| Newsgroups |
gmane.linux.lfs.security |
| Message-ID |
<[email protected]> |
Option 2 would be harder for the reader to follow. If some packages are
skipped the reader would have to follow two books to do a new build.
Recap some book ideas:
Pax, openwall, and grsecurity kernel patches. These provide a wide variety of
data privacy, and obscurity. Making the system slightly less prone to
attacks.
Gcc, binutils, glibc support for -fpie/-pie, -fbounds-checking,
-fstack-protector, and libsafe. To take advantage of pax at the toolchain
level, auditing, and proactive runtime checks.
Suid binaries should all be built static. For that matter I think everything
in /bin and /sbin should be built static. This is so / and /usr can be
seperated properly without anything on / depending on /usr/lib. It also
combats vage shared lib attacks. There's an old sshd attack which preloads an
attackers code thre /sbin/nologin, I think in general all dynamicly linked
binaries are vulnerable to a shared lib attack, thats one reason why pax was
invented.
Some things should be done about cutting down suid binaries. Maybe hardcode
some uid's which cannot use suid programs, and log it if they do (like if
user sshd tries to use passwd). Might help, might not. Also check into
privlege seperaton for anything that runs as root, including updatedb,
syslogd. Have an /etc/login.conf reflect what limits these users can have. I
think selinux, and others, have special access controls in the kernel for
special users like this. Maybe the syslogd user should be in a chroot on a
read-only empty device, since it can be accessed by network.
Maybe have advice for editing limits.h in the kernel.
None of the above would be noticable to a "user", just to the administrator
and system builder. And excpet for -fbounds-checking there would be a fairly
small preformance impact from pax, propolice, static /, and -pie, I would
guess 2-5% loss from extra cpu and seek time, maybe less.
--
http://linuxfromscratch.org/mailman/listinfo/lfs-security
FAQ: http://www.linuxfromscratch.org/faq/
Unsubscribe: See the above information page