cpach

FWIW, you might want to consider publishing your e-mail address in your HN profile or on your website. Otherwise it’s hard for people to get in touch with you.

Why does it matter?

Direct link to Hoot: https://spritely.institute/hoot/

Brother HL-L2350DW (monochrome). Those things are very reliable.

dupe: https://news.ycombinator.com/item?id=48660159

See also https://news.ycombinator.com/item?id=48660159 (1 comment so far)

Why is this on the front page? :)

Feel free to launch your own CA.

Interesting!

Reading, writing, cooking, child-rearing.

What’s the performance when you do that?

Dupe: https://news.ycombinator.com/item?id=48265498

Uhm… cryptography or cryptocurrency?

For those who can I would recommend upgrading to Wireguard.

If it was for personal use, surely there would be some kind of consumer organization or ombudsman one could contact for advice?

For B2B, I guess the local chamber of commerce might be able to advice.

Same here, zero plugins for me.

Regarding su…

  su -

Does anyone know how to mitigate this one? Is it sufficient to disable the esp4/esp6/rxrpc modules?

Main discussion here: https://news.ycombinator.com/item?id=48058393

Welcome to Hacker News! Please write in English here. Thank you in advance from a long-time member :)

No, I haven’t.

My concern is to try to understand the mechanisms of the exploit.

Copy Fail is not simply ”hey, kernel, give me root”. I would say it’s more general than that. It’s rather: ”Hey, kernel, when you present file /foo to a process, make the contents of that file appear according to my wishes”. Which can be used (in various ways) to advance the attacker’s position.

That’s why I think it’s interesting to ponder if that power allows the attacker to simply sneak past security policies such as allowPrivilegeEscalation=false.

Many? No, I don’t agree.

Sure. But it would probably still be a good thing if the kernel maintainers could tear out AF_ALG.

That might make Copy Fail harder to exploit, but I still wouldn’t bet money on CF being impossible to use in that scenario.

How does allowPrivilegeEscalation=False help?

If so, I would look into applying a decent seccomp profile.

Other hardening solutions could be to run the workloads inside of a VM such as Firecracker, or gVisor. But that might be more work to implement compared to seccomp.

How?

I would say any sanely written application would fall back to doing the requested operations in userspace if it cannot use the AF_ALG socket.

It could fail though. But I have not yet heard of anyone noticing big problems due to disabling the problematic modules. And I have not noticed any such issues on our systems at ${DAYJOB}.

IMHO, since these parts of the Linux kernel are so crappy I personally would say disabling them is a good default choice. YMMV. But if you encounter problems, then you can always re-enable the modules. (Preferably after upgrading your kernel, obviously.)

Good enough for what?

I could be wrong, but I’m not sure those settings are enough to mitigate Copy Fail.

If your distro offers a patched kernel, it’s best to upgrade to that one and reboot.

You can also disable the vulnerable module (how to do it depends on what distro you’re using). But if you stay on an old unpatched kernel you might be exposed to other vulnerabilites.

Well at least if it’s crufty stuff like AF_ALG that barely no-one is using and is kind of a forgotten place of the kernel.

I don’t oppose reasonable crypto in the kernel, like WireGuard.