On Fri, 17 Sep 2010 13:49:49 +0200, Karel Klic wrote:
If you trust the retrace server provider, there should be no
security problem. It's a weakness of the retrace server idea, that
you must trust the provider, but that might be acceptable in many
environments.
So this seems to be a potential blocker, which must be decided
before anything else. Any idea how to resolve this?
components 1/2/3 vvv
1 2 3
core <-> gdb <-> debuginfos
A B
interfaces A/B ^^^
Component gdb(1) comes from the client.
Component debuginfos(3) comes from the distribution.
How to connect them? There are boundaries A and B, transfer can be:
A - full - Full upload of core file to the server.
A - partial - access the core file over NFS / neon etc.
In fact (modified) gdbserver could be be also used for it:
core <-> gdbserver <-> gdb <-> debuginfos
B - full - debuginfo-install (or its download in general)
B - partial - debuginfofs.
core(1) accessed arbitrarily by the server is insecure.
gdb(2) run on the server is insecure because core(1).
debuginfo(3) can be provided in a secure way to the client.
Now we can create all the possible setups depending on which components we
do trust / we do not trust - I do not see this clearly specified in advance.
Thanks,
Jan