Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 16 Mar 2011 02:07:18 +0300
From: Solar Designer <solar@...nwall.com>
To: owl-dev@...ts.openwall.com
Subject: Re: tcpdump vagaries

RB, Dmitry -

This is in addition to Dmitry's response.

On Fri, Mar 11, 2011 at 06:40:31AM -0800, RB wrote:
> As sent to Solar, re-posting as requested to owl-dev.  This particular
> pair of bugs^Wfeatures have had me pulling my hair out for the past
> week.
> 
> ====
> Just wanted to give you a heads up on some poor behavior I've noted in
> Gentoo's packaging of tcpdump that you may have unintentionally run
> into.  I know Owl's recent releases eliminated setXid binaries, so
> your likelihood of hitting these edge cases increases.

tcpdump is not included in Owl yet, although we intend to add it (or an
"equivalent").  I am also considering adding our own tiny sniffer (not
released yet) based on libnids (for TCP stream reassembly).  libnids is
already in Owl.

Obviously, we don't intend to install either of these SUID root.  This
means that they will normally be invoked by root, and privilege dropping
will be relevant.  Yes, we'll need to consider various potential issues
around such privilege dropping.

One of my concerns is that if the sniffer is to create additional files
after dropping root, the directory holding those files will need to be
writable by the non-root pseudo-user.  Yet those files would then be
examined by root, which allows for certain attacks (via (sym)links to
device files, etc.)  I'm afraid there's no perfect solution to this,
although we might try to do "something" - e.g., have the sniffer create
the subdirectory prior to dropping root, set perms to 1730 with the
pseudo-user's group, and our kernel is to be hardened again to distrust
symlinks in +t directories like 2.4.x-ow kernels were.

I think we'll get to this discussion a bit later.

Thanks again for the heads up.

Alexander

Powered by blists - more mailing lists

Your e-mail address:

Powered by Openwall GNU/*/Linux - Powered by OpenVZ