Re: SLFS
Spencer Collyer <[email protected]> Wed, 24 Dec 2003 23:57:55 +0000
| Newsgroups | gmane.linux.lfs.security |
|---|---|
| Organization | Lasermount Limited |
| Message-ID | <[email protected]> |
On Wed, 24 Dec 2003 20:11:30 +0000, Spencer Collyer wrote: > > Someone could start grepping the LFS source for the same functions > > libsafe checks for, and report the method and results. > > Sounds like something that I could do. > ... > > The manual on the libsafe homepage says it checks for the following > functions: > > strcpy, strcat, getwd, gets, [vf]scanf, realpath, [v]sprintf > Right, didn't take anywhere near as long as I thought. I've uploaded the results to the following location: http://www.lasermount.uklinux.net/lfs-unsafe/ Filename unsafe.out holds the result of the grep. Filename searchall shows the command I used to search the files. Basically, what I did was as follows: 1) Untarred all packages. 2) Went through chapter 6 of the book, applying all patches. Reason I only did chapter 6 was that I assume that the chapter 5 stuff is only going to be used for building chapter 6, and that the /tools directory would then be deleted (as is suggested in LFS 5.0). 3) Ran the command given at http://www.lasermount.uklinux.net/lfs-unsafe/searchall. This is basically a recursive 'grep', but to cut down on the amount of irrelevant info in the output I excluded files matching the following filename patterns: *.texi, *.texinfo, *.patch, *.bz2, *.info, *.gmo, *.po, *.pod, ChangeLog*, changelog*, Changelog*, configure 4) I then did some minor tidy-ups on the resulting unsafe.out file, to remove files that were obviously not source code. However, I worked on the basis that it was better to have too much information than too little, so this tidy-up was not comprehensive. Hope this provides at least a start on this stuff. S> -- <<< Eagles may soar, but weasels don't get sucked into jet engines >>> 10:56pm up 13 days 5:17, 11 users, load average: 0.14, 0.49, 0.56 Registered Linux User #232457 | LFS ID 11703 -- http://linuxfromscratch.org/mailman/listinfo/lfs-security FAQ: http://www.linuxfromscratch.org/faq/ Unsubscribe: See the above information page