News for hackers. Stuff that matters.

A comment on XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable.". Parent comment

Re:XZ backdoor: "It's RCE, not auth bypass, and gated/unrepl... by loumf on Saturday March 30, 2024 @06:44PM (#39879411)
You are looking at a makefile, not C. The C code is in a string that is being passed to a function called `check_c_source_compiles()`, and this dot makes that code not compile when it should have -- which sets a boolean incorrectly, which presumably makes the build do something it should not do.
[ Parent | on HN ]
Re:XZ backdoor: "It's RCE, not auth bypass, and gated/unrepl... by nurple on Saturday March 30, 2024 @08:02PM (#39879907)
Interesting that validating the failure reason of an autotools compile check could be a security mitigation...
[ Parent | on HN ]
Re:XZ backdoor: "It's RCE, not auth bypass, and gated/unrepl... by paulmd on Sunday March 31, 2024 @03:33AM (#39882222)
This is something that should have unit/integration tests inside the tooling itself, yeah. If your assertion is that X function is called / in the environment X then the function should return Y then that should be a test especially when it’s load-bearing for security.

And tooling is no exception either. You should have tests that your tooling does the things it says on the tin and that things happen when flags are set and things don’t happen when they’re not set, and that the tooling sets the flags in the way you expect.

These aren’t even controversial statements in the JVM world etc. Just C tooling is largely still living in the 70s apart from abortive attempts to build the jenga tower even taller like autotools/autoconf/cmake/etc (incomprehensible, may god have mercy on your build). At least hand written make files are comprehensible tbh.

[ Parent | on HN ]
Re:XZ backdoor: "It's RCE, not auth bypass, and gated/unrepl... by yencabulator on Sunday March 31, 2024 @11:51AM (#39885331)
It's a "does this compile on this platform" test, not a "does this function return what we expect" test.
[ Parent | on HN ]
Re:XZ backdoor: "It's RCE, not auth bypass, and gated/unrepl... by yencabulator on Sunday March 31, 2024 @11:51AM (#39885324)
Unfortunately in the world of autoconf and multiple platforms and compilers, there was no standard way to understand why the compilation failed.
[ Parent | on HN ]
Re:XZ backdoor: "It's RCE, not auth bypass, and gated/unrepl... by saagarjha on Sunday March 31, 2024 @12:49AM (#39881535)
Cmake actually but yes
[ Parent | on HN ]