Re: [gentoo-hardened] Re: Mini Gentoo in VMWare

[7v5w7go9ub0o]

On Mon, 06 Nov 2006 12:11:44 -0500, Longman, Bill <longman@×××××××××.com>  
wrote:

>> Well, this gets at my original musing...... are you really
>> safer with a
>> grsecurity-hardened-chrooted VMware application (with root
>> privileges,
>> that uses at least some of the host's kernel) or a
>> grsecurity-hardened-chrooted program with no privilege and only the
>> additional executables necessary to keep it running.
>>
>> And if the answer is yes, are you significantly safer?
>>
>> In one sense there'd be a thicker layer between the host and
>> the server,
>> but in another sense the added complexity and root host
>> privilege may add
>> vulnerabilities?
>>
>> (Sorry if this is foolish...... the answer seems less than obvious)
>
> Well, let's say the uberhackers crack your box and rm -r /*. How much is
> your time worth rebuilding from scratch? If the VM has been cloned, you
> just
> restart with the old VM. Takes about 12 seconds.
>
> Within that VM, you still have the option to run a hardened kernel or
> just
> chroot your services.
>
> The security angle is still a function of the inherent security of the
> service. If your creaky FTP server hasn't been patched in two years,
> that's
> probably the weakest link. If the OS affords a buffer overrun to occur,
> that's a more generic solution to ANY process on the system. Finally,
> it's a
> probability calculation between these factors. If your service is widely
> accessible, it's going to get hit more often than a protected one.
>
> At the ultimate step, the uberhackers 0wn your box. Will they be able to
> crack their way out of a process that provides them their OS? It's easy
> to
> detect that you're living inside a VMWare VM, but why would you care?
> Why is
> the REAL OS any better?

THANK YOU for replying....... I'm over my head here.

So as a case in point, consider Snort and presume that it has a backdoor  
(no overflow required)...

I run it as user snort which is unprivileged and does one thing - runs  
snort in a hardened jail.

/jail/snort/bin contains:

total 1704
drwxr-xr-x  2 root root   4096 Sep  3 16:06 ./
drwxr-xr-x 10 root root   4096 Sep  3 16:06 ../
-rwxr-xr-x  1 root root 861372 Sep  3 16:06 bash*
-rwxr-xr-x  1 root root 861372 Sep  3 16:06 sh*

There is no root user or group defined within the jail. So IIUC, to do  
what you suggested, he would use a backdoor to get to sh from snort, and  
then change to user root, assume root privilege, break out of the jail,  
and then be free to run rm? (presuming also that RBAC would allow root to  
rm the box).

OTOH, if I ran Snort within a VM (within a hardened jail), my jail would  
be running VM with root privileges, and if he cracked the VM, he'd already  
have root privileges?

So I guess we're presuming that the risk of running VMWARE with user  
"root" is more than compensated for by the robustness of the VMware player?

The other question has to do with VMware server vs player. I'd guess that  
one constructs his "appliance" with the server, and then plays it with the  
(smaller) player?

TIA, Newbie

-- 
gentoo-hardened@g.o mailing list