[BUG] writing file outside “/etc/opensnitchd/rules” as root

[tititototutu]

Bonjour,

opensnitchd -check-requirements                                                               
                                               
        Checking system requirements for kernel version 6.12.1-arch1-1                                                 
------------------------------------------------------------------------------                                         
                                               
        Checking => CONFIG_KPROBES=y      
        Checking => CONFIG_KPROBES_ON_FTRACE=y 
        Checking => CONFIG_HAVE_KPROBES=y
        Checking => CONFIG_HAVE_KPROBES_ON_FTRACE=y                                            
        Checking => CONFIG_KPROBE_EVENTS=y
                                                                                               
        * kprobes        ✔
                                                                                               
        Checking => CONFIG_UPROBES=y                                                           
        Checking => CONFIG_UPROBE_EVENTS=y  
                                               
        * uprobes        ✔           
                                               
        Checking => CONFIG_FTRACE=y                                                                                                                                                           
                                               
        * ftrace         ✔                                                                     
                                               
        Checking => CONFIG_HAVE_SYSCALL_TRACEPOINTS=y                                          
        Checking => CONFIG_FTRACE_SYSCALLS=y   
                                                                                                                                                                                              
        * syscalls       ✔                                                                     
                                                                                               
        Checking => CONFIG_NETFILTER_NETLINK_QUEUE=[my]                                                                
        Checking => CONFIG_NFT_QUEUE=[my]
        Checking => CONFIG_NETFILTER_XT_TARGET_NFQUEUE=[my]                                                            
                                                                                               
        * nfqueue        ✔                                                                     
                                               
        Checking => CONFIG_NETFILTER_NETLINK=[my]                     
        Checking => CONFIG_NETFILTER_NETLINK_QUEUE=[my]                                        
        Checking => CONFIG_NETFILTER_NETLINK_ACCT=[my]                                                                 
                                               
        * netlink        ✔                    

        Checking => CONFIG_INET_DIAG=[my]                  
        Checking => CONFIG_INET_TCP_DIAG=[my]              
        Checking => CONFIG_INET_UDP_DIAG=[my]              
        Checking => CONFIG_INET_DIAG_DESTROY=[my]                                                                      

        * net diagnostics        ✔

• OpenSnitch version: 1.6.6
• OS: ArchLinux
• Window Manager: Gnome

Via the UI rules editing interface, it is possible to write files outside the “/etc/opensnitchd/rules” directory (local and remote nodes)

if the rule name is of the form ../../../../../tmp/outsisde

A picture would be more telling:

My 20cents... and Thank you for your project!
Vincent

[gustavo-iniguez-goya]

Hi @tititototutu , thank you very much for this warning!

It was "fixed" here 25e9268, but I'm not sure if it'll be enough to address this and other cases. I'll test more cases and release a new GUI version.

[tititototutu]

Salut,

A solution seems to be to use the os.path.normpath function:

• https://docs.python.org/2/library/os.path.html#os.path.normpath
• https://qwiet.ai/preventing-directory-traversal-attacks-best-practices-for-file-handling/

[gustavo-iniguez-goya]

thank you @tititototutu !

I'll take that into account.

If I'm not wrong, 'opensnitch' AUR package doesn't contain latest (3) changes from the 1.6.0 branch. With the mentioned commit, at least from the GUI you can't type nor paste '/' in the text field.

[tititototutu]

Hi Gustavo,

ah sorry.... :)

thanks again to the OpenSnitch team!