Recently in Linux/Unix Category

Shock! Horror! Bug found where Windows applications will open DLLs that are in the current working directory of a process!

Except it's not a bug. It's by design, and it's existed since NT.

Microsoft is being smacked in the head by a required feature of Windows due to the initial weakness of the LoadLibrary call. If you don't specify a path to the file to load, it uses the standard library search path.

Dear god, you would think that this was news. It is not news, nor has it been since the goddamned operating system shipped. Granted, the issue is severe, but the fact of the matter is if an application is executed using a working directory that isn't under your control, then what can you do? if there are libraries in the same directory that launched the program that happen to share the name of system libraries then you're hosed.

Hey, guess what asshole, if you link a linux binary with a search path containing '.', then you get the same problem. It's just as well that nobody links their binaries with -R. .... eh?

The documentation is blatant in this regard. I've known it was a security issue since I first learned of the LoadLibrary call, as any even half decent developer should have known when they started using the damned function.

The rule is simple. Resolve the full path to a library before you load it. Validate that it 'looks right' at that point. Then load it.

BTW .init section in .so files - so totally a security hole. You can't dlopen a file to determine if it's good without executing the .init code. Game over man, game f**king over!

My .init code does a setenv("LD_LIBRARY_PATH", "." + getenv("LD_LIBRARY_PATH")) ... now piss off and write secure code for once...

First I got the pid of thunderbird...

~% ps -fe | grep thunder
1000     17509     1  0 13:19 ?        00:00:00 /bin/sh /usr/bin/thunderbird
1000     17521 17509  0 13:19 ?        00:00:00 /bin/sh /usr/lib/thunderbird/run-mozilla.sh /usr/lib/thunderbird/thunderbird-bin
1000     17526 17521  0 13:19 ?        00:00:24 /usr/lib/thunderbird/thunderbird-bin
1000     19101 19006  0 14:09 pts/10   00:00:00 grep thunder

Then I got the address of the heap from the process' maps

~% grep 'heap' /proc/17526/maps
08d02000-0a9ad000 rw-p 08d02000 00:00 0          [heap]

I compiled up memory_dumper, and ran it against the process and heap addresses listed.

% ./memory_dumper 08d02000 0a46a000 17526 heap

Then I ran strings on the resulting file, looking for the pattern that matched my remembered password

% strings heap | grep t%7
cheat%7Ladel
cheat%7Ladel
cheat%7Ladel
cheat%7Ladel
%

4 copies of the password in memory in the program. That is just in-freaking-sane. It should be present in the program only once, and should probably be concealed using some form of obfuscation. Mind you, it has kept the new password in my mind now, so I should be grateful.

And just in case you feel like trying the password listed, don't. It's not the real password ;)

Nothing more than a rant....
It's not that tough - when using most english locales, we sort case insensitively. a==A, B==B and so on. Pragmatically, the only reason for picking a locale other than UTF-8.generic is because I would really, really like these rules obeyed.
I am sick to death of having to work around stupidity.
I'm just complaining as I look at the output from ls and it's pretty much a case sensitive sort. I'm sure that accents are sorted correctly in EN_ie - after all á is the same as a, but apparently it's different to A.
Sorting it difficult... the rules are so complicated... stop complaining! you're able to perform at least 600 million operations per second, and a table lookup for a case insensitive sort is probably going to cost 20.
Bear in mind that the number above was a quick back of the envelope number of an iPhone. I'm sure a real computer will be able to do something a little better...

Update:

Looks like it's not Linux, it's only Leopard that doesn't understand EN_ie collation. Oh well, that's life I suppose…

signal(int signum, void (*handler)(int))

signal

sigaction(int sig, const struct sigaction *restrict act, struct sigaction *restrict oact)

#!/bin/bash -p

if [ $# -eq 0 ]; then
    echo "Usage: $(basename $0) " 1>&2
    exit 1
fi

while [ -d /proc/$1 ]; do sleep 0.5; done

~% ls -ld .
drwx--x--x 163 pshanahan pshanahan 12288 2008-06-16 16:26 .
~% setfacl -m user:postfix:rx .
~% ls -ld .                    
drwxr-x--x+ 163 pshanahan pshanahan 12288 2008-06-16 16:26 .

