Re: kernel module for chmod restrictions while in securelevel one or higher
- From: Robert Watson <rwatson@xxxxxxxxxxx>
- Date: Wed, 4 Aug 2010 23:58:56 +0100 (BST)
On Fri, 30 Jul 2010, Selphie Keller wrote:
Kernel module for chmod restrictions while in securelevel one or higher: http://gist.github.com/501800 (fbsd 8.x)
Was looking at the new recent sendfile/mbuf exploit and it was using a shellcode that calls chmod syscall to make a setuid/setgid binary. However was thinking of ways to block the creation of suid/sgid binaries if the machine is in a securelevel, beyond the normal things like nosuid/noexec mount flags for /tmp.
So came up with this quick module to handle it, but the concept of restricting the creation of suid/sgid binaries while in securelevel seems like a good idea to be part of the base.
While I'm not convinced this approach is a good idea (the remainder of the thread suggests some reasons why), a better way to implement the same policy would be to use the MAC Framework's mpo_vnode_check_setmode entry point. This would catch all the chmod variations, including ones in compatibility ABIs such as the Linux ABI.
freebsd-security@xxxxxxxxxxx mailing list
To unsubscribe, send any mail to "freebsd-security-unsubscribe@xxxxxxxxxxx"
- Prev by Date: Re: kernel module for chmod restrictions while in securelevel one or higher
- Next by Date: ~/.login_conf mechanism is flawed
- Previous by thread: Re: kernel module for chmod restrictions while in securelevel one or higher
- Next by thread: ~/.login_conf mechanism is flawed