Hi, I've been reading the last thread where my TPE was mentioned, also about the other security-related issues, work models, etc... I'm just curious about what's the opinion of kernel hackers on the possibility of including an optional suite of security enhancements in the mainline, such as grSecurity, but using Vanilla-"default" code base, without touching the kernel core and messing up things that some hackers wouldn't like. I've started a new LSM called vSecurity, inspired by grsecurity aims to bring to Vanilla sources users most of grsec's features without being a non usable solution or even an "aggressive" implementation. Using the LSM framework, it can be handled as a simple LKM, so, it can be easily enabled and disabled. Now I've done the TPE features, most of socket restriction ones, and some jail and raw I/O protections as well. Past week I haven't a lot of time, because of personal reasons (the arrival of an exchange student girl was the main one), so, maybe this weekend i could have a pre-release, before I start the normal school rhythm (Monday). The goal is quite simple, solve at least the 50% of the issues that my (still not released, Rik Van Riel has an old copy) regression test suite reports: (...) FIPS-140-2 Compliance tests for RNG dev : /dev/urandom MonoBit test: : Passed Poker test: : Passed RUNS test: : Passed LongRun test: : Passed (...) PID Randomization : Vulnerable Raw IO access restrictions : Testing denied ioperm : Vulnerable Testing denied iopl : Vulnerable DMESG Restrictions : Vulnerable Symlink restrictions : Vulnerable Hardlinking restrictions : Vulnerable Chroot jails regression tests : Chdir("/") on chroot : Vulnerable Testing double chroot : Vulnerable Dangerous capabilities inside chroot : Vulnerable Fchmod +s inside chroot : Vulnerable Chmod +s in chroot : Vulnerable Kill process outside chroot : Vulnerable mknod() inside chroot : Vulnerable Nice raise in chroot : Vulnerable Priority raise in chroot : Vulnerable sysctl() inside chroot : Vulnerable Abstract Unix socket() outside chroot : Vulnerable SHM attach outside chroot (non-root) : Vulnerable SHM attach outside chroot : Vulnerable ptrace() attach outside chroot : Vulnerable RSBAC Jail regression test : rsbac_jail() unsupported (...) That's what it reports when running in a default Vanilla sources that come with most of the distributions. Should we solve them or leave them unsolved waiting for independent developers and hackers work? I think that's not worthy, but it's just my opinion. This is what currently happens when loading vSecurity: lorenzo@estila:~/kernel/vsecurity $ sudo insmod vsecurity.ko lorenzo@estila:~/kernel/vsecurity $ LANG="en" dmesg klogctl: Operation not permitted Dmesg output (must have CAP_SYS_ADMIN capabilities): VSEC: Registering vsecfs subsystem (sysfs). VSEC: Initializing Access Control Lists. VSEC: vSecurity engine initialized. VSEC: Denied syslog access: uid/euid=1000/1000 gid/egid=1000/1000 suid/sgid=1000/1000 pid=19826 VSEC: Denied syslog access: uid/euid=1000/1000 gid/egid=1000/1000 suid/sgid=1000/1000 pid=19829 ...and so on. Almost all of the restrictions and protections have also an ACL: lorenzo@estila:~/proyectos/collision-rts-0.1/src $ ls /sys/vsecfs/ all-sockets-add client-sockets-add rawio-add server-sockets-add tpe-add all-sockets-add-group client-sockets-add-group rawio-add-group server-sockets-add-group tpe-add-group all-sockets-del client-sockets-del rawio-del server-sockets-del tpe-del all-sockets-del-group client-sockets-del-group rawio-del-group server-sockets-del-group tpe-del-group lorenzo@estila:~/proyectos/collision-rts-0.1/src $ I will try to make most of the remaining work to get at least the half of those issues solved, but it depends on how i feel to do it and how good is the users opinion on it, so, please, tell me your opinion. BTW, Linus was working on some type of TPE features, Am i right? Cheers, -- Lorenzo Hernández García-Hierro <lorenzo@private> [1024D/6F2B2DEC] [2048g/9AE91A22] Hardened Debian head developer & project manager
This archive was generated by hypermail 2.1.3 : Sat Jan 15 2005 - 02:11:03 PST