On: Backdoor in upstream xz/liblzma leading to SSH server compromise

[cesarb]

It should be trivial in any language which has AF_UNIX. Last time I looked, Java didn't have it, so the only way was to call into non-Java code.

[fullstop → cesarb]

At first I thought that this surely could not be true as of today, but it looks like it is.

There is AF_UNIX support, but only for streams and not datagrams: https://bugs.openjdk.org/browse/JDK-8297837

What an odd decision. I suppose that you could execute systemd-notify but that's a solution that I would not like.

[ptx → fullstop]

It looks like the FFI (Project Panama) finally landed in Java 22, released a few days ago: https://openjdk.org/jeps/454

Unless that feature also has some weird limitation, you could probably use that to call the socket API in libc.

[cesarb → fullstop]

> I suppose that you could execute systemd-notify but that's a solution that I would not like.

What I did was to use JNA to call sd_notify() in libsystemd.so.0 (when that library exists), which works but obviously does not avoid using libsystemd. I suppose I could have done all the socket calls into glibc by hand, but doing that single call into libsystemd directly was simpler (and it can be expected to exist whenever systemd is being used).

[reftel → cesarb]

Then I suggest you have another look =) https://inside.java/2021/02/03/jep380-unix-domain-sockets-ch...

[fullstop → reftel]

Under Limitations: Datagram support

[reftel → fullstop]

It appears you are correct. What an odd limitation!