From owner-freebsd-security Tue Feb 2 21:06:34 1999 Return-Path: Received: (from majordom@localhost) by hub.freebsd.org (8.8.8/8.8.8) id VAA18774 for freebsd-security-outgoing; Tue, 2 Feb 1999 21:06:34 -0800 (PST) (envelope-from owner-freebsd-security@FreeBSD.ORG) Received: from goliath.camtech.net.au (goliath.camtech.net.au [203.5.73.2]) by hub.freebsd.org (8.8.8/8.8.8) with ESMTP id VAA18709; Tue, 2 Feb 1999 21:06:24 -0800 (PST) (envelope-from newton@camtech.com.au) Received: from sebastion.sa.camtech.com.au (sebastion.sa.camtech.com.au [203.28.3.2]) by goliath.camtech.net.au (8.8.5/8.8.2) with ESMTP id PAA17999; Wed, 3 Feb 1999 15:34:59 +1030 (CST) Received: (from smtp@localhost) by sebastion.sa.camtech.com.au (8.8.5/8.8.7) id PAA22932; Wed, 3 Feb 1999 15:35:59 +1030 (CST) Received: from slingshot(192.168.1.2) by sebastion via smap (V2.0) id xma022930; Wed, 3 Feb 99 15:35:49 +1030 Received: from frenzy.ct (newton@frenzy.ct [192.168.4.65]) by slingshot.ct (8.9.1/8.9.1) with ESMTP id PAA01574; Wed, 3 Feb 1999 15:35:46 +1030 (CST) From: Mark Newton Received: (from newton@localhost) by frenzy.ct (8.8.8/8.8.8) id PAA19809; Wed, 3 Feb 1999 15:35:44 +1030 (CDT) Message-Id: <199902030505.PAA19809@frenzy.ct> Subject: Re: tcpdump In-Reply-To: from Robert Watson at "Feb 2, 99 11:35:47 pm" To: robert+freebsd@cyrus.watson.org Date: Wed, 3 Feb 1999 15:35:44 +1030 (CDT) Cc: jkh@zippy.cdrom.com, jmb@FreeBSD.ORG, woodford@cc181716-a.hwrd1.md.home.com, security@FreeBSD.ORG X-Mailer: ELM [version 2.4ME+ PL32 (25)] MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org Robert Watson wrote: > As Matt points out, the security limitations are not very clear: the > securelevel code generally requires a lot of modifications to the base > system, so my temptation is to ignore the issue, but create a securelevel > man page that discusses "things to do in making a securelevel-friendly > system", and add to it: disable bpf. In case this hasn't already been suggested (and apologies if it has): Make opens on /dev/bpf* fail if securelevel > 0 - mark --- Mark Newton Email: newton@camtech.com.au Systems Engineer and Senior Trainer Phone: +61-8-8303-3300 Camtech (SA), a member of the Fax: +61-8-8303-4403 CAMTECH group of companies WWW: http://www.camtech.com.au To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message