Re: stack protection
On Mon, 25 Aug 2003 07:48, Milan P. Stanic wrote:
> > Also I don't expect DJB to write replacements for dhcpd, dhclient, ftpd,
> > cron,
>
> Maybe someone else should do that, I hope at least.
What should be done for the few years that we probably have to wait for such
programs to be written?
> > > That couldn't be solved by SE Linux (or similar code) but just
> > > mitigated a little.
> >
> > No, it means that a badly written daemon running as UID 0 can not trash
> > your system. So a sound server that has a bug can at worst play sounds
> > and record sounds in a malicious manner, and refuse to do what it is
> > supposed to do. Much better than allowing it to write to /etc/shadow!
>
> If attacker can poison DNS cache or fake DHCP server to do something
> nasty then the problem with SE Linux is just mitigated, not solved.
Mitigating a problem so that it only allows DOS attacks or attacks of limited
means (such as making a DNS or DHCP server return bogus data) rather than
having it allow full administrative access is more than a little mitigation!
If you trust DNS data then your security sucks anyway. If you don't trust DNS
data then an attack that makes a DNS caching server return bogus data is no
big deal.
> > > I'm not against SE Linux, RSBAC GRSec, LIDS etc. I'm using some them
> > > on servers and playing with all of them. I just like to say that
> > > putting limits in the (our loved (Debian)/Linux) is not good thing,
> > > IMO.
> >
> > Why is it a limit? We are not talking about making any of these
> > mandatory for Debian users. We want to give them a choice of all of
> > the above.
>
> I'm not against choice, I just don't like idea that that stack
> protection and similar code could become "mainstream" one day.
Why? I've used OpenWall and PaX and not found any programs that fail to work
correctly with them. Why not make them mainstream? There seems to be no
cost.
> P.S.
> I appreciate you contribution to Linux (and Debian) security a lot,
> and I play with *your* SE Linux host when I have time.
Thanks.
--
http://www.coker.com.au/selinux/ My NSA Security Enhanced Linux packages
http://www.coker.com.au/bonnie++/ Bonnie++ hard drive benchmark
http://www.coker.com.au/postal/ Postal SMTP/POP benchmark
http://www.coker.com.au/~russell/ My home page
Reply to: