TE
TechEcho
Home24h TopNewestBestAskShowJobs
GitHubTwitter
Home

TechEcho

A tech news platform built with Next.js, providing global tech news and discussions.

GitHubTwitter

Home

HomeNewestBestAskShowJobs

Resources

HackerNews APIOriginal HackerNewsNext.js

© 2025 TechEcho. All rights reserved.

How Torch broke ls and made me vulnerable

183 pointsby joshumaxalmost 8 years ago

12 comments

binarycrusaderalmost 8 years ago
Torch probably doesn&#x27;t even need to set LD_LIBRARY_PATH. If LD_LIBRARY_PATH is only being set so that binaries distributed by torch work, then I&#x27;d strongly suggest they use RUNPATH instead with $ORIGIN.<p>There are examples in various places:<p><a href="https:&#x2F;&#x2F;enchildfone.wordpress.com&#x2F;2010&#x2F;03&#x2F;23&#x2F;a-description-of-rpath-origin-ld_library_path-and-portable-linux-binaries&#x2F;" rel="nofollow">https:&#x2F;&#x2F;enchildfone.wordpress.com&#x2F;2010&#x2F;03&#x2F;23&#x2F;a-description-o...</a> <a href="http:&#x2F;&#x2F;man7.org&#x2F;linux&#x2F;man-pages&#x2F;man8&#x2F;ld.so.8.html" rel="nofollow">http:&#x2F;&#x2F;man7.org&#x2F;linux&#x2F;man-pages&#x2F;man8&#x2F;ld.so.8.html</a> <a href="http:&#x2F;&#x2F;longwei.github.io&#x2F;rpath_origin&#x2F;" rel="nofollow">http:&#x2F;&#x2F;longwei.github.io&#x2F;rpath_origin&#x2F;</a><p>LD_LIBRARY_PATH is really only for a developer&#x27;s local use; it should never be used for installed software.<p>Disclaimer: may not apply in some scenarios, I haven&#x27;t used Torch, so this is merely a general observation.
评论 #14520180 未加载
评论 #14521095 未加载
anderskaseorgalmost 8 years ago
How to safely prepend a directory to a PATH-like variable (in any POSIX-compliant shell):<p>export LD_LIBRARY_PATH=&#x2F;opt&#x2F;whatever&#x2F;lib${LD_LIBRARY_PATH:+:$LD_LIBRARY_PATH}<p>Pull request sent to <a href="https:&#x2F;&#x2F;github.com&#x2F;torch&#x2F;distro&#x2F;pull&#x2F;228" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;torch&#x2F;distro&#x2F;pull&#x2F;228</a>.
评论 #14519486 未加载
AceJohnny2almost 8 years ago
More concerning to me is that ld.so will interpret a trailing `:` in LD_LIBRARY_PATH to mean to include PWD.<p>Where is this documented? It&#x27;s not indicated in ld.so&#x27;s manpage:<p><a href="http:&#x2F;&#x2F;man7.org&#x2F;linux&#x2F;man-pages&#x2F;man8&#x2F;ld.so.8.html" rel="nofollow">http:&#x2F;&#x2F;man7.org&#x2F;linux&#x2F;man-pages&#x2F;man8&#x2F;ld.so.8.html</a><p>Sounds like a bug in GNU&#x27;s ld.so more than anything.
评论 #14520729 未加载
评论 #14519696 未加载
评论 #14519756 未加载
评论 #14520518 未加载
lloyddealmost 8 years ago
Buried in there is &quot;Torch machine learning library&quot;, which then allowed me to figure out what software was being blamed. <a href="http:&#x2F;&#x2F;torch.ch&#x2F;" rel="nofollow">http:&#x2F;&#x2F;torch.ch&#x2F;</a>
评论 #14519647 未加载
matheweisalmost 8 years ago
On most modern Mac OS installations, this is a non-issue. System Integrity Protection doesn&#x27;t honor any changes to LD_LIBRARY_PATH, presumably for exactly this sort of reason. (Of course, one might have turned off SIP, in which case this is no longer true, but it&#x27;s nice to know it&#x27;s the default).
评论 #14520559 未加载
thewisenerdalmost 8 years ago
on a similar note, this (having &#x27;.&#x27; or $(pwd) on LD_LIBRARY_PATH) also broke the `ls` command (and a bunch of other stuff) in the TeamWin Recovery Project (TWRP) recovery on mobile devices when you were in `&#x2F;system&#x2F;lib` on a 64-bit machine.<p><a href="https:&#x2F;&#x2F;github.com&#x2F;omnirom&#x2F;android_bootable_recovery&#x2F;commit&#x2F;9c3b7e990e162319cb379545b458838478a19eb0" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;omnirom&#x2F;android_bootable_recovery&#x2F;commit&#x2F;...</a>
andreiwalmost 8 years ago
you know, that&#x27;s a pretty good plausibly-deniable backdoor, if you think about it...<p>sounds like a pretty good thing to disable in ld.so...
评论 #14519433 未加载
Houshalteralmost 8 years ago
Why is torchs install so weird? Why can&#x27;t it use standard package management, and why does it need to install to my home directory? I&#x27;m not surprised to see it causes security issues.
tebruno99almost 8 years ago
So I&#x27;m less concerned about Torch and more concerned about GNU ld adding things unexpected. This sort of &quot;magic&quot; shouldn&#x27;t occur.
评论 #14530665 未加载
footaalmost 8 years ago
Seems like this may almost have been better done through a disclosure channel with torch?
评论 #14520833 未加载
评论 #14520188 未加载
fslkjhjdfhgj4jalmost 8 years ago
wow! thats a gotcha, trailing : appends $(PWD) to the LD_LIBRARY_PATH<p>Thanks for sharing!
IshKebabalmost 8 years ago
Ha, shitty text-based configuration systems strike again. Ask yourself if this could have happened with Windows 10&#x27;s PATH editor.
评论 #14525134 未加载