[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Mon, 28 Mar 2011 00:35:52 +0400
From: Solar Designer <solar@...nwall.com>
To: owl-dev@...ts.openwall.com
Subject: Re: sysfs facility
Vasiliy,
On Mon, Mar 28, 2011 at 12:15:46AM +0400, Vasiliy Kulikov wrote:
> On Sun, Mar 27, 2011 at 23:45 +0400, Solar Designer wrote:
> > Although we had discussed this approach, I never liked it much. I did
> > not seriously consider it for Owl. I think it is better for us to get
> > support for different sysfs and procfs permission settings into the
> > kernel.
>
> It is really better, but I'd say that at least introducing such (even
> strictly hardening) procfs features into the upstream would occur only
> after bloody disputes.
Sure. We might have a GSoC student apply for those. ;-)
> Maybe umask, pid-umask, net-umask, XXX-umask, etc.? The same with group
> (if it makes sense).
This is starting to feel too generic and complex. We really only need
an equivalent of CONFIG_HARDEN_PROC, which we had in -ow patches for 2.0
through 2.4, and the same is now in grsecurity (I don't recall the
option name). We may make it somewhat more generic for upstream
acceptance, but supporting different settings for each subdirectory
feels excessive.
> > So if you asked me whether to create such a control facility or not,
> > I would reply "no".
>
> Actually, I'm also slowly porting owl-control to my ubuntu system to
> harden it a bit. There are too many setuid root binaries in the default
> system :( If sysfs facility is not a part of Owl, then I'll merely use
> it on my desktop ;-)
Oh, this makes sense. Perhaps propose owl-control to Kees? :-)
Alexander
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
