Re: [gentoo-hardened] Exploitable Weakness: Shared Memory

> > as was said already, it's not an exploit per se, it's a hacking technique
> > to stay on an already compromised box. /dev/shm is a tmpfs filesystem, you
> > can check your 'mount' output or /etc/fstab. most likely it isn't mounted
> > with the noexec (let alone nodev, nosuid, etc) options so it serves as an
> > ideal hiding place (as in, many people don't think of it as a general
> > purpose storage place).
>
> on that note, is there any reason to not mount /dev/shm by default with all
> these options you listed ?

honestly, i don't know, but you can just try it and see what breaks.
however if you want to turn 'noexec' mounts into a securing method
then you'll have to revamp the filesystems completely, not unlike how
PaX does it with memory access control: separate the writable (by a
potential attacker) filesystems from the executable ones (i.e., those
mounted without noexec). of course this gives you a very coarse grained
control over what the user can execute vs. write to, if you need more
then you'll need some kind of access control mechanism, there's a few
of them in the hardened subproject, choose one that fits your
requirements best (based on granularity vs. usability vs. whatever
you care about).


--
gentoo-hardened@g.o mailing list