From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80]) by finch.gentoo.org (Postfix) with ESMTP id 2350F1381F3 for ; Mon, 9 Sep 2013 16:04:30 +0000 (UTC) Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id 453DCE0B79; Mon, 9 Sep 2013 16:04:21 +0000 (UTC) Received: from outpost1.zedat.fu-berlin.de (outpost1.zedat.fu-berlin.de [130.133.4.66]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by pigeon.gentoo.org (Postfix) with ESMTPS id 366F6E0869 for ; Mon, 9 Sep 2013 16:04:20 +0000 (UTC) Received: from inpost2.zedat.fu-berlin.de ([130.133.4.69]) by outpost1.zedat.fu-berlin.de (Exim 4.80.1) for gentoo-user@lists.gentoo.org with esmtp (envelope-from ) id <1VJ3wo-0026xi-VV>; Mon, 09 Sep 2013 18:04:19 +0200 Received: from dslb-188-103-162-065.pools.arcor-ip.net ([188.103.162.65] helo=bifrost.fritz.box) by inpost2.zedat.fu-berlin.de (Exim 4.80.1) for gentoo-user@lists.gentoo.org with esmtpsa (envelope-from ) id <1VJ3wo-000Fh9-PQ>; Mon, 09 Sep 2013 18:04:18 +0200 Date: Mon, 9 Sep 2013 18:04:14 +0200 From: Hinnerk van Bruinehsen To: gentoo-user@lists.gentoo.org Subject: Re: [gentoo-user] Internet security. Message-ID: <20130909160414.GB12070@bifrost.fritz.box> References: <522D257C.5060902@gmail.com> <522D9689.6080309@thegeezer.net> <20130909142822.GA12070@bifrost.fritz.box> <522DE997.9000706@thegeezer.net> Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-user@lists.gentoo.org Reply-to: gentoo-user@lists.gentoo.org MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="v9Ux+11Zm5mwPlX6" Content-Disposition: inline In-Reply-To: <522DE997.9000706@thegeezer.net> User-Agent: Mutt/1.5.21 (2010-09-15) X-Originating-IP: 188.103.162.65 X-Archives-Salt: ca80c36a-a87f-47e4-bc26-76567db6da7d X-Archives-Hash: 82292f052c44bda0952ce7f93929762f --v9Ux+11Zm5mwPlX6 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Mon, Sep 09, 2013 at 04:30:31PM +0100, thegeezer wrote: > >> i read in slashdot that there is a question mark over SELinux because = it came > >> from the NSA [4] but this is nonsense, as it is a means of securing pr= ocesses > >> not network connections. i find it difficult to believe that a backdo= or in a > >> locked cupboard in your house can somehow give access through the fron= t door. > > This point you get wrong. SELinux implement the LSM API (in fact the LS= M API > > was tailored to SELinux needs). It has hooks in nearly everything > > (file/directory access, process access and also sockets). One of the bi= ggest > > concerns at the time of creation of the LSM API was rootkits hooking th= at > > functions. It's definitively a thread. I'm not saying that SELinux cont= ains > > a backdoor (I for myself would have hidden it in the LSM part, not in S= ELinux > > because that would enable me to use it even if other LSMs are used). If= you > > google for "underhanded C contest" you'll see that it's possible to hide > > malicious behaviour in plain sight. And if the kernel is compromised al= l other > > defenses mean nothing. (As I said, I don't want to spread fearbut that= is > > something to consider imho). > Interesting, I didn't realise LSM provisioned hooks for SELinux - > thought it it was more modular (and less 'shoehorned') than that.=20 > I need to go read about that some more now You can start here: http://www.freetechbooks.com/efiles/selinuxnotebook/The_SELinux_Notebook_Th= e_Foundations_3rd_Edition.pdf for a general overview (page 64ff has a list of the hooks). Other than that http://www.kroah.com/linux/talks/ols_2002_lsm_paper/lsm.pdf= and http://www.nsa.gov/research/_files/publications/implementing_selinux.pdf ma= y be of interest (though both are quite old). WKR Hinnerk --v9Ux+11Zm5mwPlX6 Content-Type: application/pgp-signature; name="signature.asc" Content-Description: Digital signature -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.21 (GNU/Linux) iQEcBAEBAgAGBQJSLfF+AAoJEJwwOFaNFkYc9O8H/AmaM4neqb7vKyQp/hI4ZQfy dCdm1SsFF3BdUxr4Vhb71FiL/jvLfK//gWQH3cw0+hss344xiRYznOH/ZjJlSIVz +XUIu75kaylqk+7OkzHY2VCd3JDGnDX4Z+JdEL903Z4O1oGbcc+URu8lDrpUCiD/ MtQz29FRujdNdxT7jFv/M1yzt4iKdov/I5sTnM/I5LWXUqnunpOK8Zsb0uvxlZfD j0EH12qWrrA403O2q0zgiGVEejgQspJ+e3XUqzGRQJfEjK5GZR+7P36MKOUjIi6T smYnf4hXHLNF/DFytsnfBhHys3D56E6j9+FZ41GqaRD4n8DC7elUIUm8J32xYko= =BhS7 -----END PGP SIGNATURE----- --v9Ux+11Zm5mwPlX6--