Hacker News Reader

Comment by tedunangst | Hacker News Reader

> the presumption that "localhost" is only accessible by local users

Why is there even a presumption that all local users are equally trusted?

Their suggested methods (Unix sockets and named pipes) both use Unix filesystem ACLs which means they're resilient to this problem.

This is the main reason I've never liked binding to 127.0.0.1 rather than just using a socket -- you lose the access control you could have if you used sockets.

It was once the case on BSD that filesystem DAC bits weren't applied to AF_UNIX sockets. Can that be universally relied upon now?

I know it works on GNU/Linux, and I'm fairly sure it works on illumos (Solaris). I don't really use any of the BSDs, so I can't comment on that. Sounds like a nasty kernel bug though -- Linux implements AF_UNIX sockets as actual filesystem objects (so you go through VFS implicitly to interact with them).

It does work on FreeBSD now at least.

It wasn't a bug, though - just a questionable design (POSIX still doesn't mandate how filesystem permissions interact with connect() on AF_UNIX sockets AFAICS).

Someone logged in to the machine likely has enough access to make this attack irrelevant.

Even HN has enough access to your machine. Your browser is showing you this page, the page may contain javascript (probably does, feh), and the javascript can retrieve http://localhost:43278/this/that.

Not if you have noscript and the ABE protection turned on.

That doesn't even require JavaScript, does it? Just `<img src="http://localhost..."/>`.

I suppose you're right.

Although for the good stuff you want POST. With POST and an error-tolerant SMTP server you can send mail, I imagine other kinds of servers might be equally accommodating.

Not necessarily; unless they have root, they likely don't have permission to run as your user account, only their own.

Reply on news.ycombinator.com