Re: Secure Linux From Scratch

On Monday 15 December 2003 22:43, Archaic wrote:
> On Mon, Dec 15, 2003 at 06:17:06PM +0200, Christos Gioran wrote:
> > I hope I will get around it soon. Also, I checked out libformat but
> > did not use it, since after a (quick) look through the code I noticed
> > some not very security-consious function selection, such as strcpy()
> > and little error handling.
>
> If you're worried about strcpy in libformat, try grepping the sources in
> a vanilla LFS. You will find it in many places as well as other older
> functions that should have been deprecated and unsupported for a long
> time now.

I don't even doubt that. Surely it is widely used, that's why solutions such 
as lib{safe,format} are needed. What impresses me is that in a library 
supposed to make up for such problems uses insecure functions. I am no 
programmer, but while trying to become one I have generally undestand that 
use of such functions should be at all costs be avoided. That's all. If you 
say it is secure, then I will go for it.

By the way, can these two implementations ( lib{safe,format} ) co-exist. In 
other words, is it possible to define more than one library in 
/etc/lib.so.preload that reference the same function? RTFM's welcomed and 
deserved :-)

himicos
-- 
http://linuxfromscratch.org/mailman/listinfo/lfs-security
FAQ: http://www.linuxfromscratch.org/faq/
Unsubscribe: See the above information page