From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (qmail 30575 invoked by alias); 17 Jan 2012 20:19:47 -0000 Received: (qmail 30562 invoked by uid 22791); 17 Jan 2012 20:19:44 -0000 X-SWARE-Spam-Status: No, hits=-7.0 required=5.0 tests=AWL,BAYES_00,RCVD_IN_DNSWL_HI,SPF_HELO_PASS,T_RP_MATCHES_RCVD X-Spam-Check-By: sourceware.org Received: from mx1.redhat.com (HELO mx1.redhat.com) (209.132.183.28) by sourceware.org (qpsmtpd/0.43rc1) with ESMTP; Tue, 17 Jan 2012 20:19:26 +0000 Received: from int-mx12.intmail.prod.int.phx2.redhat.com (int-mx12.intmail.prod.int.phx2.redhat.com [10.5.11.25]) by mx1.redhat.com (8.14.4/8.14.4) with ESMTP id q0HKJOr7013666 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK); Tue, 17 Jan 2012 15:19:24 -0500 Received: from ns3.rdu.redhat.com (ns3.rdu.redhat.com [10.11.255.199]) by int-mx12.intmail.prod.int.phx2.redhat.com (8.14.4/8.14.4) with ESMTP id q0HKJO1w008607; Tue, 17 Jan 2012 15:19:24 -0500 Received: from barimba (ovpn01.gateway.prod.ext.phx2.redhat.com [10.5.9.1]) by ns3.rdu.redhat.com (8.13.8/8.13.8) with ESMTP id q0HKJLT4022861; Tue, 17 Jan 2012 15:19:22 -0500 From: Tom Tromey To: Eli Zaretskii Cc: Jan Kratochvil , gdb-patches@sourceware.org Subject: Re: [patch] New set auto-load-local-gdbinit + disable it by default References: <20120117095552.GA6141@host2.jankratochvil.net> Date: Tue, 17 Jan 2012 20:22:00 -0000 In-Reply-To: (Eli Zaretskii's message of "Tue, 17 Jan 2012 05:21:38 -0500") Message-ID: User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/24.0.92 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain Mailing-List: contact gdb-patches-help@sourceware.org; run by ezmlm Precedence: bulk List-Id: List-Subscribe: List-Archive: List-Post: List-Help: , Sender: gdb-patches-owner@sourceware.org X-SW-Source: 2012-01/txt/msg00638.txt.bz2 >>>>> "Eli" == Eli Zaretskii writes: Jan> Still at least the setting should go in and then one can then have Jan> "set auto-load-local-gdbinit off" at least in ~/.gdbinit. Anyway I Jan> would file a FESCo (Fedora Engineering Steering Committee) ticket Jan> for such "off" in /etc/gdbinit at least in distro and IMHO it needs Jan> to get approved (but maybe not, it would be another fork from Jan> upstream). Eli> I think this is a draconian measure. It prevents me from having a Eli> .gdbinit file loaded automatically as appropriate for a program I'm Eli> debugging. Prominent examples include GDB itself and Emacs, which Eli> both come with a .gdbinit file that makes debugging much easier. Jan> And "gdb -x ./.gdbinit" is a pretty simple way to do what one wants to do. Eli> "gdb -x .gdbinit" is much longer than just "gdb". You can also put the setting into your ~/.gdbinit and get the old behavior back. I read through this thread and, while I agree that this change is inconvenient, I think the inconvenience is outweighed by the security implications. I consider this to be similar to putting "." in PATH. We're just lucky that it hasn't been exploited yet (or at least that we haven't gotten the blame). Well, I "agree" with it -- I am not happy about it by a long stretch. I'm tempted by the idea that gdb should be insecure by default and we should require "-safe"... but on balance this seems irresponsible to me, as I think that tools should generally be secure by default. FWIW, I think this patch doesn't go far enough :-( Some other topics for consideration; perhaps the new option could cover all such cases. * Auto-loading of Python code from the filesystem. Perhaps we could have a set of trusted directories; but I wonder if there are issues with sysroots starting with "remote:". * Auto-loading of Python code from objfiles. Even more dangerous. * The JIT interface. I'm not sure whether this can be exploited or not. FWIW, I will probably set the new parameter in my own .gdbinit and use "-safe" in those rare instances that I do something other than debug programs that I built myself. Tom