Date: Sat, 5 Jun 2004 18:18:48 +1000 (Australia/ACT) From: Darren Reed <avalon@caligula.anu.edu.au> To: colin.percival@wadham.ox.ac.uk (Colin Percival) Cc: freebsd-security@freebsd.org Subject: Re: syslogd(8) Dropping Privs Message-ID: <200406050818.i558ImAC003171@caligula.anu.edu.au> In-Reply-To: <6.1.0.6.1.20040604235214.03fec120@popserver.sfu.ca> from "Colin Percival" at Jun 04, 2004 11:57:51 PM
next in thread | previous in thread | raw e-mail | index | archive | help
In some mail from Colin Percival, sie said: > At 20:53 04/06/2004, Crist J. Clark wrote: > >We haven't had many syslogd(8) vulnerabilities lately, but one > >less daemon running as root seems like a Good Thing. I do not > >see any drawbacks from a security point of view. The log files > >would have to be owned, or otherwise writeable, by this other > >user, but so what. Obviously, I may be missing something. > > One consideration is that if syslogd is not running as root, > it will no longer be able to write to a filesystem which is > already "full". > On systems where non-root users can write to the filesystem > containing /var/log (and are not limited by quotas) this would > allow non-root users to disable logging, which would probably > be a Bad Thing. One way or another, you can generally exploit a DoS attack against syslogd with disk space. Well at least with current sources, anyway. Lets pretend that /var/log is its own filesystem, isolated from a full /var/tmp. The attack is then to just spam syslogd with lots of data such that it fills /var/log. Granted this is harder but not impossible. How do you defend against that? Add code to rate limit messages from a given source to a max of x kb/s ? As an "out there" suggestion, you might increase the % for root only to be greater than 10% on a /var/log so you can always run newsyslog successfully. Darren
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200406050818.i558ImAC003171>