Re: How to limit it ?

[Russell Coker <russell@coker.com.au>]

On Tue, 16 Nov 1999, Marek Habersack wrote:
>
>* Grzegorz Pawel Szostak said:
>> Hi, i see that limited access to /etc/passwd file and others is a very big
>> problem but... may be can someone write linux kernel module (i saw one,
>> writed by lcamtuf@ids.pl but compilation wasn't sucessfull ) that will
>A module?! :)))) What for?! Just write your own WRAPPER around the open
>syscall and use that instead of the libc's one :))))))). You can do it using
>the LD_PRELOAD mechanism.
>

int (*real_open)(const char *, int) = NULL;
int main()
{
  void *libc6 = NULL;
  libc6 = dlopen("libc.so.6", RTLD_LAZY | RTLD_GLOBAL);
  if(!libc6)
  {
    printf("Aieee\n");
    exit(1);
  }
  real_open = (int (*)(const char *, int))dlsym(libc6, "open");

  int fd = real_open("/etc/passwd", O_RDONLY);
  read(fd...
}

Of course you could pre-load a library that replaces the dlopen call, but
your system probably won't work in such a fashion.
Mounting /home, /tmp, and /var/tmp in a noexec fashion is probably a better
idea.

>> catch any call to open () system function then it will check GID (maybe
>> UID also ) and if someone want to access all lines in /etc/passwd it gaves
>How does it do :))? open() just OPENS a file, read() reads the BYTES, not
>LINES - and to test for authorized access you need to interpret LINES or
>interpret every read byte - completely useless, solution IMO.

I agree.  That sort of stuff doesn't belong in the kernel.


-- 
Electronic information tampers with your soul.