From owner-freebsd-security@FreeBSD.ORG Sat Mar 12 19:16:44 2005 Return-Path: Delivered-To: freebsd-security@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 27F0516A4CE; Sat, 12 Mar 2005 19:16:44 +0000 (GMT) Received: from kientzle.com (h-66-166-149-50.snvacaid.covad.net [66.166.149.50]) by mx1.FreeBSD.org (Postfix) with ESMTP id 41BBE43D1F; Sat, 12 Mar 2005 19:16:43 +0000 (GMT) (envelope-from kientzle@freebsd.org) Received: from freebsd.org (p54.kientzle.com [66.166.149.54]) by kientzle.com (8.12.9/8.12.9) with ESMTP id j2CJGgOZ051606; Sat, 12 Mar 2005 11:16:43 -0800 (PST) (envelope-from kientzle@freebsd.org) Message-ID: <4233401A.3040403@freebsd.org> Date: Sat, 12 Mar 2005 11:16:42 -0800 From: Tim Kientzle User-Agent: Mozilla/5.0 (X11; U; FreeBSD i386; en-US; rv:1.4) Gecko/20031006 X-Accept-Language: en-us, en MIME-Version: 1.0 To: "Christian S.J. Peron" References: <20050311152951.GA90290@freefall.freebsd.org> In-Reply-To: <20050311152951.GA90290@freefall.freebsd.org> Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit X-Mailman-Approved-At: Sun, 13 Mar 2005 13:01:35 +0000 cc: freebsd-security@freebsd.org cc: freebsd-hackers@freebsd.org Subject: Re: FreeBSD trusted execution system: beta testers wanted X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Security issues [members-only posting] List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 12 Mar 2005 19:16:44 -0000 Christian S.J. Peron wrote: > > I have written a trusted execution module and would appreciate if anyone could > help in testing. This module provides a functionality similar to NetBSD's > verified exec mechanism. Excellent! Sounds like something that could provide a lot of additional protection against trojans and worms. Wish I had time to play with it right now.... Tim From owner-freebsd-security@FreeBSD.ORG Tue Mar 15 20:42:16 2005 Return-Path: Delivered-To: freebsd-security@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id A984A16A52D for ; Tue, 15 Mar 2005 20:42:16 +0000 (GMT) Received: from wproxy.gmail.com (wproxy.gmail.com [64.233.184.204]) by mx1.FreeBSD.org (Postfix) with ESMTP id 1C55943D60 for ; Tue, 15 Mar 2005 20:42:16 +0000 (GMT) (envelope-from vaida.bogdan@gmail.com) Received: by wproxy.gmail.com with SMTP id 36so5545wra for ; Tue, 15 Mar 2005 12:42:15 -0800 (PST) DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=beta; d=gmail.com; h=received:message-id:date:from:reply-to:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:references; b=EnD0RIFHbMyGFb1+4zz5pa4yFdmPmcQfwTsO1ZHa4G4wHQ6rPuPAWGJ9hN06uoVHS1p380o79ANRPsSPC+CtXOQf6rL3rahhj2f3hM6wAGqkCNoM631DX2sX1aE6V6Ze7Qf1afRDHg0zakXfW2KqA3EXPQnZhk6Jxk1DuAmWHkU= Received: by 10.38.15.37 with SMTP id 37mr1046926rno; Tue, 15 Mar 2005 12:42:15 -0800 (PST) Received: by 10.38.208.63 with HTTP; Tue, 15 Mar 2005 12:42:15 -0800 (PST) Message-ID: <12848a3b05031512426bf7664c@mail.gmail.com> Date: Tue, 15 Mar 2005 22:42:15 +0200 From: vaida bogdan To: Tim Kientzle In-Reply-To: <4233401A.3040403@freebsd.org> Mime-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit References: <20050311152951.GA90290@freefall.freebsd.org> <4233401A.3040403@freebsd.org> cc: freebsd-security@freebsd.org cc: "Christian S.J. Peron" cc: freebsd-hackers@freebsd.org Subject: Re: FreeBSD trusted execution system: beta testers wanted X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list Reply-To: vaida bogdan List-Id: Security issues [members-only posting] List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 15 Mar 2005 20:42:16 -0000 Hi, could you explain me how this error is related to mac_chkexec? (after enforcing, I execute xchat and get:) /libexec/ld-elf.so.1: /usr/X11R6/lib/libgdk-x11-2.0.so.400: mmap of entire address space failed: Operation not permitted (I set chkexec.enforce to 0, run xchat and enforce the policy again and the error disappears) It didn't tell me which executable it could not run. On Sat, 12 Mar 2005 11:16:42 -0800, Tim Kientzle wrote: > Christian S.J. Peron wrote: > > > > I have written a trusted execution module and would appreciate if anyone > could > > help in testing. This module provides a functionality similar to NetBSD's > > verified exec mechanism. > > Excellent! > > Sounds like something that could provide a > lot of additional protection against > trojans and worms. > > Wish I had time to play with it right now.... > > Tim > > _______________________________________________ > freebsd-security@freebsd.org mailing list > http://lists.freebsd.org/mailman/listinfo/freebsd-security > To unsubscribe, send any mail to "freebsd-security-unsubscribe@freebsd.org" > From owner-freebsd-security@FreeBSD.ORG Wed Mar 16 06:38:47 2005 Return-Path: Delivered-To: freebsd-security@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 351B116A4CE for ; Wed, 16 Mar 2005 06:38:47 +0000 (GMT) Received: from ivc-i.dp.uz.gov.ua (ivc-i.dp.uz.gov.ua [212.1.84.107]) by mx1.FreeBSD.org (Postfix) with ESMTP id B558A43D31 for ; Wed, 16 Mar 2005 06:38:35 +0000 (GMT) (envelope-from o.palij@dp.uz.gov.ua) Received: from s4dnepr.dp.uz.gov.ua ([10.6.105.15]) by ivc-i.dp.uz.gov.ua (8.12.11/8.12.11) with ESMTP id j2G6cATS022502 for ; Wed, 16 Mar 2005 08:38:18 +0200 Received: from dp.uz.gov.ua ([10.6.105.74]) by s4dnepr.dp.uz.gov.ua (Lotus Domino Release 5.0.10) with ESMTP id 2005031608380263:7306 ; Wed, 16 Mar 2005 08:38:02 +0200 Date: Wed, 16 Mar 2005 08:38:02 +0200 From: Oleg Palij To: freebsd-security@freebsd.org Message-ID: <20050316083802.5e80e245@iscmpd-oleg.dp.uz.gov.ua> In-Reply-To: <50F02500D53247E3C2256FC2004AF0D6.004AEACD42256FC2@dp.uz.gov.ua> References: <50F02500D53247E3C2256FC2004AF0D6.004AEACD42256FC2@dp.uz.gov.ua> Organization: Pridn railway X-Mailer: Sylpheed-Claws 1.0.0 (GTK+ 1.2.10; i386-portbld-freebsd5.3) Mime-Version: 1.0 X-MIMETrack: Itemize by SMTP Server on s4dnepr/DNEPR/UKRZAL(Release 5.0.10 |March 22, 2002) at 03/16/2005 08:38:02 AM,2002) at 03/16/2005 08:38:18 AM, Serialize complete at 03/16/2005 08:38:18 AM Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset=US-ASCII X-Virus-Scanned: clamd / ClamAV version 0.75, clamav-milter version 0.75 on ivc-i X-Virus-Status: Clean Subject: Re: FreeBSD trusted execution system: beta testers wanted X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Security issues [members-only posting] List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 16 Mar 2005 06:38:47 -0000 On Sat, 12 Mar 2005 15:38:17 +0200 owner-freebsd-security@freebsd.org wrote: > I have written a trusted execution module and would appreciate if anyone > could > help in testing. This module provides a functionality similar to NetBSD's > verified exec mechanism. Once the design details of this security policy > has > been solidified, I will be releasing a white paper which describes the > technical implementation in greater detail. It would be great to implement some logging to files with fixed tag. Thanks! -- Best regards, Palij Oleg, ISC (Pridn railway) jid: malik@jabber.te.ua From owner-freebsd-security@FreeBSD.ORG Wed Mar 16 06:54:23 2005 Return-Path: Delivered-To: freebsd-security@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id B9F8D16A4CE; Wed, 16 Mar 2005 06:54:23 +0000 (GMT) Received: from ivc-i.dp.uz.gov.ua (ivc-i.dp.uz.gov.ua [212.1.84.107]) by mx1.FreeBSD.org (Postfix) with ESMTP id E871643D39; Wed, 16 Mar 2005 06:54:21 +0000 (GMT) (envelope-from o.palij@dp.uz.gov.ua) Received: from s4dnepr.dp.uz.gov.ua ([10.6.105.15]) by ivc-i.dp.uz.gov.ua (8.12.11/8.12.11) with ESMTP id j2G6sE6Z022528; Wed, 16 Mar 2005 08:54:19 +0200 Received: from dp.uz.gov.ua ([10.6.105.74]) by s4dnepr.dp.uz.gov.ua (Lotus Domino Release 5.0.10) with ESMTP id 2005031608541395:7311 ; Wed, 16 Mar 2005 08:54:13 +0200 Date: Wed, 16 Mar 2005 08:54:13 +0200 From: Oleg Palij To: csjp@FreeBSD.ORG Message-ID: <20050316085413.2cb4ec3c@iscmpd-oleg.dp.uz.gov.ua> Organization: Pridn railway