Date: Mon, 7 Jul 1997 13:08:32 -0400 (EDT) From: Robert N Watson <rnw@andrew.cmu.edu> To: "Jonathan M. Bresler" <jmb@FreeBSD.ORG> Cc: freebsd-security@FreeBSD.ORG Subject: Re: Security Model/Target for FreeBSD or 4.4? Message-ID: <Pine.SUN.3.93l.970707130204.13617D-100000@apriori.cc.cmu.edu> In-Reply-To: <199707062150.OAA07546@hub.freebsd.org>
next in thread | previous in thread | raw e-mail | index | archive | help
On Sun, 6 Jul 1997, Jonathan M. Bresler wrote: > Jordan K. Hubbard wrote: > > > > > I also spent a couple of hours fighting with Alta Vista looking for relevant > > > documents and didn't find very much. Any other suggestions? > > > > /usr/src? :) > > > > Seriously, I doubt you'll find that anyone has sat down and documented > > this aspect of the system specifically. If you want to study the > > security implementation in detail, the sources remain the first and > > foremost resource. In fact, they probably represent the ONLY resource. > > Good luck! > > in a nutshell, the security model is > "you must have permission to do something". > the superuser (aka root: uid 0) is can do anything. > command audit trail (logging) is not provided. > the holes have been in the implementation of that model. > the source shows the implementation. which has been of greatly > varying quality regarding security. ;( I've heard that OpenBSD now has a feature to allow non-root users to bind to <1024 ports. It would be nice to see something similar to that under FreeBSD -- half the daemons (not a verified figure) that run as root probably don't need root access, except to bind to the port (named, sendmail, web servers, etc.) I believe the OpenBSD implementation just gives this access to the daemon user (or something to that extent? Would love details), but perhaps we could go for something a little more sophisticated if it doesn't up the overhead too much on the kernel? A limited list of (port, user) (say a max of 64, except as configured in the kernel), and if the bind() call matches this for TCP, allow the program to bind, for example. An appropriate root-owned file (/etc/rc.conf?) could define those permissions in an ipfirewall-style setup, running early in the rc sequence. This would potentially open up more holes as extra configuration files have to be monitored, and add more overhead on bind() calls, not to mention adding a configuration mechanism, but not suffering from the numerous problems involving daemons running as root (without having to rewrite all the daemons) would be nice. Even the single-user unconfigurable approach (root and daemon can bind) would be better than nothing. Just a thought.. Robert Watson
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?Pine.SUN.3.93l.970707130204.13617D-100000>