On Mon, Aug 24 2009, andrew mcelroy wrote:
> On Sun, Aug 23, 2009 at 11:28 PM, Manoj Srivastava <[email protected]>wrote:
>
>>
>> On Sun, Aug 23 2009, andrew mcelroy wrote:
>>
>> > I have been working on taking over _why's Try Ruby program.
>> > Essentially, it is a webpage that employs ajax to talk to a ruby
>> interpretor
>> > on a server to give you an interactive shell.
>> > This interactive shell would come with lessons that would teach basic
>> ruby
>> > scripting.
>>
>> > The trouble I am running into is deciding how to best secure this
>> program.
>> > I noticed that it allows for the use of the system method; and yes I have
>> > been able to read /etc/passwd.
>>
>> The obvious solution appears to be mandatory, role based access
>> controls, SELinux would do everything you want. chroots are not really
>> meant for security; and virtual machines are overkill.
> I am pretty paranoid, so selinux inside a vm might be the way to go.
Unless your host is also protected, SELinux on the guest buys
you stuff, but it is still a house built on sand.
> I guess I now can no longer slack off learning SELinux.
> Being that your a maintainer for Debian, I can presume that Debian has
> out of the box support for SELinux, no?
Actually, for out of the box support, fedora is still your best
bet. Having an corporation with a boss and supporting only a fraction
of what Debian supports makes it easier for fedora to achieve
compliance, and they have invested a lot of effort into SELinux to
boot. In Debian, with 20K packages, it is like herding cats.
However, that being said, the play machine below is just a lenny
box, with minor policy tweaks.
> Under an selinux system, I should be able to sandbox a ruby
> interpretor to an explicit list of directories, right?
Sure. You might have to write your own container policy, but
you are trying for a highly tailored situation. You can certainly keep
it out of /etc pretty easily.
Or ask Russel for his tweaked policy, heck, man, f root can't
mess up the play machine, your interpreter will have a hard time
breaking out.
> If so, this would be fantastic, as there is a part of the lesson plan that
> lets the user create and manipulate a file
> on the server.
>
>>
>> For instance, see http://www.coker.com.au/selinux/play.html
>> He gives out root passwords on the web page.
>>
>
> neat.
I'm serious. Log in. play around. See the wonders of SELinux.
manoj
--
It's always darkest just before the lights go out. Alex Clark
Manoj Srivastava <[email protected]> <http://www.debian.org/~srivasta/>
1024D/BF24424C print 4966 F272 D093 B493 410B 924B 21BA DABB BF24 424C
--~--~---------~--~----~------------~-------~--~----~
You received this message because you are subscribed to the Google Groups
"NLUG" group.
To post to this group, send email to [email protected]
To unsubscribe from this group, send email to
[email protected]
For more options, visit this group at
http://groups.google.com/group/nlug-talk?hl=en
-~----------~----~----~----~------~----~------~--~---
