Re: Secure Linux From Scratch

On Monday 15 December 2003 21:20, ashes wrote:
> On Monday 15 December 2003 11:17 am, Christos Gioran wrote:
> > One final note: I installed libsafe following the ideas of a
> > previous post
> > on this thread. As far as I can tell it is still actively developed and
> > is a very good security measure to have lying around. If it is going to
> > be included in a SLFS approach, would building the SUID binaries
> > statically have a meaning?
>
> Libsafe checks for dangerous functions at runtime. Source for suid programs
> can be checked with Rats (a source code checker) for these dangerous
> functions before they are built. Libsafe checks for well known problems, I
> should hope our suid code doesn't have known dangerous code. Its best to
> check anyway.

Well, just checked with some home made exploits. Nothing funcy; plain old 
shellcode copied into a smaller string. The results where interesting. 
Running such a binary dynamically linked resulted in an alarm from libsafe to 
be recorded in prelude and the program terminated instantly. If the same code 
was compiled statically, libsafe was out of the picture and only the 
propolice patch saved the situation, printing the standard message of stack 
smashing attempt and aborted the program. What do you make of it?

My opinion is based on the libsafe manual. Libsafe preloads its library that 
intercepts all calls to library functions contained in libc.so (the statndard 
library), checks the arguments to those who pose threat to the system and 
then decides what to do. Statically linking a binary renders this mechanism 
useless, because there is no library call to intercept; all code is loaded in 
memory from the beggining, as if it was contained in the program.

I understand that linking statically the security-wise critical binaries is 
done in response to the possibility of using the exact same method as libsafe 
(utilise ld.so.preload), but instead of loading a security-consious library, 
well...we all know what can be done. Thus, there steems the dillema: To use 
libsafe in SUID binaries or not? The way I see it, if the candidate SUID 
binaries are bulletproof then link them statically (but as is well known, 
there is no such thing as bulletproof code, is there?)

And one more thing: That bfbtester thing, when run against my /bin dir seg 
faults almost constanly my more binary. Is this supposed to be happening? 
Especially considering I have installed the propolice patches.

regards

himicos
-- 
http://linuxfromscratch.org/mailman/listinfo/lfs-security
FAQ: http://www.linuxfromscratch.org/faq/
Unsubscribe: See the above information page