From owner-freebsd-hackers Sat Oct 30 15:32:40 1999 Delivered-To: freebsd-hackers@freebsd.org Received: from polaris.we.lc.ehu.es (polaris.we.lc.ehu.es [158.227.6.43]) by hub.freebsd.org (Postfix) with ESMTP id 0A69B15195 for ; Sat, 30 Oct 1999 15:32:35 -0700 (PDT) (envelope-from borjam@we.lc.ehu.es) Received: from sirius.we.lc.ehu.es (sirius [158.227.6.30]) by polaris.we.lc.ehu.es (8.9.1/8.9.1) with ESMTP id AAA21306 for ; Sun, 31 Oct 1999 00:32:33 +0200 (MET DST) From: Borja Marcos Received: (from borjam@localhost) by sirius.we.lc.ehu.es (8.9.1/8.9.1) id AAA16912 for hackers@freebsd.org; Sun, 31 Oct 1999 00:32:32 +0200 (MET DST) Message-Id: <199910302232.AAA16912@sirius.we.lc.ehu.es> Subject: exec() security enhancement To: hackers@freebsd.org Date: Sun, 31 Oct 1999 00:32:32 +0200 (MET DST) X-Mailer: ELM [version 2.4 PL24] Content-Type: text Sender: owner-freebsd-hackers@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.ORG Hello, Many security exploits create files in the /tmp directory and execute them. I think it would be a good idea to add logging to the to exec_check_permissions() in kern.exec.c so that attempts to run files from a filesystem mounted as "noexec" can be detected. With this measeure, and mounting /tmp as "noexec" some generic hostile acts (wow, how does it sound! :-) ) could be detected. Regards, Borja. -- *********************************************************************** Borja Marcos * Internet: borjam@we.lc.ehu.es Alangoeta, 11 1 izq * borjamar@sarenet.es 48990 - Algorta (Vizcaya) * borjam@well.com SPAIN * CompuServe: 100015,3502 *********************************************************************** --- FreeBSD, turning PCs into workstations To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-hackers" in the body of the message