Skip site navigation (1)Skip section navigation (2)
Date:      Sat, 5 Jun 2004 18:18:48 +1000 (Australia/ACT)
From:      Darren Reed <avalon@caligula.anu.edu.au>
To:        colin.percival@wadham.ox.ac.uk (Colin Percival)
Cc:        freebsd-security@freebsd.org
Subject:   Re: syslogd(8) Dropping Privs
Message-ID:  <200406050818.i558ImAC003171@caligula.anu.edu.au>
In-Reply-To: <6.1.0.6.1.20040604235214.03fec120@popserver.sfu.ca> from "Colin Percival" at Jun 04, 2004 11:57:51 PM

next in thread | previous in thread | raw e-mail | index | archive | help
In some mail from Colin Percival, sie said:
> At 20:53 04/06/2004, Crist J. Clark wrote:
> >We haven't had many syslogd(8) vulnerabilities lately, but one
> >less daemon running as root seems like a Good Thing. I do not
> >see any drawbacks from a security point of view. The log files
> >would have to be owned, or otherwise writeable, by this other
> >user, but so what. Obviously, I may be missing something.
> 
>   One consideration is that if syslogd is not running as root,
> it will no longer be able to write to a filesystem which is
> already "full".
>   On systems where non-root users can write to the filesystem
> containing /var/log (and are not limited by quotas) this would
> allow non-root users to disable logging, which would probably
> be a Bad Thing.

One way or another, you can generally exploit a DoS attack against
syslogd with disk space.

Well at least with current sources, anyway.

Lets pretend that /var/log is its own filesystem, isolated from
a full /var/tmp.

The attack is then to just spam syslogd with lots of data such
that it fills /var/log.  Granted this is harder but not impossible.
How do you defend against that?  Add code to rate limit messages
from a given source to a max of x kb/s ?

As an "out there" suggestion, you might increase the % for root
only to be greater than 10% on a /var/log so you can always run
newsyslog successfully.

Darren



Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200406050818.i558ImAC003171>