Join GitHub today
GitHub is home to over 28 million developers working together to host and review code, manage projects, and build software together.Sign up
Add developer accessible backdoor to VM tests infrastructure. #47418
Thanks to @dezgeg for prototype implementation, I've
I admit it's not clear to me if console access via $TMPDIR is considered a security issue, on a builder running multiple tests, I'd expect this could be considered an adversary.
referenced this pull request
Sep 27, 2018
I'd expect the temporary directory to have sufficiently restrictive permissions anyway. That's a problem that Nix should already solve. An adversary will have just as hard a time attacking a backdoored test as he would attacking a non-backdoored test.
Some potential improvements:
A similar backdoor to the perl script could be added, to provide access to library functions on machines and to relay the vm backdoors.
Also the tester could print the backdoor instructions, although it won't be able to point the user to the right path because of that one security measure to prevent dangerous accidental /tmp references in built packages, or do we have an obscure impure environment variable with that info?
Sounds good to me - anyone should feel free to contribute that, my motivation was to have a system that works and is documented. Hopefully that sparkles simplification :)
Shouldn't be an issue to echo $TMPDIR to logs. My willpower to do more test debugging is very low, as I was deep into it in last days, can we also consider this an improvement yet to be done? :)
I'm merging this by discarding my concern about backdoor being a security issue given that
I know this is far from perfect, but I've managed to debug my test failures easily - so it does the job. Any improvements are welcome to be done on top of this work.
Going to backport to 18.09 as well.