Re: svn commit: r228843 - head/contrib/telnet/libtelnet head/crypto/heimdal/appl/telnet/libtelnet head/include head/lib/libc/gen head/lib/libc/iconv head/lib/libc/include head/lib/libc/net head/libexec...

On Thu, Dec 29, 2011 at 12:15:31PM -0800, Xin Li wrote:
Instead of total disabling we can (by calling rtld function)
restrict dlopen() in ftpd() to absolute path of know safe
directories list like "/etc" "/lib" "/usr/lib" etc.

This just came back to the origin!! These "safe" locations are never
necessarily be safe inside a chroot environment and the issue was
exactly loading a library underneath /lib/.

I just realized that someone have removed some details from my
advisory draft by the way. To clarify: the chroot issue is not about
the usual usage of chroot, but the fact that many chroot setups are
not safe (e.g. "recommended" practice is to create a user writable
directory under the chroot root with everything else read-only).

Unsecure (non-root /lib) may happens by admin mistake which is very
different situation from loading .so from the current (say /incoming/)
directory. We can't provide babysitting for every admin by our code, but
can by our documentation only (probably by repeating the same thing in
ftpd docs and chroot docs). And many admins don't needs babysitting and
may take it as unnecessary restriction.

--
http://ache.vniz.net/
_______________________________________________
freebsd-security@xxxxxxxxxxx mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-security
To unsubscribe, send any mail to "freebsd-security-unsubscribe@xxxxxxxxxxx"

Relevant Pages

  • Re: svn commit: r228843 - head/contrib/telnet/libtelnet head/crypto/heimdal/appl/telnet/libtelne
    ... Why doing a patch if you apparently don't care? ... These "safe" locations are never ... the chroot issue is not about ... Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ ...
    (FreeBSD-Security)
  • Re: removing a chroot directory
    ... This is what I did (as root) ... Is it safe to simply say 'rm -rf /var/chroot' outside this directory, ... mounted anything in the chroot yet. ... To UNSUBSCRIBE, email to debian-user-REQUEST@xxxxxxxxxxxxxxxx ...
    (Debian-User)
  • SCAN in safe mode. It helps.
    ... Turn off system restore first. ... Then start via safe mode. ... Also run as a NORMAL user not ADMIN. ... When you need to install software go to admin install and change back to ...
    (microsoft.public.security.virus)
  • RE: forgotton xp administrator password
    ... XP Home can only log on the local, builtin Admin from safe ... If you try to log on Home edition with CtrlAtlDel, ... >>If you start up the computer and before the windows logo ...
    (microsoft.public.windowsxp.security_admin)
  • Re: "Standard" vs. Admin Account
    ... because it has apparently been running in "admin." ... your system will be safe. ... What you run or install as a nonadminstrator can ... system is misbehaving somehow, figuring out if it's compromised is ...
    (comp.sys.mac.system)