[gentoo-hardened] Re: Hardened with 1 user and 0 services?

[7v5w7go9ub0o]

Marcel Meyer wrote:
> Am Sonntag, 24. Februar 2008 schrieb 7v5w7go9ub0o:
>> The hardened toolchain'll protect you outright against some types of
>> memory attacks; GRSEC'll provide additional PAX protections; putting
>> net-clients into the much-harder jails provided by some hardened kernels
>> (e.g. grsecurity) will confine damage (e.g. my browsers, mail clients,
>> media players, chat client, ooffice, etc. are each in their own
>> hardened-chroot jail), plus RBAC will stop a browser that suddenly
>> decides to browse about the box (well, within the jail :-) ) looking for
>> information, or trying to effect changes.
> Did you (or anybody else here) already set up some chroot/jail/other
> restrictions for a browser like Konqueror with grsec/RSBAC?

Haven't done Konqueror; I do have Opera and FireFox in individual jails.

How does it
> look like?

I have a directory /jail that contains sub directories; each a jailed
application. Most of the time, I simply cd to the application directory
and start the jail. In the cases of opera, thunderbird, and firefox, I
copy the individual jail into ram disk first, and then start the jail in
ramdisk (this so that any changes other than bookmarks, mail, etc. are
automatically discarded)

It's hard for me to image what to restrict without dramatically
> cut down the usefullness of the program.

It is NOT as convenient as it was, but remains fully useful;
e.g. if you want to jump to a link in thunderbird (mail client), you
need to rt-click copy the link and then ctr-click paste it onto the
opened browser window. Cumbersome at first, it becomes second nature
after a while.

There is probably a way to use X to safely allow a one-way connection 
from the tbird jail to the browser jail for the purpose of links, but I 
haven't figured it out yet (low priority - but would be useful).

Another alternative is  to put your browser into the same jail as the 
mail client - problem there is that I keep account information, personal 
scheduling information, mailing lists, etc. in my mail client, so I 
don't want that information anywhere near my browser which might be 
compromised.

And how to deal with spontaneous
> exceptions to the rules (like limiting to ports 80 and 443 and then wanting
> to contact port 8080).

Exactly right..... some web page'll have 8080 or some other http port,
and RBAC will block it. I use multitail to monitor the syslog, and
whenever grsec entries occur, I pop up an xmessage window with a copy of
the log message (which are pretty good at describing what was blocked). 
You then edit the RBAC policy file to allow that port (or not). After a 
while, you get the RBAC rules set up and the popups subside.

HTH




-- 
gentoo-hardened@l.g.o mailing list