Re: [gentoo-hardened] Exploitable Weakness: Shared Memory

[Ed Grimm]

On Fri, 15 Oct 2004, Joshua Brindle wrote:

> How about running 'untrusted' code through any interpreter in your
> trusted path, are you going to somehow prevent interpreters from
> reading anything in non-root owned directories? This is a slippery
> slope and quickly approaches the need for MAC. I repeat, TPE is a
> broken model and should not be relied on for anything.

TPE is not a flawed concept; you have a flawed understanding of it.  For
it to work, yes, you do need to have your interpreters honor it as well.
ld.so shouldn't be in the trusted path, since it can't be trusted.  (I
haven't tried this with kernel-sponsored TPE; I don't know how well that
would work.  I probably won't have time to try it until next year.)

Note that most of the people I've seen talking about TPE had basically
the same understanding you appear to have possessed.  It's the
understanding that one would have if one studied only the first page of
the first document I've read on the topic, or by reading all of most of
the documents I've read on the topic.  (The first document I read on it
was handed to me by the senior admin of my college's computer center.  I
have not found its equal since, and I very much regret having given it
to my roommate at the time, instead of photocopying it.  I suspect that
I also have a flawed understanding, as a result of that mistake.)

Generally, my use of TPE is restricted to a subset of users, who are
given a very strict subset of commands; most of those commands are
either wrappers around normal commands, or they were written to honor
TPE; the remainder are commands like head which are so basic they can't
be exploited without using a commandline that the restricted shell will
block.  They never get telnet, ssh, or any other command that allows
them to go elsewhere; there's too many potentials there.

(Note: it may be permissible to allow some reading by the interpreters
outside of root-owned space, but only for data purposes; any such grants
should be by explicit allows, and should be carefully thought out.  For
example, I've given users in a TPE environment access to read some of my
apache logs, which are in a directory owned by httpd; this directory
mod 3755, the TP settings wouldn't allow writes even if the directory
did.)

> We should not recomment noexec, noexec does nothing at all.

By itself, you're right.  It requires much more work, and most of the
recommendations I've seen for it don't come near the effort required.

Ed

--
gentoo-hardened@g.o mailing list