Re: Ghostscript / ImageMagick / GraphicsMagick vulnerability mitigation?

[Ludovic Courtès]

Hello Leo,

Leo Famulari <address@hidden> skribis:

> For the last couple years, people have been finding exploitable bugs in
> the image processing system based on Ghostscript and ImageMagick /
> GraphicsMagick:
>
> http://seclists.org/oss-sec/2018/q3/142
> http://seclists.org/oss-sec/2016/q4/29

In this week’s discussions, it’s unclear to me why people are focusing
so much on ImageMagick and Evince when the real issue is in
Ghostscript’s ability to run arbitrary commands from PostScript code.  I
rarely run ‘convert’ on PS files, but I do run ‘gs’ from different
sources: gv, Emacs Docview, Evince, ps2pdf, etc.

So I was wondering if we could arrange to provide a wrapper around ‘gs’
that would run it in a container that can only access its input and
output files, plus font files from the store.  Now I wonder if I’m too
naive and if this would in practice require more work.

Thoughts?

There are a few applications that use libgs directly though, and these
would have to be treated separately.

> Despite these issues, these programs are still the best way to achieve
> some common image processing goals, so we have to think about how to
> make them safer.
>
> The primary recommendation seems to be setting a restrictive security
> policy in ImageMagick's policy.xml file, as described in the discussions
> linked above.
>
> Currently, Guix doesn't "set up" ImageMagick at all upon installation,
> which is different from some other systems like Debian and Fedora and
> their cousins, where the vulnerabilities are more dire [0]. Our
> ImageMagick package includes the default, unrestricted policy.xml.
>
> But, I'm wondering if anyone is using these tools in production from
> Guix and, if so, how they do it, and if they would like us to ship a
> non-default, more restrictive policy.xml in our package. And if so,
> could they write the policy.xml? :)

I agree that it would be good to provide a policy.xml somehow. On
GuixSD, we could provide it by default for new accounts (as a Shadow
“skeleton”.)

Thanks,
Ludo’.