| Newsgroups |
gmane.linux.lfs.security |
| Message-ID |
<[email protected]> |
> there is (phew! searching done) the --disable-net-redirections possibility
> in the configure of bash ...
There's also a --enable-minimal-config option. This will keep you from
writing non-portable shell scripts too :) You could even go with a non-bash
shell, or remove the shell altogether, and use fork+execve to run all
the programs at startup.
Do not have the security of your system rely on people not being able to
execute thier own code. You don't need a compiler when you can copy
a binary data to the system (perhaps via a uuencoded file, and an awk
script or something to convert it). Furthermore, one may not need ld.so
at all if there's a single exploitable vulnerability in any of the installed
binaries, even without a setuid bit (you did remove all those setuid bits,
right?), and they can insert thier binary code into the running executable.
-James
--
Unsubscribe: send email to [email protected]
and put 'unsubscribe lfs-security' in the subject header of the message