Re: [RFC] Adding a SECURITY policy for GDB

[Kevin Buettner <kevinb@redhat.com>]

On Mon, 06 Nov 2023 13:26:27 +0000
Andrew Burgess <aburgess@redhat.com> wrote:

> I'd be interested to hear:
> 
>   * Do people feel I'm being too restrictive in what I consider a
>     security issue?  Are there any additional classes of bug that you
>     would see as a security issue within GDB?
> 
>   * I've tried to highlight areas of GDB that might pose a risk if run
>     in a non-secure setting, e.g. GDB run the inferior, so using GDB to
>     debug unknown inferiors can allow arbitrary code execution, or that
>     gdbserver on an open network would allow access to the machine
>     running gdbserver.  Are there any other areas of GDB for which we
>     should list as being potentially dangerous if not run in a secure
>     (sandboxed) environment?

Some crash detection/analysis tools use GDB in an automatic fashion to
provide diagnostics.  I think it should be made clear that such tools
should use GDB in a sandboxed environment.

Kevin