X-Mailer: Sylpheed-Claws 1.0.0 (GTK+ 1.2.10; i386-portbld-freebsd5.3) Mime-Version: 1.0 X-MIMETrack: Itemize by SMTP Server on s4dnepr/DNEPR/UKRZAL(Release 5.0.10 |March 22, 2002) at 03/16/2005 08:54:14 AM,2002) at 03/16/2005 08:54:19 AM, Serialize complete at 03/16/2005 08:54:19 AM Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset=US-ASCII X-Virus-Scanned: clamd / ClamAV version 0.75, clamav-milter version 0.75 on ivc-i X-Virus-Status: Clean cc: freebsd-security@FreeBSD.ORG Subject: Re: FreeBSD trusted execution system: beta testers wanted X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Security issues [members-only posting] List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 16 Mar 2005 06:54:23 -0000 Hi! Thanks for developing such interesting feature :) ! But I have some problems, which I cant understand. # sysctl security.mac.chkexec.enforce=0 security.mac.chkexec.enforce: 1 -> 0 # setfhash /usr/local/sbin/logrotate # getfhash /usr/local/sbin/logrotate /usr/local/sbin/logrotate: sha1 78513a038cd9416f2be710b6732369b96874b364 # sysctl security.mac.chkexec.enforce=1 security.mac.chkexec.enforce: 0 -> 1 # /usr/local/sbin/logrotate bash: /usr/local/sbin/logrotate: Operation not permitted # getfhash /usr/local/sbin/logrotate /usr/local/sbin/logrotate: sha1 78513a038cd9416f2be710b6732369b96874b364 How can I see what exactly goes wrong ??? Oleg. From owner-freebsd-security@FreeBSD.ORG Thu Mar 17 23:52:37 2005 Return-Path: Delivered-To: freebsd-security@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 00F8916A4CE for ; Thu, 17 Mar 2005 23:52:37 +0000 (GMT) Received: from titan.open-networks.net (dsl-202-173-176-254.qld.westnet.com.au [202.173.176.254]) by mx1.FreeBSD.org (Postfix) with ESMTP id 269A343D41 for ; Thu, 17 Mar 2005 23:52:36 +0000 (GMT) (envelope-from timothy@open-networks.net) Received: from [192.168.1.200] (unknown [192.168.1.1]) by titan.open-networks.net (Postfix) with ESMTP id 7F7EFBC for ; Fri, 18 Mar 2005 09:52:34 +1000 (EST) Message-ID: <423A1842.4050603@open-networks.net> Date: Fri, 18 Mar 2005 09:52:34 +1000 From: Timothy Smith User-Agent: Mozilla Thunderbird 0.8 (X11/20041023) X-Accept-Language: en-us, en MIME-Version: 1.0 To: freebsd-security@freebsd.org Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Subject: no patch, is there a problem X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Security issues [members-only posting] List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 17 Mar 2005 23:52:37 -0000 http://www.securityfocus.com/bid/12825/info/ no patch or anything, is there any action on this? From owner-freebsd-security@FreeBSD.ORG Thu Mar 17 23:59:31 2005 Return-Path: Delivered-To: freebsd-security@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 347C016A4CE for ; Thu, 17 Mar 2005 23:59:31 +0000 (GMT) Received: from pd4mo3so.prod.shaw.ca (shawidc-mo1.cg.shawcable.net [24.71.223.10]) by mx1.FreeBSD.org (Postfix) with ESMTP id EB50343D1F for ; Thu, 17 Mar 2005 23:59:30 +0000 (GMT) (envelope-from cperciva@freebsd.org) Received: from pd5mr7so.prod.shaw.ca (pd5mr7so-qfe3.prod.shaw.ca [10.0.141.183]) by l-daemon (Sun ONE Messaging Server 6.0 HotFix 1.01 (built Mar 15 2004)) with ESMTP id <0IDI00M3YT9X4F10@l-daemon> for freebsd-security@freebsd.org; Thu, 17 Mar 2005 16:58:45 -0700 (MST) Received: from pn2ml2so.prod.shaw.ca ([10.0.121.146]) by pd5mr7so.prod.shaw.ca (Sun ONE Messaging Server 6.0 HotFix 1.01 (built Mar 15 2004)) with ESMTP id <0IDI00H9WT9V2YB0@pd5mr7so.prod.shaw.ca> for freebsd-security@freebsd.org; Thu, 17 Mar 2005 16:58:43 -0700 (MST) Received: from [192.168.0.60] (S0106006067227a4a.vc.shawcable.net [24.87.209.6]) by l-daemon (iPlanet Messaging Server 5.2 HotFix 1.18 (built Jul 28 2003)) freebsd-security@freebsd.org; Thu, 17 Mar 2005 16:58:43 -0700 (MST) Date: Thu, 17 Mar 2005 15:58:42 -0800 From: Colin Percival In-reply-to: <423A1842.4050603@open-networks.net> To: Timothy Smith Message-id: <423A19B2.7000602@freebsd.org> MIME-version: 1.0 Content-type: text/plain; charset=ISO-8859-1 Content-transfer-encoding: 7bit X-Accept-Language: en-us, en X-Enigmail-Version: 0.90.1.0 X-Enigmail-Supports: pgp-inline, pgp-mime References: <423A1842.4050603@open-networks.net> User-Agent: Mozilla Thunderbird 1.0 (X11/20050314) cc: freebsd-security@freebsd.org Subject: Re: no patch, is there a problem X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Security issues [members-only posting] List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 17 Mar 2005 23:59:31 -0000 Timothy Smith wrote: > http://www.securityfocus.com/bid/12825/info/ > > no patch or anything, is there any action on this? We're not affected. The problem is in copyoutstr(), which doesn't exist in FreeBSD. I've sent an email to securityfocus advising them of this. Colin Percival From owner-freebsd-security@FreeBSD.ORG Fri Mar 18 00:26:44 2005 Return-Path: Delivered-To: freebsd-security@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 7F88F16A4CE for ; Fri, 18 Mar 2005 00:26:44 +0000 (GMT) Received: from web53909.mail.yahoo.com (web53909.mail.yahoo.com [206.190.36.219]) by mx1.FreeBSD.org (Postfix) with SMTP id 9699843D55 for ; Fri, 18 Mar 2005 00:26:43 +0000 (GMT) (envelope-from stheg_olloydson@yahoo.com) Received: (qmail 80400 invoked by uid 60001); 18 Mar 2005 00:26:42 -0000 Comment: DomainKeys? See http://antispam.yahoo.com/domainkeys DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=s1024; d=yahoo.com; b=JJutL8othwjKH4hKyp9jVP8HFSlwxqWxQ2XNvTvM1bRWwtd9OChZFw3E3HCB54vty2L/jGUBkO1nkKMMLV2EOAs3yjSwZetHnxliiDg+LBNCndiegya3ObOSRMberJhuhq7wJTy+Z4MssLfhG1A6L76bb0NsZiyndHzd3Z+Tygk= ; Message-ID: <20050318002642.80398.qmail@web53909.mail.yahoo.com> Received: from [68.157.0.215] by web53909.mail.yahoo.com via HTTP; Thu, 17 Mar 2005 16:26:42 PST Date: Thu, 17 Mar 2005 16:26:42 -0800 (PST) From: stheg olloydson To: kris@FreeBSD.org MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii cc: timothy@open-networks.net cc: freebsd-security@freebsd.org cc: freebsd-questions@freebsd.org Subject: Re: no patch whats going on X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Security issues [members-only posting] List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 18 Mar 2005 00:26:44 -0000 it was said: >>On Fri, Mar 18, 2005 at 08:52:30AM +1000, Timothy Smith wrote: >> http://www.securityfocus.com/bid/12825/info/ > >That URL doesn't seem to have any details. > >> openbsd and netbsd have taken action on this, but i see no >>movment in >> the freebsd camp.... > >Well, you wouldn't, on the freebsd-questions list. Security >discussion happens on the freebsd-security mailing list. > >Kris > Hello, Click on the "Discussion" and "Solution" links for the details. Nothing has been said about this on the security@ list. According to the site, this hole was disclosed 28.2.05. I wonder if this is the issue that Theo deRaadt was complaining about.... Regards, stheg __________________________________ Do you Yahoo!? Make Yahoo! your home page http://www.yahoo.com/r/hs From owner-freebsd-security@FreeBSD.ORG Fri Mar 18 00:35:28 2005 Return-Path: Delivered-To: freebsd-security@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 02B6D16A4CE; Fri, 18 Mar 2005 00:35:28 +0000 (GMT) Received: from pd4mo3so.prod.shaw.ca (shawidc-mo1.cg.shawcable.net [24.71.223.10]) by mx1.FreeBSD.org (Postfix) with ESMTP id 9A99043D31; Fri, 18 Mar 2005 00:35:27 +0000 (GMT) (envelope-from cperciva@freebsd.org) Received: from pd5mr6so.prod.shaw.ca (pd5mr6so-qfe3.prod.shaw.ca [10.0.141.182]) by l-daemon (Sun ONE Messaging Server 6.0 HotFix 1.01 (built Mar 15 2004)) with ESMTP id <0IDI00MDXUZ34S30@l-daemon>; Thu, 17 Mar 2005 17:35:27 -0700 (MST) Received: from pn2ml2so.prod.shaw.ca ([10.0.121.146]) by pd5mr6so.prod.shaw.ca (Sun ONE Messaging Server 6.0 HotFix 1.01 (built Mar 15 2004)) with ESMTP id <0IDI00FYEUZ3W970@pd5mr6so.prod.shaw.ca>; Thu, 