Re: darkhttpd: timing attack and local leak of HTTP basic auth credentials

[Hanno Böck <hanno () hboeck de>]

On Tue, 23 Jan 2024 11:39:19 +0100
Matthias Gerstner <mgerstner () suse de> wrote:

> The only way to configure the HTTP basic auth string in darkhttpd is
> to pass it via the `--auth` command line parameter. On Linux all local
> users can view the parameters of other programs running on the system.

I'd like to comment on that.
While "on Linux" *in most distros default settings* this is true, the
Linux Kernel actually has a mitigation for this since quite a while.

This is a feature that I believe was initially introduced by
grsecurity, but was lated ported as an option to the mainline kernel.
/proc can be mounted with the hidepid option (ideally set to hidepid=2)
[1], with it enabled users cannot see processes of other users.

Unfortunately, this has not been widely applied by linux distributions.
There is a website by redhat that explicitly discourages its use [2].

it hints to some problems that could show up because daemons could not
access information about the clients accessing them. But that sounds
very nonspecific and they don't reference any examples, so it's hard to
tell what exactly these problems would be.

Furthermore, they point out that the same information can be queried
via systemd without any access control. That sounds more like a weakness
in systemd that should be fixed than an issue with hidepid.

I think it would be desirable that Linux distributions start using
hidepid and mitigate the whole class of bugs like the one mentioned
above.

[1] https://www.kernel.org/doc/html/latest/filesystems/proc.html
[2] https://access.redhat.com/solutions/6704531
-- 
Hanno Böck
https://hboeck.de/