having fun looking inside btrfs-progs. we are finding truly historic concentrations of linux in this filesystem
20
Replies
4
Boosts
like. first off. you would assume a userspace toolkit makes things safer right?
(a) because it does not directly work in kernel memory?
(b) you would assume that there would be some sort of interface to safely communicate?
(c) and the interface would be more stable than building against kernel headers directly?
so they already decided to take a simple concept (recursive quotas applied to subvolumes) and break it: https://github.com/kdave/btrfs-progs/commit/a26bfde051dd5cfdbade7dcaaeb0df770aead6d0
- The qgroup implementation is considered reasonably stable for daily use and has
- been enabled in various distributions.
+ The qgroup mode is considered not recommended for daily usage, unless there is
+ no planned new snapshot/subvolume creation and deletion.
that is reflected on their docsite, but it's written into the quota command, which has absolutely nothing to do with qgroups: https://btrfs.readthedocs.io/en/latest/btrfs-quota.html#stability-and-performance-implications
note the commit says:
Signed-off-by: Qu Wenruo <wqu@suse.com>
the github username is adam900710 and they have lots of free scripts to break btrfs in the kernel
their ci is funny https://github.com/kdave/btrfs-progs/blob/devel/ci/README.md
Running plain docker build may not work as some magic is needed to allow building either the branch from web repository, or from a local git branch provided as a tarball. Docker does not allow conditional image contents so this is pushed to the test build scripts.
so they cannot run git in docker. very curious
https://github.com/kdave/btrfs-progs/blob/devel/ci/images/ci-openSUSE-tumbleweed-x86_64/test-build
here they use wget to pull the URL
https://github.com/kdave/btrfs-progs/blob/devel/ci/ci-build-tumbleweed
cd /tmp
if [ -f "$fname" -a -s "$fname" ]; then
echo "Found local file $fname, not downloading"
else
echo "Missing or empty tar, downloading branch $branch from git"
rm -- "$fname"
wget "$url" -O "$fname"
fi
tar xf "$fname"
but here they just generate it by hand
BRANCH=${1:-HEAD}
if [ "$#" -ge 1 ]; then
shift
fi
HASH=$(git log -1 --format='%h %s' "$BRANCH")
echo "CI: Generate archive from $BRANCH ($HASH)"
git archive --prefix=btrfs-progs-devel/ -o devel.tar "$BRANCH"
echo "$BRANCH $HASH" > GITCOMMIT
tar uvf devel.tar GITCOMMIT
#rm GITCOMMIT
gzip --force --best devel.tar
the absolute fools. they ran tar xf
everyone knows you can't tar xf on a .tar.gz
so i got distracted because i tried pulling the same file with wget and i got uh a lot of messages
ERROR:tcti:src/tss2-tcti/tctildr-dl.c:142:tcti_from_file() Could not initialize TCTI file: libtss2-tcti-tabrmd.so.0
ERROR:tcti:src/tss2-tcti/tcti-device.c:421:Tss2_Tcti_Device_Init() Failed to open specified TCTI device file /dev/tpmrm0: Permission denied
ERROR:tcti:src/tss2-tcti/tctildr-dl.c:142:tcti_from_file() Could not initialize TCTI file: libtss2-tcti-device.so.0
ERROR:tcti:src/tss2-tcti/tcti-device.c:421:Tss2_Tcti_Device_Init() Failed to open specified TCTI device file /dev/tpm0: Permission denied
ERROR:tcti:src/tss2-tcti/tctildr-dl.c:142:tcti_from_file() Could not initialize TCTI file: libtss2-tcti-device.so.0
ERROR:tcti:src/tss2-tcti/tcti-device.c:421:Tss2_Tcti_Device_Init() Failed to open specified TCTI device file /dev/tcm0: No such file or directory
ERROR:tcti:src/tss2-tcti/tctildr-dl.c:142:tcti_from_file() Could not initialize TCTI file: libtss2-tcti-device.so.0
WARNING:tcti:src/util-io/io.c:255:socket_connect() Failed to connect to host 127.0.0.1, port 2321: errno 111: Connection refused
ERROR:tcti:src/tss2-tcti/tcti-swtpm.c:571:Tss2_Tcti_Swtpm_Init() Cannot connect to swtpm TPM socket
good ol' arch linux!
