Re:Backdoor in upstream xz/liblzma leading to SSH server com...
by tripflag on Friday March 29, 2024 @01:43PM
(#39866885)
indeed; it should be trivial in any language. Here's python: https://github.com/9001/copyparty/blob/a080759a03ef5c0a6b06c...
[ Parent
| on HN ]
Re:Backdoor in upstream xz/liblzma leading to SSH server com...
by cesarb on Friday March 29, 2024 @03:12PM
(#39867841)
It should be trivial in any language which has AF_UNIX. Last time I looked, Java didn't have it, so the only way was to call into non-Java code.
Re:Backdoor in upstream xz/liblzma leading to SSH server com...
by fullstop on Friday March 29, 2024 @04:13PM
(#39868510)
At first I thought that this surely could not be true as of today, but it looks like it is.
There is AF_UNIX support, but only for streams and not datagrams: https://bugs.openjdk.org/browse/JDK-8297837
What an odd decision. I suppose that you could execute systemd-notify but that's a solution that I would not like.
Re:Backdoor in upstream xz/liblzma leading to SSH server com...
by cesarb on Friday March 29, 2024 @04:23PM
(#39868609)
> I suppose that you could execute systemd-notify but that's a solution that I would not like.
What I did was to use JNA to call sd_notify() in libsystemd.so.0 (when that library exists), which works but obviously does not avoid using libsystemd. I suppose I could have done all the socket calls into glibc by hand, but doing that single call into libsystemd directly was simpler (and it can be expected to exist whenever systemd is being used).
Re:Backdoor in upstream xz/liblzma leading to SSH server com...
by ptx on Friday March 29, 2024 @05:42PM
(#39869331)
It looks like the FFI (Project Panama) finally landed in Java 22, released a few days ago: https://openjdk.org/jeps/454
Unless that feature also has some weird limitation, you could probably use that to call the socket API in libc.
Re:Backdoor in upstream xz/liblzma leading to SSH server com...
by reftel on Friday March 29, 2024 @03:40PM
(#39868145)
Then I suggest you have another look =) https://inside.java/2021/02/03/jep380-unix-domain-sockets-ch...