[gentoo-dev] Towards less insecure permissions on gentoo

[gentoo-dev] Towards less insecure permissions on gentoo

[Ned Ludd]

Alot of the suid binarys that get installed on a gentoo system seem to
have had there default permissions overlooked.

Today we will cover group and other readable bits and why I think they
should be removed on installed setid ELF's.

Alot of the common buffer overflows exploits these days rely on knowing
a predefined offsets or relocation addresses. Sometimes these offsets
are not known to the exploit itself at compile time and the author often
leaves it up to the local attacker to find the offsets using tools such
as objdump,readelf,examminer. Now if the local attacker is unable read
the binary he/she wont be able to discover these offsets thus making
future exploitation harder to exploit on a gentoo system.

The "least privilege" rule, strictly applied, can save us from a lot of 
unexpected trouble.

You can use the following command to see what setid files you have and
what port they came from. -requires gentoolkit

find / \( -perm 04000 -o -perm -02000 \) -type f -ls 2> /dev/null |
while read line; do suid=`echo $line | awk '{print $11}'` ; echo $line
"[`qpkg -nc -f $suid`]" ; done

Over the next week or so I will be looking over the permissions of
eveything I use and offering unified diffs/patches when/where feasible.

If you currently are a maintainer of a port that installs files 4755(I
hope you all know who you are) please try to get your port to install
4711 or with even less privs. However if your program is a setid
executable script then you should leave the permissions alone.

Below is a suggested patch to the current util-linux ebuild.

http://cvs.gentoo.org/~solar/util-linux-2.11z-r4.ebuild.diff
-- 
Ned Ludd <solar@gentoo.org>
Gentoo Linux (Hardened)


--
gentoo-dev@gentoo.org mailing list

Re: [gentoo-dev] Towards less insecure permissions on gentoo

[Anthony de Boer]

Ned Ludd wrote:
> If you currently are a maintainer of a port that installs files 4755(I
> hope you all know who you are) please try to get your port to install
> 4711 or with even less privs. However if your program is a setid
> executable script then you should leave the permissions alone.

4511, perhaps?

When something is installed by a packaging system, and will be stomped at
the next upgrade without consideration for local mods, I prefer to install
with all writable bits off.  This is more of a concern for those
oh-so-easily-tweakable scripts than for binaries, and at least encourages
the superuser to stop and think before making a change, but especially in
the suid case the more protection the better.

Likewise for installed nonexecutables (terminfo and the like), 444 rather
than 644.

-- 
Anthony de Boer

--
gentoo-dev@gentoo.org mailing list

Re: [gentoo-dev] Towards less insecure permissions on gentoo

[Ned Ludd]

You are correct 04511(-r-s--x--x) would be prefered over
04711(-rws--x--x) or even 04111(---s--x--x) for binary executable
formats.

As for terminfo and the like I've never tested removing the owner
writeable bit. After doing a little scouring around it seems that it
would be easy to test/try it out. In ebuild.sh we find 
( export INSOPTIONS="-m0644" ) on or around line 187. I'm unsure at the
moment if this can be overriden in the /etc/make.conf (It should be)
or what side affects it would have on upgrading.

On Thu, 2003-06-05 at 10:50, Anthony de Boer wrote:
> Ned Ludd wrote:
> > If you currently are a maintainer of a port that installs files 4755(I
> > hope you all know who you are) please try to get your port to install
> > 4711 or with even less privs. However if your program is a setid
> > executable script then you should leave the permissions alone.
> 
> 4511, perhaps?
> 
> When something is installed by a packaging system, and will be stomped at
> the next upgrade without consideration for local mods, I prefer to install
> with all writable bits off.  This is more of a concern for those
> oh-so-easily-tweakable scripts than for binaries, and at least encourages
> the superuser to stop and think before making a change, but especially in
> the suid case the more protection the better.
> 
> Likewise for installed nonexecutables (terminfo and the like), 444 rather
> than 644.
-- 
Ned Ludd <solar@gentoo.org>
Gentoo Linux (Hardened)


--
gentoo-dev@gentoo.org mailing list