17 Mar 2005 17:35:27 -0700 (MST) Received: from [192.168.0.60] (S0106006067227a4a.vc.shawcable.net [24.87.209.6]) by l-daemon (iPlanet Messaging Server 5.2 HotFix 1.18 (built Jul 28 2003)) with ESMTP id <0IDI0095MUZ2YG@l-daemon>; Thu, 17 Mar 2005 17:35:27 -0700 (MST) Date: Thu, 17 Mar 2005 16:35:26 -0800 From: Colin Percival In-reply-to: <20050318002642.80398.qmail@web53909.mail.yahoo.com> To: stheg olloydson Message-id: <423A224E.40409@freebsd.org> MIME-version: 1.0 Content-type: text/plain; charset=ISO-8859-1 Content-transfer-encoding: 7bit X-Accept-Language: en-us, en X-Enigmail-Version: 0.90.1.0 X-Enigmail-Supports: pgp-inline, pgp-mime References: <20050318002642.80398.qmail@web53909.mail.yahoo.com> User-Agent: Mozilla Thunderbird 1.0 (X11/20050314) cc: timothy@open-networks.net cc: freebsd-security@freebsd.org cc: freebsd-questions@freebsd.org Subject: Re: no patch whats going on X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Security issues [members-only posting] List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 18 Mar 2005 00:35:28 -0000 >>>On Fri, Mar 18, 2005 at 08:52:30AM +1000, Timothy Smith wrote: >>>http://www.securityfocus.com/bid/12825/info/ For the benefit of people on -questions who didn't read my reply on -security: This bug doesn't exist in FreeBSD, thus the lack of response from us. stheg olloydson wrote: > According to the site, this hole was disclosed 28.2.05. I wonder > if this is the issue that Theo deRaadt was complaining about.... No. Colin Percival From owner-freebsd-security@FreeBSD.ORG Fri Mar 18 05:27:03 2005 Return-Path: Delivered-To: freebsd-security@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 1E9EC16A4CE; Fri, 18 Mar 2005 05:27:03 +0000 (GMT) Received: from VARK.MIT.EDU (VARK.MIT.EDU [18.95.3.179]) by mx1.FreeBSD.org (Postfix) with ESMTP id A4F5943D5A; Fri, 18 Mar 2005 05:27:02 +0000 (GMT) (envelope-from das@FreeBSD.ORG) Received: from VARK.MIT.EDU (localhost [127.0.0.1]) by VARK.MIT.EDU (8.13.3/8.13.1) with ESMTP id j2I5QvP3040555; Fri, 18 Mar 2005 00:26:57 -0500 (EST) (envelope-from das@FreeBSD.ORG) Received: (from das@localhost) by VARK.MIT.EDU (8.13.3/8.13.1/Submit) id j2I5QuWb040554; Fri, 18 Mar 2005 00:26:56 -0500 (EST) (envelope-from das@FreeBSD.ORG) Date: Fri, 18 Mar 2005 00:26:56 -0500 From: David Schultz To: Colin Percival Message-ID: <20050318052656.GA40243@VARK.MIT.EDU> Mail-Followup-To: Colin Percival , Timothy Smith , freebsd-security@FreeBSD.ORG References: <423A1842.4050603@open-networks.net> <423A19B2.7000602@freebsd.org> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <423A19B2.7000602@freebsd.org> cc: Timothy Smith cc: freebsd-security@FreeBSD.ORG Subject: Re: no patch, is there a problem X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Security issues [members-only posting] List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 18 Mar 2005 05:27:03 -0000 On Thu, Mar 17, 2005, Colin Percival wrote: > Timothy Smith wrote: > > http://www.securityfocus.com/bid/12825/info/ > > > > no patch or anything, is there any action on this? > > We're not affected. The problem is in copyoutstr(), > which doesn't exist in FreeBSD. > > I've sent an email to securityfocus advising them of > this. It exists on FreeBSD/alpha because it was blindly copied from NetBSD. However, we don't use it, and it appears to do proper validation anyway. I'm not sure whether the bugtraq submitter is intentionally spreading FUD or just lazy; the assertion that we do ``no validation'' in copyout is patently false. It seems that someone just copied a list of all FreeBSD CVS branches without actually looking at the source or contacting security@freebsd.org. Sigh. From owner-freebsd-security@FreeBSD.ORG Fri Mar 18 05:37:16 2005 Return-Path: Delivered-To: freebsd-security@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id CCF7B16A4CE; Fri, 18 Mar 2005 05:37:16 +0000 (GMT) Received: from pd4mo2so.prod.shaw.ca (shawidc-mo1.cg.shawcable.net [24.71.223.10]) by mx1.FreeBSD.org (Postfix) with ESMTP id 8FB8B43D55; Fri, 18 Mar 2005 05:37:16 +0000 (GMT) (envelope-from cperciva@freebsd.org) Received: from pd2mr8so.prod.shaw.ca (pd2mr8so-qfe3.prod.shaw.ca [10.0.141.11])2004)) with ESMTP id <0IDJ00H008Y4H4AZ@l-daemon>; Thu, 17 Mar 2005 22:37:16 -0700 (MST) Received: from pn2ml1so.prod.shaw.ca ([10.0.121.145]) by pd2mr8so.prod.shaw.ca (Sun ONE Messaging Server 6.0 HotFix 1.01 (built Mar 15 2004)) with ESMTP id <0IDJ00EAS8Y4VLD0@pd2mr8so.prod.shaw.ca>; Thu, 17 Mar 2005 22:37:16 -0700 (MST) Received: from [192.168.0.60] (S0106006067227a4a.vc.shawcable.net [24.87.209.6]) by l-daemon (iPlanet Messaging Server 5.2 HotFix 1.18 (built Jul 28 2003)) with ESMTP id <0IDJ00H2H8Y3YK@l-daemon>; Thu, 17 Mar 2005 22:37:16 -0700 (MST) Date: Thu, 17 Mar 2005 21:37:15 -0800 From: Colin Percival In-reply-to: <20050318052656.GA40243@VARK.MIT.EDU> To: David Schultz Message-id: <423A690B.5010305@freebsd.org> MIME-version: 1.0 Content-type: text/plain; charset=ISO-8859-1 Content-transfer-encoding: 7bit X-Accept-Language: en-us, en X-Enigmail-Version: 0.90.1.0 X-Enigmail-Supports: pgp-inline, pgp-mime References: <423A1842.4050603@open-networks.net> <423A19B2.7000602@freebsd.org> <20050318052656.GA40243@VARK.MIT.EDU> User-Agent: Mozilla Thunderbird 1.0 (X11/20050314) cc: freebsd-security@FreeBSD.ORG Subject: Re: no patch, is there a problem X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Security issues [members-only posting] List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 18 Mar 2005 05:37:16 -0000 David Schultz wrote: > On Thu, Mar 17, 2005, Colin Percival wrote: >>We're not affected. The problem is in copyoutstr(), >>which doesn't exist in FreeBSD. > > It exists on FreeBSD/alpha because it was blindly copied from > NetBSD. However, we don't use it, and it appears to do proper > validation anyway. Heh. The problem was in Net/OpenBSD's implementations of copyoutstr() on i386 and amd64 only. > I'm not sure whether the bugtraq submitter is intentionally > spreading FUD or just lazy; the assertion that we do ``no > validation'' in copyout is patently false. I'm sure someone wrote "multiple BSDs" and someone else read that as including FreeBSD. The problem description was correct, for the affected systems -- the i386 and amd64 versions of copystrout() on OpenBSD and NetBSD did not do any validation of the target address. Colin Percival From owner-freebsd-security@FreeBSD.ORG Fri Mar 18 11:47:00 2005 Return-Path: Delivered-To: freebsd-security@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 18FBA16A4CE for ; Fri, 18 Mar 2005 11:47:00 +0000 (GMT) Received: from rproxy.gmail.com (rproxy.gmail.com [64.233.170.204]) by mx1.FreeBSD.org (Postfix) with ESMTP id 4D09B43D53 for ; Fri, 18 Mar 2005 11:46:59 +0000 (GMT) (envelope-from vaida.bogdan@gmail.com) Received: by rproxy.gmail.com with SMTP id j1so104663rnf for ; Fri, 18 Mar 2005 03:46:58 -0800 (PST) DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=beta; d=gmail.com; h=received:message-id:date:from:reply-to:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:references; b=bC0at5OnsFTjCI2ia9MB+wMUenUsW92fXPD0P3eY0YEV9s8ke80eORcxd2iod4cDugpuwtX6gYJEfMZJGNaQ5qlaxujMI0hwYIhVwgHSTLrJaVfFKFqcC1Xb3PUnK17fCWyCVcoFKVj8BfxRM+1VR1Rh1R0OE314Vum7af+S1ZE= Received: by 10.38.208.17 with SMTP id f17mr617256rng; Fri, 18 Mar 2005 03:46:58 -0800 (PST) Received: by 10.38.208.63 with HTTP; Fri, 18 Mar 2005 03:46:58 -0800 (PST) Message-ID: <12848a3b05031803466f7cd25c@mail.gmail.com> Date: Fri, 18 Mar 2005 13:46:58 +0200 From: vaida bogdan To: Oleg Palij In-Reply-To: <20050316085413.2cb4ec3c@iscmpd-oleg.dp.uz.gov.ua> Mime-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit References: <20050316085413.2cb4ec3c@iscmpd-oleg.dp.uz.gov.ua> cc: freebsd-security@freebsd.org cc: csjp@freebsd.org Subject: Re: FreeBSD trusted execution system: beta testers wanted