Re: [gentoo-hardened] Exploitable Weakness: Shared Memory

> I recently discovered that my Gentoo servers were compromised (despite having
> followed the Gentoo Security Guide's recommendations) when users installed
> root kits in /dev/shm.
>
> Is this a widely-known exploit? If so: Why isn't it addressed in the Gentoo
> Security Guide?

as was said already, it's not an exploit per se, it's a hacking technique
to stay on an already compromised box. /dev/shm is a tmpfs filesystem, you
can check your 'mount' output or /etc/fstab. most likely it isn't mounted
with the noexec (let alone nodev, nosuid, etc) options so it serves as an
ideal hiding place (as in, many people don't think of it as a general
purpose storage place).

as for the actual compromise, did you look through your logs to find out
how they may have gotten in (assuming they didn't clean them up of course)?
also, if you were running hardened, can you look for PaX logs (grep for
'PAX' in your logs)?


--
gentoo-hardened@g.o mailing list