August 2023 - Lua Packagers SIG - Fedora Mailing-Lists

[Bug 2177239] New: Lua scripts use an unsafe package path

by bugzilla＠redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=2177239 Bug ID: 2177239 Summary: Lua scripts use an unsafe package path Product: Fedora Version: 37 Status: NEW Component: lua Assignee: spotrh(a)gmail.com Reporter: arstoffel(a)gmail.com QA Contact: extras-qa(a)fedoraproject.org CC: 4le(a)live.com, drjohnson1(a)gmail.com, lua-packagers-sig(a)lists.fedoraproject.org, mhroncok(a)redhat.com, michel(a)michel-slm.name, spotrh(a)gmail.com Target Milestone: --- Classification: Fedora Description of problem: By default, Lua allows loading code from the current directory, and Fedora doesn't change this in packaged scripts installed in the system path. This has security implications. Steps to Reproduce: 1. Install any package that provides a #!/usr/bin/lua script, such as (but not limited) to luarocks 2. In the terminal: echo 'os.execute("echo rm -rf /")' > lfs.lua; luarocks --version Actual results: $ luarocks --version rm -rf / /usr/bin/lua: /usr/share/lua/5.4/luarocks/fs/lua.lua:299: attempt to index a boolean value (upvalue 'lfs') stack traceback: /usr/share/lua/5.4/luarocks/fs/lua.lua:299: in function 'luarocks.fs.lua.current_dir' (...tail calls...) /usr/share/lua/5.4/luarocks/fs/unix.lua:50: in function 'luarocks.fs.unix.absolute_name' (...tail calls...) /usr/share/lua/5.4/luarocks/fs/linux.lua:8: in function 'luarocks.fs.linux.is_dir' (...tail calls...) /usr/share/lua/5.4/luarocks/fs/lua.lua:193: in function 'luarocks.fs.lua.dir' (...tail calls...) /usr/share/lua/5.4/luarocks/fs/lua.lua:177: in function 'luarocks.fs.lua.list_dir' (...tail calls...) /usr/share/lua/5.4/luarocks/fs/lua.lua:229: in function 'luarocks.fs.lua.modules' (...tail calls...) /usr/share/lua/5.4/luarocks/cmd.lua:511: in function 'luarocks.cmd.run_command' /home/augusto/Projects/digestif/.luarocks/lib/luarocks/rocks-5.4/luarocks/3.9.2-1/bin/luarocks:35: in main chunk [C]: in ? Expected results: $ luarocks --version /usr/bin/luarocks 3.9.1 LuaRocks main command-line interface Additional info: I'm using the following fix on a Lua program I maintain: #!/usr/bin/env lua -- Remove relative directories from package path package.path = package.path:gsub("%f[^\0;]%.[^;]*", ""):gsub(";+", ";"):gsub("^;", ""):gsub(";$", "") package.cpath = package.cpath:gsub("%f[^\0;]%.[^;]*", ""):gsub(";+", ";"):gsub("^;", ""):gsub(";$", "") Fedora can probably do better and use hardcoded pacakge.path and cpath values, since these are known in advance. Scripts with the #!/usr/bin/texlua shebang also might be affected by this issue. Since texlua provides an alternative method to find packages based on kpathsea, something like this should be used as well: os.setenv("TEXMFDOTDIR", "/dev/null") However, this last modification will break programs that expect to find TeX files in the current directory. I don't know of a more fine grained way that would allow that but still exclude random Lua libraries from being found. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2177239

3 months, 2 weeks

1
3
0 / 0

[Bug 2143028] Review Request: lua-loadkit - Loadkit allows you to load arbitrary files within the Lua package path

by bugzilla＠redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=2143028 --- Comment #13 from Fedora Update System <updates(a)fedoraproject.org> --- FEDORA-2023-2ba131b47f has been pushed to the Fedora 39 stable repository. If problem still persists, please make note of it in this bug report. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2143028 Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-...

8 months, 1 week

1
0
0 / 0

[Bug 2143028] Review Request: lua-loadkit - Loadkit allows you to load arbitrary files within the Lua package path

by bugzilla＠redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=2143028 --- Comment #12 from Fedora Update System <updates(a)fedoraproject.org> --- FEDORA-2023-2ba131b47f has been submitted as an update to Fedora 39. https://bodhi.fedoraproject.org/updates/FEDORA-2023-2ba131b47f -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2143028 Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-...

