From owner-freebsd-security@FreeBSD.ORG  Wed Aug  4 22:58:57 2010
Return-Path: <owner-freebsd-security@FreeBSD.ORG>
Delivered-To: freebsd-security@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id AAE5D1065679
	for <freebsd-security@freebsd.org>;
	Wed,  4 Aug 2010 22:58:57 +0000 (UTC)
	(envelope-from rwatson@FreeBSD.org)
Received: from cyrus.watson.org (cyrus.watson.org [65.122.17.42])
	by mx1.freebsd.org (Postfix) with ESMTP id 845E28FC1D
	for <freebsd-security@freebsd.org>;
	Wed,  4 Aug 2010 22:58:57 +0000 (UTC)
Received: from fledge.watson.org (fledge.watson.org [65.122.17.41])
	by cyrus.watson.org (Postfix) with ESMTPS id 0158946BA4;
	Wed,  4 Aug 2010 18:58:57 -0400 (EDT)
Date: Wed, 4 Aug 2010 23:58:56 +0100 (BST)
From: Robert Watson <rwatson@FreeBSD.org>
X-X-Sender: robert@fledge.watson.org
To: Selphie Keller <selphie.keller@gmail.com>
In-Reply-To: <235BB726E71747BA980A0EF60F76ED37@2WIRE304>
Message-ID: <alpine.BSF.2.00.1008042356240.56647@fledge.watson.org>
References: <235BB726E71747BA980A0EF60F76ED37@2WIRE304>
User-Agent: Alpine 2.00 (BSF 1167 2008-08-23)
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed
Cc: freebsd-security@freebsd.org
Subject: Re: kernel module for chmod restrictions while in securelevel one
 or	higher
X-BeenThere: freebsd-security@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: "Security issues \[members-only posting\]"
	<freebsd-security.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-security>, 
	<mailto:freebsd-security-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-security>
List-Post: <mailto:freebsd-security@freebsd.org>
List-Help: <mailto:freebsd-security-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-security>, 
	<mailto:freebsd-security-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Wed, 04 Aug 2010 22:58:57 -0000


On Fri, 30 Jul 2010, Selphie Keller wrote:

> Kernel module for chmod restrictions while in securelevel one or higher: 
> http://gist.github.com/501800 (fbsd 8.x)
>
> Was looking at the new recent sendfile/mbuf exploit and it was using a 
> shellcode that calls chmod syscall to make a setuid/setgid binary. However 
> was thinking of ways to block the creation of suid/sgid binaries if the 
> machine is in a securelevel, beyond the normal things like nosuid/noexec 
> mount flags for /tmp.
>
> So came up with this quick module to handle it, but the concept of 
> restricting the creation of suid/sgid binaries while in securelevel seems 
> like a good idea to be part of the base.

While I'm not convinced this approach is a good idea (the remainder of the 
thread suggests some reasons why), a better way to implement the same policy 
would be to use the MAC Framework's mpo_vnode_check_setmode entry point.  This 
would catch all the chmod variations, including ones in compatibility ABIs 
such as the Linux ABI.

Robert