Kernel module for chmod restrictions while in securelevel one or higher: http://gist.github.com/501800 (fbsd 8.x)
Was looking at the new recent sendfile/mbuf exploit and it was using a shellcode that calls chmod syscall to make a setuid/setgid binary. However was thinking of ways to block the creation of suid/sgid binaries if the machine is in a securelevel, beyond the normal things like nosuid/noexec mount flags for /tmp. So came up with this quick module to handle it, but the concept of restricting the creation of suid/sgid binaries while in securelevel seems like a good idea to be part of the base. -Estella Mystagic _______________________________________________ [email protected] mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-security To unsubscribe, send any mail to "[email protected]"
