OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
Re: kernel module for chmod restrictions while in securelevel one or higher

From: Robert Watson (rwatsonFreeBSD.org)
Date: Wed Aug 04 2010 - 17:58:56 CDT


On Fri, 30 Jul 2010, Selphie Keller wrote:

> Kernel module for chmod restrictions while in securelevel one or higher:
> http://gist.github.com/501800 (fbsd 8.x)
>
> Was looking at the new recent sendfile/mbuf exploit and it was using a
> shellcode that calls chmod syscall to make a setuid/setgid binary. However
> was thinking of ways to block the creation of suid/sgid binaries if the
> machine is in a securelevel, beyond the normal things like nosuid/noexec
> mount flags for /tmp.
>
> So came up with this quick module to handle it, but the concept of
> restricting the creation of suid/sgid binaries while in securelevel seems
> like a good idea to be part of the base.

While I'm not convinced this approach is a good idea (the remainder of the
thread suggests some reasons why), a better way to implement the same policy
would be to use the MAC Framework's mpo_vnode_check_setmode entry point. This
would catch all the chmod variations, including ones in compatibility ABIs
such as the Linux ABI.

Robert
_______________________________________________
freebsd-securityfreebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-security
To unsubscribe, send any mail to "freebsd-security-unsubscribefreebsd.org"