New subject: [Bug 2177239] Lua scripts use an unsafe package path

11 Mar 2023


      https://bugzilla.redhat.com/show_bug.cgi?id=2177239
Bug ID: 2177239
           Summary: Lua scripts use an unsafe package path
           Product: Fedora
           Version: 37
            Status: NEW
         Component: lua
          Assignee: spotrh@gmail.com
          Reporter: arstoffel@gmail.com
        QA Contact: extras-qa@fedoraproject.org
                CC: 4le@live.com, drjohnson1@gmail.com,
                    lua-packagers-sig@lists.fedoraproject.org,
                    mhroncok@redhat.com, michel@michel-slm.name,
                    spotrh@gmail.com
  Target Milestone: ---
    Classification: Fedora
Description of problem:
By default, Lua allows loading code from the current directory, and Fedora
doesn't change this in packaged scripts installed in the system path.  This has
security implications.
Steps to Reproduce:
1. Install any package that provides a #!/usr/bin/lua script, such as (but not
limited) to luarocks
2. In the terminal: echo 'os.execute("echo rm -rf /")' > lfs.lua; luarocks
--version
Actual results:
$ luarocks --version
rm -rf /
/usr/bin/lua: /usr/share/lua/5.4/luarocks/fs/lua.lua:299: attempt to index a
boolean value (upvalue 'lfs')
stack traceback:
        /usr/share/lua/5.4/luarocks/fs/lua.lua:299: in function
'luarocks.fs.lua.current_dir'
        (...tail calls...)
        /usr/share/lua/5.4/luarocks/fs/unix.lua:50: in function
'luarocks.fs.unix.absolute_name'
        (...tail calls...)
        /usr/share/lua/5.4/luarocks/fs/linux.lua:8: in function
'luarocks.fs.linux.is_dir'
        (...tail calls...)
        /usr/share/lua/5.4/luarocks/fs/lua.lua:193: in function
'luarocks.fs.lua.dir'
        (...tail calls...)
        /usr/share/lua/5.4/luarocks/fs/lua.lua:177: in function
'luarocks.fs.lua.list_dir'
        (...tail calls...)
        /usr/share/lua/5.4/luarocks/fs/lua.lua:229: in function
'luarocks.fs.lua.modules'
        (...tail calls...)
        /usr/share/lua/5.4/luarocks/cmd.lua:511: in function
'luarocks.cmd.run_command'
/home/augusto/Projects/digestif/.luarocks/lib/luarocks/rocks-5.4/luarocks/3.9.2-1/bin/luarocks:35:
in main chunk
        [C]: in ?
Expected results:
$ luarocks --version
/usr/bin/luarocks 3.9.1
LuaRocks main command-line interface
Additional info:
I'm using the following fix on a Lua program I maintain:
#!/usr/bin/env lua
-- Remove relative directories from package path
package.path = package.path:gsub("%f[^\0;]%.[^;]*", ""):gsub(";+",
";"):gsub("^;", ""):gsub(";$", "")
package.cpath = package.cpath:gsub("%f[^\0;]%.[^;]*", ""):gsub(";+",
";"):gsub("^;", ""):gsub(";$", "")
Fedora can probably do better and use hardcoded pacakge.path and cpath values,
since these are known in advance.
Scripts with the #!/usr/bin/texlua shebang also might be affected by this
issue. Since texlua provides an alternative method to find packages based on
kpathsea, something like this should be used as well:
os.setenv("TEXMFDOTDIR", "/dev/null")
However, this last modification will break programs that expect to find TeX
files in the current directory.  I don't know of a more fine grained way that
would allow that but still exclude random Lua libraries from being found.
-- 
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2177239

[Bug 2177239] New: Lua scripts use an unsafe package path