Re: Refactored libsafe for Prelude 0.9+

Le lundi 26 mai 2008 à 13:34 -0400, Steve Grubb a écrit :
> On Monday 26 May 2008 11:09:34 Yoann Vandoorselaere wrote:
> > >   Just wondered if anybody refactored util.c from libsafe for the newer
> > > Prelude?
> >
> > As of now, nobody took the time to update the libsafe code, although
> > that would be an easy task. Due to the vast improvements in current
> > detection technology (ExecShield, PAX, etc), I wonder if we shouldn't
> > deprecate this module though. Any opinion?
> 
> This is useful only on very old systems. Since around 2.3.4 or maybe it was 
> 2.4, glibc has had a FORTIFY_SOURCE option that distros should have been 
> using. This essentially replaces what libsafe was doing but its system-wide 
> as opposed to requiring LD_PRELOAD. FORTIFY_SOURCE has also surpassed 
> libsafe's coverage as it now covers twice as many dangerous C functions as 
> libsafe, but it also covers dangerous C++ methods too - which libsafe 
> doesn't.
> 
> Also, the LD_PRELOAD interface to glibc has not worked right for quite a while 
> with SE Linux enabled as this is a security risk. Aside from SE Linux 
> altering how ld works, glibc has had many security improvements so that you 
> cannot intercept things that you used to. A new interface was created (I 
> think around glibc-2.4)  that deprecates LD_PRELOAD because it improves the 
> isolation between glibc and the LD_PRELOADed library. I think this is called 
> the LD_AUDIT interface (nothing to do with any audit system - just an 
> overloaded name). I don't know if any changes have to be made to adapt to 
> this new interface and way of doing things, but I seriously doubt anyone has 
> ported code.

Thanks Steve for all the useful information! 

This confirm my feeling that libsafe is obsolete technology that should
be deprecated. If a lot of users report that they still use libsafe
through, then we can revise this position and port the old code to
current Prelude API.

So if people around are still using libsafe, please tell us!

-- 
Yoann Vandoorselaere | Responsable R&D / CTO | PreludeIDS Technologies
Tel: +33 (0)8 70 70 21 58                  Fax: +33(0)4 78 42 21 58
http://www.prelude-ids.com

_______________________________________________
Prelude-user site list
[email protected]
http://lists.prelude-ids.org/mailman/listinfo/prelude-user