Re: Examples of lost security when integrating (secure) SW

[email protected] Wed, 16 Jun 2004 12:09:03 -0400
Newsgroups gmane.comp.security.programming
Message-ID <[email protected]>
On Tue, 08 Jun 2004 14:10:18 +0200, Magnus Therning <[email protected]>  said:

> Can anyone offer any more concrete examples, ideally not only academic
> ones?

Late reply, as I just tripped over this one last night...

If you use the Center for Internet Security guidelines, one thing that they
recommend is changing the default shell from /sbin/nologin to /dev/null.
This is a defense against the attacks that need a "valid" shell.

Unfortunately, if you're running Fedora Core 2 or other system that includes
SELinux, this can slide past a check in /usr/sbin/genhomedircon, and apply
a "user home directory" label to some unexpected segment of the file system
(in my case, /var/lib/*).  At that point, it may be possible to trick a program
authorized to scribble in a home dir to scribble elsewhere in the tree....

Whoops. :)
signature.asc (application/pgp-signature, 226 B)
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)
Comment: Exmh version 2.5 07/13/2001

iD8DBQFA0HCecC3lWbTT17ARAoSPAKCR+48JpV58Klmt+J2HR82mQ4eE3wCeOHh0
PMFwZiccBX8Tp3F61SfZfnU=
=JURL
-----END PGP SIGNATURE-----