~/x% locale
LANG=en_IE.UTF-8
LC_CTYPE="en_IE.UTF-8"
LC_NUMERIC="en_IE.UTF-8"
LC_TIME="en_IE.UTF-8"
LC_COLLATE="en_IE.UTF-8"
LC_MONETARY="en_IE.UTF-8"
LC_MESSAGES="en_IE.UTF-8"
LC_PAPER="en_IE.UTF-8"
LC_NAME="en_IE.UTF-8"
LC_ADDRESS="en_IE.UTF-8"
LC_TELEPHONE="en_IE.UTF-8"
LC_MEASUREMENT="en_IE.UTF-8"
LC_IDENTIFICATION="en_IE.UTF-8"
LC_ALL=
~/x% ls
a  B  c

himitsu:~/x% locale
LANG="en_IE.UTF-8"
LC_COLLATE="C"
LC_CTYPE="en_IE.UTF-8"
LC_MESSAGES="en_IE.UTF-8"
LC_MONETARY="en_IE.UTF-8"
LC_NUMERIC="en_IE.UTF-8"
LC_TIME="en_IE.UTF-8"
LC_ALL=
himitsu:~/x% ls
B  a  c

LC_COLLATE

Determine the locale for character collation information in determining the pathname collation sequence.

Setting up network-manager (0.6.5-0ubuntu16.7.10.0) ...
Installing new version of config file /etc/dbus-1/system.d/NetworkManager.conf ...
Auto interfaces found: lo eth1 eth2 ath0 wlan0
iface to disable = eth1
iface to disable = eth2
iface to disable = ath0
iface to disable = wlan0
Disabling interface: eth1 ... done.
Disabling interface: eth2 ... done.
Disabling interface: ath0 ... done.
Disabling interface: wlan0 ... done.
 * Reloading system message bus config...
   ...done.
 * Restarting network connection manager NetworkManager

function find_lowest_subprocess() {
    local -i parent=$1
    local pids
    typeset -a pids

    pids=($(pgrep -P $parent))
    while ((${#pids[@]} > 0)); do
        if ((${#pids[@]} > 1)); then
            parent=${pids[0]}
            local i=0
            while ((i < ${#pids[@]})); do
                local sub=$(pgrep -P ${pids[$i]})
                [[ -n $sub ]] && parent=$sub
                ((i=i + 1))
            done
        else
            parent=$pids
        fi
        pids=($(pgrep -P $parent))
    done
    echo $parent
}

for i in $(find . -type f); do
sed -i -e 's/EXPORT_SYMBOL_GPL/EXPORT_SYMBOL/' $i
done

for i in $(find . -type f); do
sed -i -e 's/EXPORT_SYMBOL_GPL/EXPORT_SYMBOL/g' $i
done

pkg(1) + pkg(2) + pkg(3)

Unless you're planning on creating a whole travelling salesmanOk, it's not quite the travelling salesman problem, but it gives you a good idea as to how much work is involved of snapshots, I think my mechanism is easier.

function find_lowest_subprocess() {
        local -i parent=$1
        local pids
        typeset -a pids

        pids=$(pgrep -P $parent)
        while [[ -n "$pids" ]]; do
                if (( ${#pids[@]} > 1 )); then
                        local i=0
                        while (( i < ${#pids[@]} )); do
                                local sub=$(pgrep -P ${pids[$i]})
                                [[ -n $sub ]] && parent=$sub
                                ((i=i + 1))
                        done
                else
                        parent=$pids
                fi
                pids=$(pgrep -P $parent)
        done
        echo $parent
}

#!/bin/bash -p

package=$1
destdir=${2:-/usr/local}
me=${0##*/}

[[ -z $package ]] && {
        echo "Usage: $me <package> [destination = /usr/local]"
        exit 2
}

cd $destdir/$package || {
        echo "$me: package $package does not seem to be installed"
        exit 1
}

# build the directory structure - this is a weakness
find . -type d | cpio -o | (cd $destdir; cpio -id)

find . -type f -exec $echo ln -s $destdir/$package/{} ../{} \;

(1) The [[ operator is not the same as the program /bin/[[ as a program you need to still use double quotes around the variables to be expanded; thus defeating the reason for having them in the first place.

For Example:

	# file="/tmp/let me go"
	# touch "$file"
	# [[ -e $file ]] && echo "There"

Yields [Busybox]:

	[[: me: unknown operand

- as $file is word split before handing it to the command [[

Yields [bash]:

	There

- due to $file not being split when passed to the test -e.