Date: Tue, 01 Jan 2019 12:07:17 +0100 From: nisse@...ator.liu.se (Niels Möller) To: Jeffrey Walton <noloader@...il.com> Cc: oss-security@...ts.openwall.com, gmp-bugs@...lib.org Subject: Re: Asserts considered harmful (or GMP spills its sensitive information) Jeffrey Walton <noloader@...il.com> writes: > The GMP library uses asserts to crash a program at runtime when > presented with data it did not expect. The library also ignores user > requests to remove asserts using Posix's -DNDEBUG. Posix asserts are a > deugging aide intended for developement, and using them in production > software ranges from questionable to insecure. Crashing in a controlled fashion may also be *more* secure that continuing execution with undefined results. Depending on circumstances, of course. I read the general statement "asserts considered harmful" as your personal opionion, likely based on experience with very different development projects than I'm involved with. And gmp-bugs isn't really the right place for that debate (and neither is the nettle mailinglist). > Second, the SIGABRT terminates the process and can write a core file. A security sensitive application can easily disable generation of core files, using setrlimit (on the linux kernel, prctl may also be useful). That's all part of crashing in a *controlled* fashion on assertion failures. As far as I'm aware, disabling core dumps is a fairly common practice in security sensitive applications. (And besides, most systems have zero ulimit -c as the system default these days. Which makes sense to me (any application might handle data that is sensitive to the user), even though as a developer, it's annoying with extra hoops required to get proper core dumps, including disabling the core dump collection "services" you mention). And as Vincent says, there are many ways to crash due to bugs, without triggering any assertion failure. And you should avoid generating core dumps for those crashes too. Regards, /Niels -- Niels Möller. PGP-encrypted email is preferred. Keyid 368C6677. Internet email is subject to wholesale government surveillance.
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.