[5438] in RedHat Linux List
RE: RedHat4.0 security
daemon@ATHENA.MIT.EDU (Dwight Hubbard)
Thu Nov 21 16:14:29 1996
From: "Dwight Hubbard" <Dwight.Hubbard@MCI.Com>
To: "'redhat-list@redhat.com'" <redhat-list@redhat.com>
Date: Thu, 21 Nov 1996 15:12:15 -0600
Resent-From: redhat-list@redhat.com
Reply-To: redhat-list@redhat.com
I think instead of a "Paranoid Security" install option it would be =
better to have a control panel type widget that allows turning things =
on/off based on need.
----------
From: Chris Evans[SMTP:chris@ferret.lmh.ox.ac.uk]
Sent: Thursday, November 21, 1996 3:41 PM
To: redhat-list@redhat.com
Subject: RE: RedHat4.0 security
On Thu, 21 Nov 1996, Erik Troan wrote:
> On Thu, 21 Nov 1996, Dwight Hubbard wrote:
>=20
> > Could you summarize why each one is set uid??=20
>=20
> <sigh> I don't know why I'm doing this.
Well, from your answers, looks like it was worth it! :-)
> -rwsr-xr-x- root daemon 17732 Aug 09 11:32 /usr/bin/at
>=20
> Writes to /var/spool/at when you submit jobs.
Well, whats wrong with sgid + suitable group? True, a buffer overflow=20
could then be used to write root executing jobs in the config files,=20
gaining you little...
> -rwsr-sr-x- root tty 51296 Aug 29 16:30 /sbin/dump
> -rwsr-sr-x- root tty 55376 Aug 29 16:30 /sbin/restore
>=20
> Uses rsh internally for remote dump/restore.
Hmm. So this is catering for the fact that non-root users on the local=20
system might be system administrators of remote machines, and wanting to =
initialise backups??! How many people would suffer loss of functionality =
if these weren't suid root? Isn't rsh suid root anyway? I'm probably=20
missing something, but disapprove most strongly.
[snip..etc]
> -rws--x--x- root root 15448 Sep 02 11:28 =
/usr/games/vga_mines
> -rws--x--x- root root 18028 Sep 02 11:28 =
/usr/games/vga_othello
> -r-s--x--x- root root 61240 Sep 02 11:30 =
/usr/games/tetris
> -rws--x--x- root root 159472 Nov 20 17:27 =
/usr/X11R6/bin/kterm
> -r-s--x--x- root root 88272 Sep 02 11:48 /usr/bin/zgv
>=20
> SVGAlib
Have these been verified for command line arg buffer overflows + =
dropping=20
of permissions the moment they have ioperm()'ed video I/O? Likewise for=20
programs only needing privilege briefly to, for example, open raw =
network=20
sockets.
> -r-sr-sr-x- root lp 13404 Oct 25 13:10 /usr/bin/lpq
> -r-sr-sr-x- root lp 14508 Oct 25 13:10 /usr/bin/lpr
> -r-sr-sr-x- root lp 14164 Oct 25 13:10 /usr/bin/lprm
>=20
> Secure port and access to /var/spool/lpd
Is the LRPng solution still being worked on?
> -rwsr-xr-x- root root 74628 Oct 27 09:01 =
/usr/lib/mc/bin/cons.saver
>=20
> Good question. I'm asking about this one.
I thought this highly dubious too.
> -rwsr-sr-x- root mail 72628 Oct 17 17:57 /usr/bin/mh/inc
> -rwsr-xr-x- root root 52536 Oct 17 17:57 =
/usr/bin/mh/msgchk
>=20
> Access /var/spool/mail
If that's all, sgid + group mail would seem more appropriate.
> -rwsr-xr-x- root root 29712 Aug 30 15:01 /bin/mount
> -rwsr-xr-x- root root 16360 Aug 30 15:01 /bin/umount
>=20
> For "user" mount attribute.
I would guess only a small amount of people use this; most users of=20
machines wanting to be secure, won't have console access etc. The =
install=20
proceedure should have a "paranoid security" option which among other=20
things won't install these suid root. Reference: recent appalling mount =
hole.
> -rwsr-xr-x- root root 8356 Oct 22 14:49 /sbin/cardctl
>=20
> Allows any user to look at pcmcia configuration (only root is allowed =
to
> modify it -- I'm not sure this is a good idea but it is what the =
author
> recommends).
I really wish more people would look at UNIX security like this: "Does a =
user have a specific NEED to be able to do XXX?". PCMCIA config sounds=20
somewhat like a system administrators task to me...
> -rwsr-sr-x- root mail 54384 Aug 11 23:14 =
/usr/bin/procmail
>=20
> Accesses /var/spool/mail
See above.
> -r-sr-xr-x- root root 10412 Aug 14 11:35 =
/usr/X11R6/bin/XConsole
>=20
> Reads /dev/console
Again, sgid + special group?
> -rwsr-xr-x- root root 52244 Nov 20 17:05 =
/usr/X11R6/bin/rxvt
> -rwsr-xr-x- root root 264036 Oct 24 14:57 /usr/bin/screen
> -rws--x--x- root root 136504 Nov 20 15:04 =
/usr/X11R6/bin/nxterm
> (add xterm to this list [we don't have the XFree packages in devel =
right now)
>=20
> Updates utmp/wtmp.
If that was all, a "utmp/wtmp" group would be appropriate. However,=20
changing tty ownership is also an issue. Ideally programs like these =
will=20
open the utmp/wtmp file, change ownership of the tty, then immediately=20
drop privs.
Comments welcome.
Chris. (roll on POSIX.6)
--
PLEASE read the Red Hat FAQ, Tips, Errata and the MAILING LIST =
ARCHIVES!
=
________________________________________________________________________
http://www.redhat.com/RedHat-FAQ http://www.redhat.com/RedHat-Errata
http://www.redhat.com/RedHat-Tips http://www.redhat.com/mailing-lists
=
------------------------------------------------------------------------
To unsubscribe: mail -s unsubscribe redhat-list-request@redhat.com < =
/dev/null
--
PLEASE read the Red Hat FAQ, Tips, Errata and the MAILING LIST ARCHIVES!
________________________________________________________________________
http://www.redhat.com/RedHat-FAQ http://www.redhat.com/RedHat-Errata
http://www.redhat.com/RedHat-Tips http://www.redhat.com/mailing-lists
------------------------------------------------------------------------
To unsubscribe: mail -s unsubscribe redhat-list-request@redhat.com < /dev/null
