Re: SLFS book chapter proposals

Christos Gioran wrote:
> Good evening(day, whatever) all,
> 	Just to get the discussion around this going....

Hello, as a security clueless user who's been silently listening in the 
background, I wanted to let y'all know I really like the idea of SLFS 
and everything mentioned below.  I probably have nothing to add to this 
project, short of my own clueless user questions.  Just a few extended 
points of interest from the security stupid here that hopes to reap the 
benefits. :-)

> 
> One chapter should deal with fundamental knowledge, such as what buffer 
> overflows are, basics on format string vulnerabilities etc. Thus the reader 
> realises the threats that exist and the need to deal with them
> 

I dont' know exactly how feasible it would be to show common examples of 
code that lead to the vulnerabilities mentioned in that chapter, but 
it'd be nice to see exactly what to look for in the code to find these 
vulnerabilities, also what not to do when writing your own programs.

> Another could explain the purpose of every package installed in addition to 
> the standard LFS. Thus, if the reader has understood the build procedure of 
> the LFS, he/she should also come closer to the solutions presented in the 
> book. Why do we install propolice? Show him/her how to compile a program with 
> an unpatched gcc (probably the one of the host system's) and demostrate a 
> simple buffer overflow. Then do the same thing with the patched gcc. Voila, 
> in front of his/her eyes the system is more secure.
> 

I personally would like to see this for each type of exploit mentioned 
in the fundamental knowledge chapter.  Someone had mentioned in another 
thread that this might be a 'hacker's howto' of sorts.  This seems 
dangerous, but at the same time, how can you fix a vulnerability if you 
don't understand how the exploit works in the first place?

> Explanation of the build procedure should follow. The (probably different in 
> comparison to LFS) build order, explanation for it in detail so the reader 
> understands every step. Also, here there could be shortcuts that can be 
> taken, pointers for deviations from the book etc. The "how things are going 
> to be done" section.
> 

I like this as well, IMO any LFS sub-project should compliment LFS, not 
replace it.

> Build instructions. Fully detailed steps, explained but no duplication of 
> information from previous sections. 

Also good, but be careful with not duplicating information.  A simple 
one line pointer to the previous section on a difficult topic can help 
the newb to grasp a new concept in a different context.

Just my suggestions, wishlist, and opinions.

-- DJ

-- 
http://linuxfromscratch.org/mailman/listinfo/lfs-security
FAQ: http://www.linuxfromscratch.org/faq/
Unsubscribe: See the above information page