Re: systrace insecure [was: Re: chroot browser]

2009-04-04 Thread Edd Barrett
Howdy, On Thu, Mar 26, 2009 at 09:12:42AM -0600, Theo de Raadt wrote: That said, this is not enough reason to entirely delete the code. It still has uses. It's useful for checking ports are not dumping junk all over the file-system. Please keep it. Best Regards Edd Barrett (Freelance

Re: systrace insecure [was: Re: chroot browser]

2009-04-03 Thread Niels Provos
On Thu, Mar 26, 2009 at 8:23 AM, Jonathan Schleifer js-openbsd-m...@webkeks.org wrote: It was removed when I reported a bug in NETBSD-5-0 that would crash the Kernel when you tried to use systrace. Instead of fixing that, they removed it. Looks like you will have to run OpenBSD then. For my

systrace insecure [was: Re: chroot browser]

2009-03-26 Thread Jonathan Schleifer
Am 26.03.2009 um 07:17 schrieb Tobias Weisserth: I guess you should take a look at Systrace: http://en.wikipedia.org/wiki/Systrace This was removed from NetBSD some time ago because it is vulnerable. They said it's not only possible to circumvent it, but also gain root using it. Is this

Re: systrace insecure [was: Re: chroot browser]

2009-03-26 Thread Theo de Raadt
I guess you should take a look at Systrace: http://en.wikipedia.org/wiki/Systrace This was removed from NetBSD some time ago because it is vulnerable. They said it's not only possible to circumvent it, but also gain root using it. Is this fixed in OpenBSD somehow? They freaked out

Re: systrace insecure [was: Re: chroot browser]

2009-03-26 Thread Jonathan Schleifer
Am 26.03.2009 um 16:12 schrieb Theo de Raadt: They freaked out and did the wrong thing. It was removed when I reported a bug in NETBSD-5-0 that would crash the Kernel when you tried to use systrace. Instead of fixing that, they removed it. systrace has a small problem. It is a very

Re: systrace insecure [was: Re: chroot browser]

2009-03-26 Thread Gregg Reynolds
On Thu, Mar 26, 2009 at 10:12 AM, Theo de Raadt dera...@cvs.openbsd.org wrote: real; systrace does have the ability to grant root unless you build Should that read does not? the policy specifically to do such a stupid thing (actually, I am not -g

Re: systrace insecure [was: Re: chroot browser]

2009-03-26 Thread Theo de Raadt
On Thu, Mar 26, 2009 at 10:12 AM, Theo de Raadt dera...@cvs.openbsd.org wrote: real; systrace does have the ability to grant root unless you build Should that read does not? the policy specifically to do such a stupid thing (actually, I am not Oh, indeed. Sorry. systrace cannot