[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 16 Mar 2011 02:07:18 +0300
From: Solar Designer <solar@...nwall.com>
To: owl-dev@...ts.openwall.com
Subject: Re: tcpdump vagaries
RB, Dmitry -
This is in addition to Dmitry's response.
On Fri, Mar 11, 2011 at 06:40:31AM -0800, RB wrote:
> As sent to Solar, re-posting as requested to owl-dev. This particular
> pair of bugs^Wfeatures have had me pulling my hair out for the past
> week.
>
> ====
> Just wanted to give you a heads up on some poor behavior I've noted in
> Gentoo's packaging of tcpdump that you may have unintentionally run
> into. I know Owl's recent releases eliminated setXid binaries, so
> your likelihood of hitting these edge cases increases.
tcpdump is not included in Owl yet, although we intend to add it (or an
"equivalent"). I am also considering adding our own tiny sniffer (not
released yet) based on libnids (for TCP stream reassembly). libnids is
already in Owl.
Obviously, we don't intend to install either of these SUID root. This
means that they will normally be invoked by root, and privilege dropping
will be relevant. Yes, we'll need to consider various potential issues
around such privilege dropping.
One of my concerns is that if the sniffer is to create additional files
after dropping root, the directory holding those files will need to be
writable by the non-root pseudo-user. Yet those files would then be
examined by root, which allows for certain attacks (via (sym)links to
device files, etc.) I'm afraid there's no perfect solution to this,
although we might try to do "something" - e.g., have the sniffer create
the subdirectory prior to dropping root, set perms to 1730 with the
pseudo-user's group, and our kernel is to be hardened again to distrust
symlinks in +t directories like 2.4.x-ow kernels were.
I think we'll get to this discussion a bit later.
Thanks again for the heads up.
Alexander
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
