Re: [gentoo-hardened] Ports Security

[Joshua Brindle]

based on the openbsd page you pasted, and my own intuitions i'll
just say this isn't ever going to be done. There is no reason to 
add this kind of checking into the user side of portage. The ports
security page is an outline of how ports should act, ie: how they 
should be developed, before they ever reach the user. This is the
correct place to do this sort of checking, the user side is a great 
place to add ssp, et_dyn, etc but as far as security checks go, 
correcting the install paths, etc, the ebuilds do this already
and anytime there is a necessary change in a Makefile or 
whatever the ebuild does this, this is _NOT_ a user feature and 
never will be one.

this _IS_ however a developer feature, we do have repoman for
ebuilds but it's checks are limited. If someone were willing to write
something that could do extensive checking on the whole build
process that would be welcomed, and maybe a set of regression
tests targeted at especially sensitive packages.

Joshua Brindle

>>> Jan Krueger <jk@×××××××××××.net> 09/05/03 03:25PM >>>
On Friday 05 September 2003 18:02, Alexander Gabert wrote:
> yeah,
>
> we should think about source-parsing function pointer bounds checkers
> and formatstring checkers to round up our efforts in respect to the
> linear overflow protection provided by the propolice support (SSP) and
> the process randomization of dynamic PIC binaries by PaX.
>
> if you want we can discuss it in the channel #gentoo-hardened on
I prefer discussion here, because it is searchable/grepable afterwards.

> freenode what solutions are available currently and how hard it would be
> to update portage (similar approach like the antivirus scanning prep'd
> by solar some time ago)

So far i came to the conclusion that this should be a portage FEATURE,
with configuration option in make.conf, like which scans do i want, how deep 
or so, break ebuild or not, scanner options.
Like that:

after src_unpack(), if feature is set, portage scans the source code, informs 
the user and at the users will, depending on the scan-results, breaks the 
ebuild or continues.

than src_compile

after src_install the files in the image which is to transfer to the real 
filesystem, is, before the transfer scanned for other things, (viri, trojans, 
suids, whatever), reports the results and at the users will, depending on the 
scan-results, breaks the ebuild or continues.

I know about the following source code scanners, almost restricted to c and 
c++:
flawfinder, http://www.dwheeler.com/flawfinder/ 
splint, http://www.splint.org/ 
its4, http://www.cigital.com/its4/ 
rats, http://www.securesw.com/download_form_rats.htm 

Anyway, is there a policy like http://www.openbsd.org/porting.html#Security? 

Jan


--
gentoo-hardened@g.o mailing list


--
gentoo-hardened@g.o mailing list