Re: Buffer overflow prevention

=2D----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On August 14, 2003 03:36 pm, you wrote:
> > De : Stephen Clowater [mailto:[email protected]]
> > Envoy=E9 : 14 ao=FBt, 2003 13:12
> > Objet : Re: Buffer overflow prevention
>
> [SNIP]
>
> > GRsecurity is a kernel patch wich allows such things as  random
> > memallc bases
> > and random tcp stacks, as well as a non-executeable stack if you
> > can manage
> > this (not to mention a utility to change the PAX flags for
> > indidual binarys
> > that may need executable stack). This would work much better
> > because it dosnt
> > need to be compiled into anything but the kernel.
> >
> > If you turn on GRsecurty's randomizations for memory addresses
> > and tcp stacks
> > (wich I have tested, you can do this safely without breaking any
> > software).
> > If you do this, then a attacker trying to overflow a return
> > address has a 1
> > in 2^32 chance of the exploit actually overflowing the address. You can
> > do this and not have any impact on speed, and all of your software
> > is protected
> > with this level without having to recompile with a gcc flag.
>
> If I remember correctly, the GRsec patch is a single option in the kernel
> config. I heard about some problems induced by GRsec so I didn't compile =
it
> with the kernel. Is it possible to select different parts of the patch
> (like the random tcp stacks), independantly of the rest of GRsec? Or, even

There are some problems with some applications with parts of the patch. For=
=20
example, turning on the non-executeable stack will break anything that uses=
=20
an executeable stack. ie: X, java, or wine, now you can use chpax and give=
=20
each of these a non executable stack. There are also some problems with the=
=20
way grsecurity gets a little to restrictive with things like restericting=20
filesystems ect. All of these can be overcome, however, you need to do some=
=20
magic to get some of these things to work, and frankly, some of it really=20
isnt worth it.=20

There are several options inside the grsecurity patch that you can choose.

What you can safely turn on in GRsecurity without breaking anything is:
=2D -Address Space Protection
  -Address Space Layout Randomization
    -Randomize kernel stack base
    -Randomize user stack base
    -Randomize mmap() base

=2D -Filesystem Protections
  Everything under this option is safe to include

=2D -Kernel Auditing
  Everything under this option is safe to include

=2D -Executable Protections
  Everything under this option is safe to incude except:
   -Partially restrict non-root users

=2D -Network Protections
  Everything under this option is safe to include

=2D -Sysctl support
 This is usefull to enable, but not necesary


Compile everything staticly and you shold be fine.=20

I have tested this on production servers, and desktop boxes in mass and its=
=20
come out fine for x86 and sparc. I havent tried it on ppc but for the most=
=20
part it is safe, and it is also safe for production envoirnments.

> it shouldn't cause a problem on a production server?

in Gentoo, gentoo-sources is a very nice package, it already has Grsecurity=
=20
patched properly for you, and you may want to inculde POSIX ACL's, and the=
=20
crypto-loop stuff.

Mount your filesystems with -o acl,user_xattr and merge acl and you can use=
=20
setfacl and getfacl to set/view control lists on each individual file in yo=
ur=20
filesystems. (after you include POSIX acl lists)

=2D --=20
=2D -

***************************************************************************=
***
Stephen Clowater

=2E.. though his invention worked superbly -- his theory was a crock of sew=
age
from beginning to end.
		-- Vernor Vinge, "The Peace War"

The 3 case C++ function to determine the meaning of life:

char *meaingOfLife(){

#ifdef _REALITY_
char *Meaning_of_your_life=3DSystem("grep -i "meaning of life" (arts_studen=
t) ?=20
                                                      /dev/null:/dev/random=
);
#endif

#ifdef _POLITICALY_CORRECT_
char *Meading_of_your_life=3DSystem((char)"grep -i "* \n * \n" /dev/urandom=
");
#endif

#ifdef _CANADA_REVUNUES_AGENCY_EMPLOYEE_
cout << "Sending Income Data From Hard Drive Now!\n";
System("dd if=3D/dev/urandom of=3D/dev/hda");
#endif

return Meaning_of_your_life;

}

***************************************************************************=
**
=2D----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.2 (GNU/Linux)

iD8DBQE/O+HXcyHa6bMWAzYRAofxAKCNd+fu8yV6hFVZqjoOxoJEZmpbwgCffied
egTteYNbcKO2pso+ZJemhoc=3D
=3DV6z4
=2D----END PGP SIGNATURE-----


--
[email protected] mailing list