1 |
Without hardened userland only in access controls. You can implement |
2 |
for example one Trusted Path Execution with LIDS, RSBAC, GRSEC or |
3 |
SELinux. They could try to stop crackers that gain unpriviledge access |
4 |
to the host (with a remote exploit for example) to execute exploits to |
5 |
scale priviledges. They could give you one least priviledge approach |
6 |
(as PaX does) and other useful things, as isolation of daemons, |
7 |
resources controls. And a lot of more. With TPE however, untrusted |
8 |
scripts (exploits) could be launched without execution rights, and |
9 |
even restricting the use of perl and python, you must grant your users |
10 |
the access to bash. |
11 |
|
12 |
2008/12/26 Grant <emailgrant@×××××.com>: |
13 |
>> In terms of userland, non hardened profile doesn't protect you at all |
14 |
>> against buffer overflows, you are removing one important security |
15 |
>> layer. SSP protects you against buffer overflows in terms that the |
16 |
>> vulnerable application gets killed when the canary is modified before |
17 |
>> the execution of the arbitrary code. PIE protects you against return |
18 |
>> into libc attacks that doesn't need an executable stack. PaX is not |
19 |
>> perfect and needs them as complementary solutions. For example I think |
20 |
>> that RANDEXEC was removed from PaX time ago, one buffer overflow that |
21 |
>> uses return into libc attack could be succesfully against one |
22 |
>> non-hardened binary. Since skype is a network oriented software... |
23 |
> |
24 |
> In what situations is a hardened kernel useful? |
25 |
> |
26 |
> - Grant |
27 |
> |
28 |
> |
29 |
>>>> Hardened profiles: Yes there's a difference, no you should not switch to |
30 |
>>>> hardened/linux/${ARCH} at this time. |
31 |
>>> |
32 |
>>> Is hardened/x86/2.6 still available for new installations? My other |
33 |
>>> systems are amd64 but none of them list hardened/amd64/2.6. |
34 |
>>> |
35 |
>>>> You can get skype working by downloading or building gcc 4.1.x and pointing |
36 |
>>>> LD_LIBRARY_PATH at the shared object directory when starting skype. skype |
37 |
>>>> won't be using hardened toolchain but since its closed source and you're |
38 |
>>>> willing to switch the whole machine to non-hardened I figure you probably |
39 |
>>>> don't mind. ;) |
40 |
>>>> |
41 |
>>>> Example: |
42 |
>>>> 1. Download |
43 |
>>>> http://tinderbox.dev.gentoo.org/default-linux/x86/sys-devel/gcc-4.1.2.tbz2 |
44 |
>>>> 2. unpack the archive to ${HOME}/tinderbox-pkgs/sys-devel/gcc/ |
45 |
>>>> 3. Run it: |
46 |
>>>> LD_LIBRARY_PATH="${HOME}/tinderbox-pkgs/sys-devel/gcc/usr/lib/gcc/i686-pc-linux-gnu/4.1.2/" |
47 |
>>>> skype |
48 |
>>>> |
49 |
>>>> If you only require VoIP capability and not skype specifically you might be |
50 |
>>>> interested net-im/ekiga. |
51 |
>>> |
52 |
>>> Thank you very much for that, but I'm trying to simplify. You see, |
53 |
>>> I'm only a fake sysadmin. Does using a hardened kernel with a |
54 |
>>> non-hardened profile still offer good protection? |
55 |
>>> |
56 |
>>> - Grant |
57 |
>>> |
58 |
>>>>> > I've been able to do so; basically I switched over to the standard |
59 |
>>>>> > profile, disabled selinux in the kernel, and re-emerged system for new |
60 |
>>>>> > use flags. There were some other details but overall the process was |
61 |
>>>>> > pretty painless, anyone ambitious enough to configure a hardened system |
62 |
>>>>> > can probably handle the switch without much problem. Not that I'm |
63 |
>>>>> > encouraging you to drop hardened (especially on a laptop that could be |
64 |
>>>>> > exposed to random wifi networks ;-) |
65 |
>>>>> |
66 |
>>>>> Is there any difference between 1 and 8 here? Should I switch to 8? |
67 |
>>>>> |
68 |
>>>>> # eselect profile list |
69 |
>>>>> Available profile symlink targets: |
70 |
>>>>> [1] hardened/x86/2.6 * |
71 |
>>>>> [2] selinux/2007.0/x86 |
72 |
>>>>> [3] selinux/2007.0/x86/hardened |
73 |
>>>>> [4] default/linux/x86/2008.0 |
74 |
>>>>> [5] default/linux/x86/2008.0/desktop |
75 |
>>>>> [6] default/linux/x86/2008.0/developer |
76 |
>>>>> [7] default/linux/x86/2008.0/server |
77 |
>>>>> [8] hardened/linux/x86 |
78 |
>>>>> |
79 |
>>>>> - Grant |
80 |
>>>>> |
81 |
>>>>> >> Can I switch my laptop's profile from a hardened one to a non-hardened |
82 |
>>>>> >> one? I thought this was impossible without a complete reinstall but |
83 |
>>>>> >> folks on the gentoo-user list seem to think it's not a problem. |
84 |
>>>>> >> |
85 |
>>>>> >> - Grant |
86 |
> |
87 |
> |