Date: Wed, 4 Aug 2010 23:58:56 +0100 (BST) From: Robert Watson <rwatson@FreeBSD.org> To: Selphie Keller <selphie.keller@gmail.com> Cc: freebsd-security@freebsd.org Subject: Re: kernel module for chmod restrictions while in securelevel one or higher Message-ID: <alpine.BSF.2.00.1008042356240.56647@fledge.watson.org> In-Reply-To: <235BB726E71747BA980A0EF60F76ED37@2WIRE304> References: <235BB726E71747BA980A0EF60F76ED37@2WIRE304>
next in thread | previous in thread | raw e-mail | index | archive | help
On Fri, 30 Jul 2010, Selphie Keller wrote: > Kernel module for chmod restrictions while in securelevel one or higher: > http://gist.github.com/501800 (fbsd 8.x) > > Was looking at the new recent sendfile/mbuf exploit and it was using a > shellcode that calls chmod syscall to make a setuid/setgid binary. However > was thinking of ways to block the creation of suid/sgid binaries if the > machine is in a securelevel, beyond the normal things like nosuid/noexec > mount flags for /tmp. > > So came up with this quick module to handle it, but the concept of > restricting the creation of suid/sgid binaries while in securelevel seems > like a good idea to be part of the base. While I'm not convinced this approach is a good idea (the remainder of the thread suggests some reasons why), a better way to implement the same policy would be to use the MAC Framework's mpo_vnode_check_setmode entry point. This would catch all the chmod variations, including ones in compatibility ABIs such as the Linux ABI. Robert
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?alpine.BSF.2.00.1008042356240.56647>