From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from pigeon.gentoo.org ([69.77.167.62] helo=lists.gentoo.org) by finch.gentoo.org with esmtp (Exim 4.60) (envelope-from ) id 1L55v9-00070K-6s for garchives@archives.gentoo.org; Tue, 25 Nov 2008 21:58:11 +0000 Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id CA54EE03F1; Tue, 25 Nov 2008 21:58:11 +0000 (UTC) Received: from ik-out-1112.google.com (ik-out-1112.google.com [66.249.90.182]) by pigeon.gentoo.org (Postfix) with ESMTP id 8260BE03F1 for ; Tue, 25 Nov 2008 21:58:11 +0000 (UTC) Received: by ik-out-1112.google.com with SMTP id b32so153579ika.2 for ; Tue, 25 Nov 2008 13:58:09 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:from:to:subject:date :user-agent:references:in-reply-to:mime-version:content-type :content-transfer-encoding:content-disposition:message-id; bh=Gg0LqRUZf7Xo1LAEwYgJOuEOt2qGj1Ua95REQdOM1IM=; b=ufy46MAlhAjhDPmTH/7CYbShSAwC7m/WSVeF5jtei1ARGkSNsupaga7MjaJfAWmM+G 53lu4jhEBWojhUd2l9AcVX4LzSwlmXcNColAdxDEBjf3y99KgtqrdgsDvcJ/XPS4P+JI pb7BGuifTFhUx6Hn36RB0++plJJweeSk1PQ+I= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=from:to:subject:date:user-agent:references:in-reply-to:mime-version :content-type:content-transfer-encoding:content-disposition :message-id; b=lxZWXN336w/0om3mk8YkBJcUyxdyHOXMYubhEHTK+w3GueamYMX5MnRG/cCtqXD6gk Jfym8DWiktPz6iWS9YwzB8spfCH/vxde+6E3l4E9KbCu1Q8xjJ5wfsQ8OmHoEPR3LQt9 WLMcpuzmcS2ZtEqakP0z/yKXNGERdcR3nzGSc= Received: by 10.210.42.20 with SMTP id p20mr5320767ebp.4.1227650289174; Tue, 25 Nov 2008 13:58:09 -0800 (PST) Received: from ?192.168.7.111? ([62.63.130.154]) by mx.google.com with ESMTPS id c22sm3950920ika.0.2008.11.25.13.58.08 (version=TLSv1/SSLv3 cipher=RC4-MD5); Tue, 25 Nov 2008 13:58:08 -0800 (PST) From: Jan Klod To: gentoo-hardened@lists.gentoo.org Subject: Re: [gentoo-hardened] hardened workstation - is that worth it? Date: Tue, 25 Nov 2008 21:58:06 +0000 User-Agent: KMail/1.9.9 References: <200811251700.45540.janklodvan@gmail.com> <4255c2570811251158n28f3274ch34e87a1a3f1eacb6@mail.gmail.com> In-Reply-To: <4255c2570811251158n28f3274ch34e87a1a3f1eacb6@mail.gmail.com> Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-hardened@lists.gentoo.org Reply-to: gentoo-hardened@lists.gentoo.org MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit Content-Disposition: inline Message-Id: <200811252158.06957.janklodvan@gmail.com> X-Archives-Salt: 9607b0f9-fcbb-46c7-9cbb-7fce8f20a448 X-Archives-Hash: a33c01b075790a5cb42d7d9c77ca9664 On Tuesday 25 November 2008 19:58:42 RB wrote: > KDE (and to a lesser extent X) pretty much nullifies most application > isolation efforts you're going to make. Actually, that sound like there is practically no way to keep networked workstation really secure. Sure, is not trivial to gain root access through software bugs (interesting, how many list member would be able to do it?), but no one running X can claim, he has absolutely secure system, which can't fail him regardless to who is the hacker. Furthermore, the system is said to be only as secure as the weakest part, so making hardened server will only slow down attacks and, at most, ensure server stability. Still, if there is someone ready to attack servers end clients (which ones will almost always have X running), the way can be open. Can someone explain how would it happen, the exploitation of buffer overflow in X? How would attacker gain access to X bug most importantly? What are those ways for other apps? Always different? And have there been any efforts to make PaX enabled X? Personally, I think, the best way would be using firewall to allow only the most necessary addresses, which point to trusted services (mail,sftp,...). That said, web browsing is cut off. As a conclusion of what I have read this far I can state: hardened OS is useless for non-server. Would that be too much? Well, I think, in a "black and white" no. (later is a discussion of what is better: to have 3 holes or 300) Comments?