TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

Surprising Consequences of macOS’s Environment Variable Sanitization

95 点作者 ash超过 2 年前

7 条评论

docfort超过 2 年前
It’s definitely surprising that macOS does this, but it makes me also wonder if the authors considered just modifying the binary so that the dynamic linker could find the library: <a href="https:&#x2F;&#x2F;www.joyfulbikeshedding.com&#x2F;blog&#x2F;2021-01-13-alternative-to-macos-dyld-library-path.html" rel="nofollow">https:&#x2F;&#x2F;www.joyfulbikeshedding.com&#x2F;blog&#x2F;2021-01-13-alternati...</a>
评论 #34336127 未加载
rwmj超过 2 年前
As a developer I really dislike this security feature of macOS. We have a whole system for running binaries from the build directory (ie. without installing) which relies on environment variables including DYLD_*, and it works everywhere except macOS. Unless you do some scary-looking changes to the system at boot time.<p>(If I used macOS for anything other than ssh-ing in for development, I&#x27;d probably appreciate it, especially if running $random stuff).
评论 #34338603 未加载
评论 #34338901 未加载
throwaway09223超过 2 年前
The author writes that this kind of ad-hoc breakage of system interfaces is a &quot;good thing in general&quot; but it absolutely is not. I&#x27;ve dealt with this kind of lazy, reactionary response to security extensively. It&#x27;s pernicious and becomes incredibly destructive at scale.<p>Interfaces must be simple and consistent. Inconsistencies make systems dramatically more difficult to use -- but it&#x27;s notoriously hard to measure the cost of system complexity and the countervailing pitch to confound simplicity is very straightforward: &quot;Bad guys did this thing. This is a rarely used thing. Let&#x27;s break this thing.&quot;<p>As this blog illustrates, it is now prohibitively difficult to explain or predict how environment propagates in OSX. There is a dramatic increase in the likelihood of bugs. It would be better to simply delete the functionality of DYLD_LIBRARY_PATH from the dynamic linker. Of course, we can&#x27;t do that because DYLD_LIBRARY_PATH exists for an important reason -- but that important reason is also why DYLD_LIBRARY_PATH&#x27;s functionality should be protected and not capriciously broken in this fashion.<p>This kind of approach to security will always result in fragile, buggy systems in the long term. It will also undermine developer comfort, ultimately reducing the number of people willing to develop software for a platform (one straw among many, but they add up and eventually there&#x27;s a final straw)<p>Are attackers really going to be deterred by destroying the convenience of setting environments in shells? Of course not. Figuring out how to set environment without using Apple&#x27;s broken userland is a trivial task. So what&#x27;s the point?
smcameron超过 2 年前
I wonder if you could write a LD_PRELOAD library that overrides setenv() (or whatever is used to sanitize the environment) calling the real setenv found via dlsym(RTLD_NEXT, &quot;setenv&quot;) in most cases but suppressing the sanitizing of DYLD_LIBRARY_PATH, then run a shell with this library preloaded and Bob&#x27;s your uncle. Would be kind of gross, and if you legit needed to clear DYLD_LIBRARY_PATH, you&#x27;d be out of luck.
评论 #34338262 未加载
评论 #34339530 未加载
alpb超过 2 年前
I am not sure why this person has not considered wrapping every command in &#x2F;usr&#x2F;bin&#x2F;env? Regardless of the shell, env(1) would preserve that variable and do an execve.
评论 #34336143 未加载
chriswarbo超过 2 年前
The underlying problem (as is often the case) is using references&#x2F;names (like &#x2F;bin&#x2F;sh) without defining them.<p>FYI the GNU Make in Nixpkgs doesn&#x27;t have this problem, since it patches the reference <a href="https:&#x2F;&#x2F;github.com&#x2F;NixOS&#x2F;nixpkgs&#x2F;blob&#x2F;nixos-22.11&#x2F;pkgs&#x2F;development&#x2F;tools&#x2F;build-managers&#x2F;gnumake&#x2F;0001-No-impure-bin-sh.patch">https:&#x2F;&#x2F;github.com&#x2F;NixOS&#x2F;nixpkgs&#x2F;blob&#x2F;nixos-22.11&#x2F;pkgs&#x2F;devel...</a><p>Nixpkgs also provides wrappers&#x2F;shims around Python, etc. but is also patches all #! lines to hard-code the exact paths of specific binaries (e.g. `#!&#x2F;nix&#x2F;store&#x2F;iffl6dlplhv22i2xy7n1w51a5r631kmi-bash-5.1-p16&#x2F;bin&#x2F;bash`) <a href="https:&#x2F;&#x2F;github.com&#x2F;NixOS&#x2F;nixpkgs&#x2F;blob&#x2F;master&#x2F;pkgs&#x2F;build-support&#x2F;setup-hooks&#x2F;patch-shebangs.sh">https:&#x2F;&#x2F;github.com&#x2F;NixOS&#x2F;nixpkgs&#x2F;blob&#x2F;master&#x2F;pkgs&#x2F;build-supp...</a>
评论 #34343418 未加载
emmelaich超过 2 年前
It should be possible to avoid problems with dynamic linking with judicious choice of $ORIGIN at compilation time.