unstable-book: split sanitizers into testing and production ones

[disconnect3d]

The Rust Unstable Book lists compiler sanitizers that can be used in Rust programs. However, it does not say whether it is okay to use certain sanitizers on production or not, which may suggest that its okay to do so.

I believe that none of ASAN/TSAN/MSAN/LeakSAN should be used on production.

There was an old thread on oss-security that provided more details here: https://www.openwall.com/lists/oss-security/2016/02/17/9 but one example to not use those sanitizers on production is the fact that some of them use environment variables that control things like "path to the binary that will be used to get the symbol names for stack traces". As a result, if a sanitized binary has suid, an attacker can use the specific environment variable to run their own program and escalate their privileges this way.

[rustbot]

Thanks for the pull request, and welcome! The Rust team is excited to review your changes, and you should hear from @GuillaumeGomez (or someone else) soon.

Please see the contribution instructions for more information. Namely, in order to ensure the minimum review times lag, PR authors and assigned reviewers should ensure that the review label (S-waiting-on-review and S-waiting-on-author) stays updated, invoking these commands when appropriate:

• @rustbot author: the review is finished, PR author should check the comments and take action accordingly
• @rustbot review: the author is ready for a review, this PR will be queued again in the reviewer's queue

[GuillaumeGomez]

r? rust-lang/compiler

[Noratrieb]

Thanks, adding some disambiguation is great! I think this is correct but I'm not entirely sure, I'd rather let someone who knows more about this approve it.
r? compiler

[eholk]

This change is probably fine, although I think it might be a little out of scope for the Rust Unstable Book. It seems reasonable for us to say "these are sanitizers you can use" and direct people to further documentation on those sanitizers to evaluate whether it makes sense to use it in production or just testing.

[disconnect3d]

Maybe we should have then a sentence or two at the beginning explaining what a sanitizer is, that would explain something along the lines that they are compiler plugins which enable additional instrumentation of the code that may be useful for testing/security testing and sometimes for production, depending on the sanitizer.

[apiraino]

I am personally in favor of a little bit or verbiage (maybe with a link?) explaining what a sanitizer is.

@disconnect3d can you update this patch with a proposal?

[eholk]

Marking this as waiting on author so @disconnect3d can resolve conflicts and add a small note about what a sanitizer is.

@rustbot author

[Dylan-DPC]

@disconnect3d any updates on this? thanks

[disconnect3d]

@apiraino @eholk @Dylan-DPC Updated!

[apiraino]

thanks @disconnect3d . As mentioned in a previous comment, I'll switch to waiting on a review to signal that this PR is ready for a review.

(For the record, merge commits are not allowed in PRs -- see https://rustc-dev-guide.rust-lang.org/git.html#no-merge-policy)

@rustbot review

[Dylan-DPC]

@disconnect3d can you remove the merge commit and rebase instead? After that we will get it reviewed

[JohnCSimon]

@disconnect3d
Ping from triage: I'm closing this due to inactivity, Please reopen when you are ready to continue with this.
Note: if you are going to continue please open the PR BEFORE you push to it, else you won't be able to reopen - this is a quirk of github.
Thanks for your contribution.

@rustbot label: +S-inactive

[disconnect3d]

@JohnCSimon just to be sure, how do I reopen this?

[JohnCSimon]

@disconnect3d

I clicked "reopen pull request"

[oskgo]

It seems like these changes were merged in #121195, so I'll close this.
Thanks for your contribution.