Re: [RFC] Adding a SECURITY policy for GDB

[Siddhesh Poyarekar <siddhesh@redhat.com>]

On 2023-11-06 15:15, Simon Marchi wrote:
> On 11/6/23 15:09, Siddhesh Poyarekar wrote:
>> On 2023-11-06 14:34, Simon Marchi wrote:
>>> On 11/6/23 08:26, Andrew Burgess wrote:
>>>>     In the context of local debugging, any bugs in GDB that result in
>>>>     crossing of a privilege boundary are considered security bugs.  Some
>>>>     examples of crossing a privilege boundary include; being able to
>>>>     execute code as an arbitrarily different user, or accessing resources
>>>>     (e.g. files, sockets, etc) for which the original user would not
>>>>     normally have access.
>>>
>>> Do you have examples of this?  It seems like any bug in that category would
>>> be bugs in the platform / OS, not GDB.  If such a bug is possible to exploit
>>> with GDB, the user could another program to exploit the same bu
>>
>> That's basically boilerplate to state that *if* such a thing ever happens, it will be considered a security issue.  I don't think there are any such opportunities for misuse in gdb at the moment, but never say never :)
> 
> Ok... it seems strange because it looks like it invites people to report
> as GDB bugs what are bugs in other components (e.g. the kernel).  An
> option would be to say that exploiting GDB to cross a privilege boundary
> is considered a bug of the platform, and not a GDB bug.  That would be
> even less work for us, and technically accurate, AFAIK.

An example of such a CVE could be failure to respect umask[1].  I'm not 
sure how one would word that without risking OS bugs being reported 
against GDB.  I'm inclined to think that it's not as much of a problem 
at the moment since we haven't historically gotten any reports in this 
area.  Maybe if we start getting reports in this area we could tighten 
up this text?

Thanks,
Sid

[1] https://blog.rust-lang.org/2023/08/03/cve-2023-38497.html