man! this is crazy. so wget in archlinux is here https://gitlab.archlinux.org/archlinux/packaging/packages/wget/-/blob/main/PKGBUILD?ref_type=heads
and it has this line in the prepare() method:
# Build with nettle 4
git cherry-pick -n fd4487b629edea789fc22baac8a6b641e942bb49
where's that from? let's take a look https://gitlab.com/gnuwget/wget/-/merge_requests/73/diffs?commit_id=fd4487b629edea789fc22baac8a6b641e942bb49
#if NETTLE_VERSION_MAJOR >= 4
nettle_md4_digest(&MD4, ntbuffer);
#else
nettle_md4_digest(&MD4, MD4_DIGEST_SIZE, ntbuffer);
#endif
yeah, conditionally truncating the digest size looks like a normal thing to do
it's from a pull request: https://gitlab.com/gnuwget/wget/-/merge_requests/73/diffs?commit_id=896fcbfcd577c29956a059b9e6ea7c01a109eefc which also removes a --disable-ntlm from the configure script options. we'll come back to this
let's check where we're pulling the wget source from in the arch linux PKGBUILD:
source=("git+https://gitlab.com/gnuwget/wget.git?signed#tag=v${pkgver}"
"git+https://git.savannah.gnu.org/git/gnulib.git"
"https://ftp.gnu.org/gnu/${pkgname}/${pkgname}-${pkgver}.tar.lz"{,.sig})
a signed tag from the gitlab, and a .tar.lz file from ftp.gnu.org (they don't even have the courtesy to use ftpmirror.gnu.org, ugh)
let's take a look at the gitlab tags--
https://gitlab.com/gnuwget/wget/-/tags#
oh, curious, 1.25.0 is unverified? and it also failed a build...... https://gitlab.com/gnuwget/wget/-/jobs/8324934144
make: Entering directory '/builds/gnuwget/wget/wget-1.25.0/doc'
MAKEINFO wget.html
/bin/bash: /builds/gnuwget/wget/wget-UNKNOWN/build-aux/missing: No such file or directory
make: Leaving directory '/builds/gnuwget/wget/wget-1.25.0/doc'
so that sounds like someone's been messing with the release version variables.........and i was right again https://gitlab.com/gnuwget/wget/-/commit/a78b0d4da405cd46232fe0a1632f8591c4da0eba
they even have a special "arch linux" build job https://gitlab.com/gnuwget/wget/-/jobs/8324934105 and i notice again here:
NTLM: yes
there's also this great other commit https://gitlab.com/gnuwget/wget/-/commit/c284e9162a97d4622acaae9a479876fa1a9c2670
If the @var{file} is a local file, on systems that support it, it will be
opened with the @code{O_NONBLOCK} flag to allow non-blocking reads from the
file. @samp{Wget} will attempt to continue reading from the file until
EOF is reached or it is closed. This allows one to stream a list of files
for retrieval where the list is dynamically generated during the execution
of the process. Currently, this feature is not available on Windows platforms.
famously, linux does not allow opening local files with O_NONBLOCK. let's take a look at man wget:
-i file
--input-file=file
Read URLs from a local or external file. If - is specified as file, URLs are read from the standard input. (Use ./- to read
from a file literally named -.)
If this function is used, no URLs need be present on the command line.
so helpful they even tell you how to be sneaky with it
every single commit in the v1.25.0 tag is pure comedy https://gitlab.com/gnuwget/wget/-/commit/c4cb544c5dd13842456fe8773e6ec2df91f15b02
// Work-around linker issue "multiple definition of `getaddrinfo'"
#ifdef _WIN32
__attribute__ ((weak))
#endif
look at this loser. doesn't even know how to use lld from the LLVM project to re-link a binary after the fact without changing the file's modification or access time
remember when mark zuckerberg typed wget on the terminal in the hit film by david fincher "The Social Network"? i remember
it's so curious how all this happened all at once specifically in the beginning of november 2024 when the fascist took the US presidency again
there's a gnulib update this wget tag pulled in with a fix to a problem reported by Pádraig Brady, the maintainer of coreutils who also works at facebook https://debbugs.gnu.org/cgi/bugreport.cgi?bug=73418#35
I can still repro.
I'm on BTRFS though I don't think that matters for this test.
ah! btrfs! right back where we started all this!
it brings me immense relief to see that paul eggert (the ucla prof who writes snarky messages about POSIX and its lack of interest in user security in the autoconf docs, and who also publicly acknowledges the status of palestine as an independent nation), still seems to be a good egg. i like him very much
but this would explain why when i reported the backdoor in linux crypto to the coreutils mailing list in march (because coreutils has a configure flag to use linux crypto impls) that our buddy pádraig wasn't terribly interested
and just what is NTLM? the new thing injected into wget? https://davenport.sourceforge.net/ntlm.html
NTLM is a suite of authentication and session security protocols used in various Microsoft network protocol implementations and supported by the NTLM Security Support Provider ("NTLMSSP").
literally nothing could possibly be more backdoored than the microsoft security protocol
Key Weakening
The key used for signing and sealing is "weakened" in accordance with cryptographic export restrictions.
awesome. yes
Recent improvements in computer hardware and software algorithms have made these protocols vulnerable to widely published attacks for obtaining user passwords.
love it. awesome. fantastic
