joeyh,
@joeyh@hachyderm.io avatar

Lasse Collin has started making some commits to #xz, interesting starting point here.

https://git.tukaani.org/?p=xz.git;a=commitdiff;h=f9cf4c05edd14dedfe63833f8ccbe41b55823b00

joeyh,
@joeyh@hachyderm.io avatar

Here's the malicious commit that disabled the Landlock sandbox. Pretty slick!

https://git.tukaani.org/?p=xz.git;a=commitdiff;h=328c52da8a2bbb81307644efdb58db2c422d9ba7

  • A compile check is done here because some systems have

  • linux/landlock.h, but do not have the syscalls defined

  • in order to actually use Linux Landlock.

That may even be true.

jamescooke,
@jamescooke@fosstodon.org avatar

@joeyh Took me ages 😬

demiurg,
@demiurg@fosstodon.org avatar

@jamescooke @joeyh Thank you...I didn't see it the umpteenth time I read it and was about to lose my mind over people talking about dots.

UkiahSmith,

@joeyh would this be something linting and formatters would catch, or make easier to catch?

At the least it would properly indent which might make it more obvious.

jamescooke,
@jamescooke@fosstodon.org avatar

@UkiahSmith @joeyh I’m no C person, but I think this would be hard. It looks to me like the code is packed inside a string - someone would have to turn on a linter and explicitly check that string.

0x,

@joeyh So sneaky. I reviewed the code several times before I even saw the added '.'

tshirtman,
@tshirtman@mas.to avatar

@0x @joeyh damn, this “underhanded c contest” worthy, even after your comment, and understanding something must make this code not compile, I had a hard time spotting it.

cloud_manul,

@joeyh I am not an expert in C, can you explain what is caused by the addition of the dot?

timbray,
@timbray@cosocial.ca avatar

@cloud_manul @joeyh The . would cause the code to fail to compile, which would be detected and thus disable the landlock capability.

  • All
  • Subscribed
  • Moderated
  • Favorites
  • random
  • DreamBathrooms
  • InstantRegret
  • ethstaker
  • magazineikmin
  • GTA5RPClips
  • rosin
  • modclub
  • Youngstown
  • ngwrru68w68
  • slotface
  • osvaldo12
  • kavyap
  • mdbf
  • thenastyranch
  • JUstTest
  • everett
  • cubers
  • cisconetworking
  • normalnudes
  • Durango
  • anitta
  • khanakhh
  • tacticalgear
  • tester
  • provamag3
  • megavids
  • Leos
  • lostlight
  • All magazines