X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list Reply-To: vaida bogdan List-Id: Security issues [members-only posting] List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 18 Mar 2005 11:47:00 -0000 VMWare port gives error when mac.chkexec is enabled but not enforced: # sysctl security.mac.chkexec security.mac.chkexec.enable: 1 security.mac.chkexec.enforce: 0 ... # cd /usr/ports/emulators/vmware3 && make ===> Extracting for vmware3-3.2.1.2242_10,1 => Checksum OK for VMware-workstation-3.2.1-2242.tar.gz. => Checksum OK for vmmon-only-3.2.1-20040727.tar.gz. => Checksum OK for vmnet-only-3.2.1-20040705.tar.gz. vmware-distrib/INSTALL: Can't update time for vmware-distrib/INSTALL: Input/output error vmware-distrib/vmware-install.pl: Can't update time for vmware-distrib/vmware-install.pl: Input/output error *** Error code 1 Stop in /usr/ports/emulators/vmware3. *** Error code 1 Stop in /usr/ports/emulators/vmware3. # sysctl security.mac.chkexec.enable=0 cd /usr/ports/emulators/vmware3 && make WMWare compiles fine. On Wed, 16 Mar 2005 08:54:13 +0200, Oleg Palij wrote: > Hi! > > Thanks for developing such interesting feature :) ! > > But I have some problems, which I cant understand. > > # sysctl security.mac.chkexec.enforce=0 > security.mac.chkexec.enforce: 1 -> 0 > > # setfhash /usr/local/sbin/logrotate > # getfhash /usr/local/sbin/logrotate > /usr/local/sbin/logrotate: sha1 78513a038cd9416f2be710b6732369b96874b364 > > # sysctl security.mac.chkexec.enforce=1 > security.mac.chkexec.enforce: 0 -> 1 > > # /usr/local/sbin/logrotate > bash: /usr/local/sbin/logrotate: Operation not permitted > > # getfhash /usr/local/sbin/logrotate > /usr/local/sbin/logrotate: sha1 78513a038cd9416f2be710b6732369b96874b364 > > How can I see what exactly goes wrong ??? > > Oleg. > _______________________________________________ > freebsd-security@freebsd.org mailing list > http://lists.freebsd.org/mailman/listinfo/freebsd-security > To unsubscribe, send any mail to "freebsd-security-unsubscribe@freebsd.org" > From owner-freebsd-security@FreeBSD.ORG Fri Mar 18 00:47:03 2005 Return-Path: Delivered-To: freebsd-security@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id ACEE716A4CF for ; Fri, 18 Mar 2005 00:47:03 +0000 (GMT) Received: from mail.gmx.net (mail.gmx.de [213.165.64.20]) by mx1.FreeBSD.org (Postfix) with SMTP id 56C6143D54 for ; Fri, 18 Mar 2005 00:47:02 +0000 (GMT) (envelope-from emanuel.strobl@gmx.net) Received: (qmail invoked by alias); 18 Mar 2005 00:47:01 -0000 Received: from flb.schmalzbauer.de (EHLO cale.flintsbach.schmalzbauer.de) [62.245.232.135] by mail.gmx.net (mp007) with SMTP; 18 Mar 2005 01:47:01 +0100 X-Authenticated: #301138 From: Emanuel Strobl To: freebsd-questions@freebsd.org Date: Fri, 18 Mar 2005 01:46:56 +0100 User-Agent: KMail/1.7.2 References: <20050318002642.80398.qmail@web53909.mail.yahoo.com> <423A224E.40409@freebsd.org> In-Reply-To: <423A224E.40409@freebsd.org> X-Birthday: 10/06/72 X-CelPhone: +49 173 9967781 X-Tel: +49 89 18947781 X-Country: Germany X-Address: Munich, 80686 X-OS: FreeBSD MIME-Version: 1.0 Content-Type: multipart/signed; boundary="nextPart3292350.JQqKGklHN6"; protocol="application/pgp-signature"; micalg=pgp-sha1 Content-Transfer-Encoding: 7bit Message-Id: <200503180147.01548@harrymail> X-Y-GMX-Trusted: 0 X-Mailman-Approved-At: Fri, 18 Mar 2005 14:58:43 +0000 cc: timothy@open-networks.net cc: freebsd-security@freebsd.org cc: stheg olloydson cc: Colin Percival Subject: Re: no patch whats going on X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Security issues [members-only posting] List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 18 Mar 2005 00:47:03 -0000 --nextPart3292350.JQqKGklHN6 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Content-Disposition: inline Am Freitag, 18. M=E4rz 2005 01:35 schrieb Colin Percival: > >>>On Fri, Mar 18, 2005 at 08:52:30AM +1000, Timothy Smith wrote: > >>>http://www.securityfocus.com/bid/12825/info/ > > For the benefit of people on -questions who didn't read my reply > on -security: This bug doesn't exist in FreeBSD, thus the lack > of response from us. Thanks for that note! =2DHarry --nextPart3292350.JQqKGklHN6 Content-Type: application/pgp-signature -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.0 (FreeBSD) iD8DBQBCOiUFBylq0S4AzzwRAtz5AKCRzkRLLq7Zkzc59/MgjL7hqMgtCACgh97a +KDfRmNyOKAX+HxrN4bFpcI= =OQMQ -----END PGP SIGNATURE----- --nextPart3292350.JQqKGklHN6-- From owner-freebsd-security@FreeBSD.ORG Sat Mar 19 23:00:15 2005 Return-Path: Delivered-To: freebsd-security@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 99A6216A4CE for ; Sat, 19 Mar 2005 23:00:15 +0000 (GMT) Received: from wproxy.gmail.com (wproxy.gmail.com [64.233.184.204]) by mx1.FreeBSD.org (Postfix) with ESMTP id 26B4A43D2D for ; Sat, 19 Mar 2005 23:00:15 +0000 (GMT) (envelope-from metrol.net@gmail.com) Received: by wproxy.gmail.com with SMTP id 70so743265wra for ; Sat, 19 Mar 2005 15:00:14 -0800 (PST) DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=beta; d=gmail.com; h=received:message-id:date:from:reply-to:to:subject:mime-version:content-type:content-transfer-encoding; b=I8nF9Y+Zu3nl2p5n8IwhRLTc0OugtUxryt1UDm82JNvJHqk6qTY9kqT2mRapGFP342eD4YM/4tmLpYCw0bkHxlbev1EYVWrVw2KXF7awRy3/iqR2SudtPb7BY3PLtoCVNbD4aXGEjrP5upNzSiIHB+6GznU8IxMAlW/SIF8YXIM= Received: by 10.54.7.38 with SMTP id 38mr153813wrg; Sat, 19 Mar 2005 15:00:14 -0800 (PST) Received: by 10.54.51.37 with HTTP; Sat, 19 Mar 2005 15:00:14 -0800 (PST) Message-ID: Date: Sat, 19 Mar 2005 15:00:14 -0800 From: Michael Collette To: FreeBSD Security Mime-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Subject: LDAP and Linux compatibility X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list Reply-To: Michael Collette List-Id: Security issues [members-only posting] List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 19 Mar 2005 23:00:15 -0000 Please excuse a wee bit of cross posting here. It seems that the questions list may not be the appropriate place for this as I've found a number of unanswered posts involving this topic. My FreeBSD workstations are setup with pam_ldap to a centralized openldap server for authentication. This works perfectly for native FreeBSD applications. What I'm running into an issue with are Linux binaries attempting to make a getpwuid_r() call so as to discover the user's uid. So far it seems that the latest Real Player and Adobe Acrobat Reader 7.0 are unable to run without this call functioning. Either application dies with... GLib-WARNING **: getpwuid_r(): failed due to unknown user id I suspect that there are probably several other Linux applications that will have similar problems. The problem is immediately evident with /compat/linux/usr/bin/id when attempting a lookup on an LDAP user. The Linux id command only seems to work on locally stored users. The FreeBSD native id command performs as expected in all cases. The reason I decided to write this mailing list was that it seems that this is more than just a configuration issue. I would have thought that whatever routines are grabbing calls from the Linux apps should be respecting the main system settings. It would appear that what's happening instead is simply a redirect to the local password database. Which now leads into my questions for this list: How do Linux applications determine authorization for users? Do we need linux_pam_ldap, linux_nss_ldap and linux_openldap_client ports to be created to facilitate what I'm talking about? Is there a lower level option of properly masking the Linux call for a uid and returning the appropriate information from the main system? If we're talking about an honest to gosh bug with the system, could someone who has a better understanding of what all is going on give me a hand with putting together a useful PR report? Thanks, -- "When you come to a fork in the road....Take it" - Yogi Berra