
This comment is unavailable — it may have been deleted or is not visible to you.
This comment is unavailable — it may have been deleted or is not visible to you.
This comment is unavailable — it may have been deleted or is not visible to you.
This comment is unavailable — it may have been deleted or is not visible to you.
This comment is unavailable — it may have been deleted or is not visible to you.
This comment is unavailable — it may have been deleted or is not visible to you.
This comment is unavailable — it may have been deleted or is not visible to you.
This comment is unavailable — it may have been deleted or is not visible to you.
This comment is unavailable — it may have been deleted or is not visible to you.
This comment is unavailable — it may have been deleted or is not visible to you.
This comment is unavailable — it may have been deleted or is not visible to you.
This comment is unavailable — it may have been deleted or is not visible to you.
there's a gnulib update this wget tag pulled in with a fix to a problem reported by Pádraig Brady, the maintainer of coreutils who also works at facebook https://debbugs.gnu.org/cgi/bugreport.cgi?bug=73418#35
I can still repro.
I'm on BTRFS though I don't think that matters for this test.
ah! btrfs! right back where we started all this!
it brings me immense relief to see that paul eggert (the ucla prof who writes snarky messages about POSIX and its lack of interest in user security in the autoconf docs, and who also publicly acknowledges the status of palestine as an independent nation), still seems to be a good egg. i like him very much
but this would explain why when i reported the backdoor in linux crypto to the coreutils mailing list in march (because coreutils has a configure flag to use linux crypto impls) that our buddy pádraig wasn't terribly interested
and just what is NTLM? the new thing injected into wget? https://davenport.sourceforge.net/ntlm.html
NTLM is a suite of authentication and session security protocols used in various Microsoft network protocol implementations and supported by the NTLM Security Support Provider ("NTLMSSP").
literally nothing could possibly be more backdoored than the microsoft security protocol
Key Weakening
The key used for signing and sealing is "weakened" in accordance with cryptographic export restrictions.
awesome. yes
Recent improvements in computer hardware and software algorithms have made these protocols vulnerable to widely published attacks for obtaining user passwords.
love it. awesome. fantastic
looking up the messages i got from running:
; TSS2_LOG='all+TRACE,marshal+TRACE,tcti+TRACE' wget \
--debug --verbose \
--report-speed=bits --no-config \
'https://github.com/kdave/btrfs-progs/archive/devel.tar.gz' \
-O devel.tar.gz
led me immediately to this issue: https://github.com/tpm2-software/tpm2-pkcs11/issues/655#issuecomment-953833625 where as usual they just explain directly how to use this for evil:
No it's made to that TPM. So if you place it on another system, the TPM will still "work". But measured state could be different so you'd lock yourself out of certain keys potentially. This is analogous to you stole my smartcard. For transient objects, you'd need to steal my TPM and the key blobs from wherever they were stored. Obviously, you would still need to satisfy whatever authorizations needed to access anything on the TPM.
i love this. "This is analogous to you stole my smartcard. For transient objects, you'd need to steal my TPM and the key blobs". fantastic
one thing i don't get is why they didn't connect to the right service. i totally thought systemd would be up for that sort of shit?
of course they are https://github.com/wmcelderry/systemd_with_tpm2/issues/2
Some would say "there's no such thing as perfect security, so that's no surprise!"
Others would say that "this isn't anywhere near and leaves the door WIDE open."
I'd say it all depends on your use!
This issue is to collect together the debate about the pros and cons.
surprisingly, arch linux systemd does seem to have tpm2 support enabled https://gitlab.archlinux.org/archlinux/packaging/packages/systemd/-/blob/main/PKGBUILD?ref_type=heads and loads more fun:
# Upstream versioning is incompatible with pacman's version comparisons, one
# way or another. We use proper version for pacman here (no dash for rc
# release!), and change in source array below.
and then they pull an extremely fast one and just openly admit they're not fucking pulling from git whatsoever!!! surprise!!!!!
# Some heuristics to detect that we are building on OBS, with no network access. Skip
# git verification, and use the OBS-provided tarball instead. The sources will be
# unpacked by OBS in $package-$version/
if [ -f /.build/build.dist ] && [ -d /usr/src/packages/SOURCES ] && [ -d /usr/src/packages/BUILD ] && [ -d /usr/src/packages/OTHER ]; then
literally a cornucopia of backdoors unfolding right before my very eyes
then they just start relying on shell variables defined literally fucking nowhere, iterating through for _c in "${_backports[@]}"; do. they've got a whole fucking streamlined build process to make it simple to ship your backdoors anywhere
always wondered why SELinux was disabled in my systemd. now i know
what the hell is the point of setting the default locale to C.UTF-8. i know POSIX refuses to support any non-US english locale or some fucking awful bullshit like that (the sed docs have a diatribe about it). i bet some stuff doesn't encode UTF-8 correctly or something
lmao they make sure to put the siphash license first even though siphash is djbslop and doesn't even do what it says it does and systemd's single hash table isn't exposed to the internet and isn't latency-dependent in the first place
of course poettering will immediately jump to use the slow and broken djb hash function but refuses to accept a libc protocol that ensures he can't dlopen() a backdoored xz-utils like he did in 2023
oh that's so cute! pacman lets you declare depends totally separately from the actual dependencies. so there's just no relationship between declared and actual deps at all
lmfao look at that optdepends line:
'tpm2-tss: unlocking LUKS2 volumes with TPM2'
despite obviously including tpm2-tss in makedepends
ooo iocost is cute
The qos and model values are calculated based on benchmarks collected on the iocost-benchmark[1] project and turned into a set of solutions that go from most to least isolated. Isolation allows the system to remain responsive in face of high I/O load.
so they have a specially-calibrated timing attack made just for you: the user
