Date: Sat, 20 Jun 2015 19:18:57 +0100 From: Nick Boyce <nick.boyce@...il.com> To: oss-security@...ts.openwall.com Subject: Re: CVE-2015-3243 rsyslog: some log files are created world-readable [hopefully non-OT post of possibly questionable value, coming as it does from a relatively Un*x-naive refugee from the land of mainframes ] On 18 June 2015 at 18:56, Kurt Seifried <kseifried@...hat.com> wrote: > > So /var/log/cron is world readable in RHEL7 > which means the complete command line is > logged (so --password=, hostnames, etc.). > > In line with this I have made the following > proposed change for Fedora (and by > extensions Red Hat products): [...] > All configuration files (e.g. files in /etc/) and all > log files (e.g. files in /var/log/) must not be set > world-readable unless there is a functional > reason to do so. Basically +million ... I've always been faintly horrified by how much of the Un*x system configuration detail is readable by just about any user of the system, though I accept that my opinion is compromised by my industrial upbringing, and also that security-through-obscurity is, um ..... I queried this situation a long time ago for Debian  (locking down hosts.allow caused problems), and asked similar questions of the manufacturer's tech support personnel for both Digital Unix and HPUX - but in the fluffy world of Un*x, where by default the user was considered non-adversarial (and in the case of workstations was usually the owner of the system anyway), nobody was very interested. Authorisation tokens are not the only relevant sensitive content - this list knows that all kinds of data can be useful to an attacker, but Back In The Day paranoia levels were low. I'd really like to see this situation revisited (perhaps now is a better moment), but clearly the codebase would need a lot of scrutiny for potential consequent problems.  No, not IBM mainframes - proper mainframes :-) https://en.wikipedia.org/wiki/ICL_VME Here, mandatory access control pervaded the whole system, and user accounts were only ever given any access to a resource if they absolutely needed it. This operating system actually achieved Common Criteria certification (in the early '90s).  https://lists.debian.org/debian-security/2002/08/msg00356.html Cheers, Nick
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