Re: [gentoo-hardened] Just joined, normallly would lurk, but...

On Tue, 11 Mar 2003, Alain Penders wrote:

> Yes, but:
>
> - "bash -c 'source abc'" still works, and does not require abc to be
>   executable.  Hence, protecting against setting the x bit does not prevent
>   execution.
>
> - All commands needed to compromise the system are already signed and +x'd.

No disagreement on either point.  That's why I thought their idea of signing the executables themselves was cooler.  Their implementation was indeed rather trivial.
It is true the exploitable code is already signed, but normally an exploit is used to bootstrap one's self into the system.  Hard to do if the executable has tightly restricted rights to what operations it can perform, and you can't add executables to the system.

> Overall, this scheme doesn't seem to give any more security than a regular
> tripwire does.  Giving access denied on a chmod() only educates a hacker on
> what does and does not work, and all he has to do is figure out how to
> compromise the system to the point where he can safely replace executables.
>
> All you can do while he's doing that is read log files and hope you'll catch
> the failed attempts he might have made.
>
> Very similar to tripwire, where a cracker would have to jump through the same
> hoops to avoid detection.... and the detection process isn't any faster.

Yep.  Tripwire makes one jump through a lot of hoops, but unless you're the sort of person who carries an MD5 sum of the tripwire executable on your person at all times, you can still be compromised...

> From what I understand, SELinux and the new security framework in the 2.5
> kernels do a waaaaay better job at detecting all the various things one can
> screw with, and actually stopping crackers.

*That* sounds much more promising.  If people are already building this into the kernel then I guess there's no point in my trying to do it myself :-)

I take it gentoo will simply use the 2.5 security framework?


--
gentoo-hardened@g.o mailing list