Re: [gentoo-hardened] Will perl or php scripts run in enforcing mode in the hardened gentoo environment "out of the box?"

[Joshua Brindle]

On Tue, 2005-04-12 at 09:58 +0300, petre rodan wrote:
> I did reply to your question a few hours back :/
>
> Jon Howard wrote:
> > Hello,
> >   I have a Gentoo SE system up and running as per the handbook(X86),
> > but I cannot get apache to execute cgi's in enforcing mode(the test ones
> > that come with apache).  The scripts do work in permissive.   Before I
> > got started in examing the apache.te file, I was wondering if I might
> > have an apache configuration issue.  I guess the first question that I
> > have is whether perl or php scripts run in enforcing mode in the
> > hardened gentoo environment "out of the box?"  I installed the perl and
> > php mods for apache, and changed the startup to include the -D option
> > for these, but in studying the SE model, I was afraid that some other
> > method for executing scripts might be in play.   I removed the mods from
> > the -D statup option, but I am still getting the same results.  So, will
> > it or won't it is my question.
>
> won't is the short answer. the long answer has been in your inbox when you wrote to the list.
> the short conclusion is that some cgi scripts need a kitchen sink to be allowed. it's up to the user to allow it or not.
>

A good solution to this was something I was working on a while back with
fastcgi. Basically rather than using mod_perl, mod_php and so on you'd
use the cgi versions and use fastcgi. Fastcgi then, would read the
context of the script being run (much like it does for UID already) and
calculate a type transition for that script. It would then transition to
that domain and run the script. This would effectively sandbox users
cgi's, php, perl, etc from one another while also limiting it further
from what apache has access to.

Sadly I never finished this and don't really have time to work on it
anymore. 

Joshua

--
gentoo-hardened@g.o mailing list