From owner-freebsd-security Mon Jul 12 1:45:10 1999 Delivered-To: freebsd-security@freebsd.org Received: from fledge.watson.org (fledge.watson.org [204.156.12.50]) by hub.freebsd.org (Postfix) with ESMTP id 76D9F14BE4 for ; Mon, 12 Jul 1999 01:45:07 -0700 (PDT) (envelope-from robert@cyrus.watson.org) Received: from fledge.watson.org (robert@fledge.pr.watson.org [192.0.2.3]) by fledge.watson.org (8.8.8/8.8.8) with SMTP id EAA08971; Mon, 12 Jul 1999 04:43:15 -0400 (EDT) (envelope-from robert@cyrus.watson.org) Date: Mon, 12 Jul 1999 04:43:15 -0400 (EDT) From: Robert Watson X-Sender: robert@fledge.watson.org Reply-To: Robert Watson To: Darren Reed Cc: proff@suburbia.net, imp@village.org, alla@sovlink.ru, security@FreeBSD.ORG Subject: Re: Syslog alternatives? In-Reply-To: <199907110904.TAA01620@cheops.anu.edu.au> Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org On Sun, 11 Jul 1999, Darren Reed wrote: > In some mail from Robert Watson, sie said: > [...] > > I still lean towards a combination of existing securelevel code, and a > > protected process flag indicating that the process may not be intefered > > with by unauthorized userland code (i.e., no debugging, signaling, etc). > > That can be used to solve a suite of different problems. Interesting idea, > none the less. I've been meaning to implement this for a long time, as I've needed it for auditing stuff, as well as a number of other projects. I wonder if it would be appropriate to work on a more general policy, such as requiring processes to flag themselves as accessible from higher securelevels before they are. There might be some race conditions involving forks and pipes, however... Robert N M Watson robert@fledge.watson.org http://www.watson.org/~robert/ PGP key fingerprint: AF B5 5F FF A6 4A 79 37 ED 5F 55 E9 58 04 6A B1 TIS Labs at Network Associates, Computing Laboratory at Cambridge University Safeport Network Services To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message