8 months, 1 week

1
0
0 / 0

[Bug 2143028] Review Request: lua-loadkit - Loadkit allows you to load arbitrary files within the Lua package path

by bugzilla＠redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=2143028 Fedora Update System <updates(a)fedoraproject.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|MODIFIED |CLOSED Resolution|--- |ERRATA Last Closed| |2023-08-17 20:12:44 --- Comment #11 from Fedora Update System <updates(a)fedoraproject.org> --- FEDORA-2023-5bd5acdae6 has been pushed to the Fedora 40 stable repository. If problem still persists, please make note of it in this bug report. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2143028 Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-...

8 months, 1 week

1
0
0 / 0

[Bug 2143028] Review Request: lua-loadkit - Loadkit allows you to load arbitrary files within the Lua package path

by bugzilla＠redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=2143028 Fedora Update System <updates(a)fedoraproject.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|POST |MODIFIED --- Comment #10 from Fedora Update System <updates(a)fedoraproject.org> --- FEDORA-2023-5bd5acdae6 has been submitted as an update to Fedora 40. https://bodhi.fedoraproject.org/updates/FEDORA-2023-5bd5acdae6 -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2143028 Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-...

8 months, 1 week

1
0
0 / 0

[Bug 2143028] Review Request: lua-loadkit - Loadkit allows you to load arbitrary files within the Lua package path

by bugzilla＠redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=2143028 --- Comment #9 from Jonny Heggheim <hegjon(a)gmail.com> --- (In reply to Robert-André Mauchin 🐧 from comment #7) > Yes indeed for now.Add the bug link in the SPEC though. Upstream added the LICENSE already, adding it as Source1 and including it as %license. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2143028 Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-...

8 months, 1 week

1
0
0 / 0

[Bug 2143028] Review Request: lua-loadkit - Loadkit allows you to load arbitrary files within the Lua package path

by bugzilla＠redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=2143028 --- Comment #8 from Fedora Admin user for bugzilla script actions <fedora-admin-xmlrpc(a)fedoraproject.org> --- The Pagure repository was created at https://src.fedoraproject.org/rpms/lua-loadkit -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2143028 Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-...

8 months, 1 week

1
0
0 / 0

[Bug 2143028] Review Request: lua-loadkit - Loadkit allows you to load arbitrary files within the Lua package path

by bugzilla＠redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=2143028 --- Comment #7 from Robert-André Mauchin 🐧 <zebob.m(a)gmail.com> --- (In reply to Jonny Heggheim from comment #6) > (In reply to Robert-André Mauchin 🐧 from comment #4) > > - Don't put the README as a licence: > > > > %files > > %license README.md > > %doc README.md > > Would it be better to leave the spec file without a %license? Yes indeed for now.Add the bug link in the SPEC though. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2143028 Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-...

8 months, 1 week

1
0
0 / 0

[Bug 2143028] Review Request: lua-loadkit - Loadkit allows you to load arbitrary files within the Lua package path

by bugzilla＠redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=2143028 --- Comment #6 from Jonny Heggheim <hegjon(a)gmail.com> --- (In reply to Robert-André Mauchin 🐧 from comment #4) > - Don't put the README as a licence: > > %files > %license README.md > %doc README.md Would it be better to leave the spec file without a %license? -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2143028 Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-...

8 months, 1 week

1
0
0 / 0

[Bug 2143028] Review Request: lua-loadkit - Loadkit allows you to load arbitrary files within the Lua package path

by bugzilla＠redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=2143028 Jonny Heggheim <hegjon(a)gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Github | |leafo/loadkit/issues/3 --- Comment #5 from Jonny Heggheim <hegjon(a)gmail.com> --- Thanks again for the review! (In reply to Robert-André Mauchin 🐧 from comment #4) > Hello fellow Sal enjoyer! Glad there are others here that also likes his memes :) > MIT specifies that the text of the license should be given with the source, which is not the case here, even in the README. Open a bug upstream so that they fix this. I have reported this issue upstream: https://github.com/leafo/loadkit/issues/3 -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2143028 Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-...

8 months, 1 week

1
0
0 / 0

2024

2023

2022

2021

2020

Lua Packagers SIG August 2023