[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Tue, 15 May 2012 14:29:50 +0200
From: Sebastian Krahmer <krahmer@...e.de>
To: oss-security@...ts.openwall.com
Subject: Re: Automatic binary hardening with Autoconf
On Tue, May 15, 2012 at 08:13:31AM -0400, Steve Grubb wrote:
> On Monday, May 14, 2012 09:33:14 PM Solar Designer wrote:
> > I'd like this sort of topics to be brought up in here, so I'll start by
> > referring to some blog posts.
> >
> > Here's an interesting one by Keegan McAllister:
> >
> > http://mainisusuallyafunction.blogspot.com/2012/05/automatic-binary-hardeni
> > ng-with.html
> >
> > This suggests (and shows how) individual programs that use autoconf may
> > automatically enable the usual set of compile-time hardening settings
> > that are otherwise normally provided by builds for/by/on hardened
> > distros only. This is not rocket science, yet the provided examples may
> > be reused and it may become a trend.
>
> I think there are conflicting goals in projects like this. There are times when
> someone may want to go all out and harden everything as much as possible. But
> there is a cost to that...either startup or runtime. Not all programs have the
> same threat model and consequence if attacked successfully. Apps that are at
> greatest risk are: set[ug]id/fs based capabilities, network facing apps,
> daemons, or parsers of untrusted media. It would be hard to argue that the "cat"
> program needs full relro and bind now.
You never know. I'd even say that the cat gets the most untrusted input
ever. Everything and the world has been piped
through cat since epoch. And similar surprises will happen to all the
non threatening programs that are not seen as risk like file, ls, ps etc.
until one realizes that some procmail/cups or whatever filter is using it.
And then, Murphy is entering the dance floor.
Sebastian
--
~ perl self.pl
~ $_='print"\$_=\47$_\47;eval"';eval
~ krahmer@...e.de - SuSE Security Team
---
SUSE LINUX Products GmbH,
GF: Jeff Hawn, Jennifer Guild, Felix Imendörffer, HRB 16746 (AG Nürnberg)
Maxfeldstraße 5
90409 Nürnberg
Germany
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
