Re: Refactored libsafe for Prelude 0.9+

On Monday 26 May 2008 11:09:34 Yoann Vandoorselaere wrote:
> >   Just wondered if anybody refactored util.c from libsafe for the newer
> > Prelude?
>
> As of now, nobody took the time to update the libsafe code, although
> that would be an easy task. Due to the vast improvements in current
> detection technology (ExecShield, PAX, etc), I wonder if we shouldn't
> deprecate this module though. Any opinion?

This is useful only on very old systems. Since around 2.3.4 or maybe it was 
2.4, glibc has had a FORTIFY_SOURCE option that distros should have been 
using. This essentially replaces what libsafe was doing but its system-wide 
as opposed to requiring LD_PRELOAD. FORTIFY_SOURCE has also surpassed 
libsafe's coverage as it now covers twice as many dangerous C functions as 
libsafe, but it also covers dangerous C++ methods too - which libsafe 
doesn't.

Also, the LD_PRELOAD interface to glibc has not worked right for quite a while 
with SE Linux enabled as this is a security risk. Aside from SE Linux 
altering how ld works, glibc has had many security improvements so that you 
cannot intercept things that you used to. A new interface was created (I 
think around glibc-2.4)  that deprecates LD_PRELOAD because it improves the 
isolation between glibc and the LD_PRELOADed library. I think this is called 
the LD_AUDIT interface (nothing to do with any audit system - just an 
overloaded name). I don't know if any changes have to be made to adapt to 
this new interface and way of doing things, but I seriously doubt anyone has 
ported code.

So, my opinion is that libsafe is good for systems with very old glibc, but 
not for any recent (later than 2004) distros.

-Steve
_______________________________________________
Prelude-user site list
[email protected]
http://lists.prelude-ids.org/mailman/listinfo/prelude-user