Re: [PATCH] Filesystem linking protections

2005-02-07 Thread John Richard Moser
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Chris Wright wrote: > * John Richard Moser ([EMAIL PROTECTED]) wrote: > >>Yes, mkdtemp() and mkstemp(). >> >>Of course we can't always rely on programmers to get it right, so the >>idea here is to make sure we ask broken code to behave nicely, and

Re: [PATCH] Filesystem linking protections

2005-02-07 Thread Chris Wright
* John Richard Moser ([EMAIL PROTECTED]) wrote: > Yes, mkdtemp() and mkstemp(). > > Of course we can't always rely on programmers to get it right, so the > idea here is to make sure we ask broken code to behave nicely, and stab > it in the face if it doesn't. Please try to examine this in that

Re: [PATCH] Filesystem linking protections

2005-02-07 Thread John Richard Moser
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Chris Wright wrote: > * John Richard Moser ([EMAIL PROTECTED]) wrote: > >>I've yet to see this break anything on Ubuntu or Gentoo; Brad Spengler >>claims this breaks nothing on Debian. On the other hand, this could >>potentially squash the second

Re: [PATCH] Filesystem linking protections

2005-02-07 Thread Valdis . Kletnieks
On Mon, 07 Feb 2005 23:00:33 +0100, Lorenzo =?ISO-8859-1?Q?Hern=E1ndez_?= =?ISO-8859-1?Q?Garc=EDa-Hierro?= said: > A sysctl can be a good option, creating a CTL_SECURITY and then > registering stuff under it, but this requires to have the kernel hackers > agree with implementing a new security

Re: [PATCH] Filesystem linking protections

2005-02-07 Thread Lorenzo Hernández García-Hierro
El lun, 07-02-2005 a las 16:45 -0500, [EMAIL PROTECTED] escribió: > On Mon, 07 Feb 2005 20:34:33 +0100, Lorenzo =?ISO-8859-1?Q?Hern=E1ndez_?= > =?ISO-8859-1?Q?Garc=EDa-Hierro?= said: > > > But It's better to give users a "secure-by-default" status, at least on > > those parts that don't affect

Re: [PATCH] Filesystem linking protections

2005-02-07 Thread Valdis . Kletnieks
On Mon, 07 Feb 2005 20:34:33 +0100, Lorenzo =?ISO-8859-1?Q?Hern=E1ndez_?= =?ISO-8859-1?Q?Garc=EDa-Hierro?= said: > But It's better to give users a "secure-by-default" status, at least on > those parts that don't affect negatively the stability or the > performance itself. It's still policy, and

Re: [PATCH] Filesystem linking protections

2005-02-07 Thread John Richard Moser
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Chris Wright wrote: > * Lorenzo Hernández García-Hierro ([EMAIL PROTECTED]) wrote: > >>This patch adds two checks to do_follow_link() and sys_link(), for >>prevent users to follow (untrusted) symlinks owned by other users in >>world-writable +t

Re: [PATCH] Filesystem linking protections

2005-02-07 Thread Chris Wright
* John Richard Moser ([EMAIL PROTECTED]) wrote: > I've yet to see this break anything on Ubuntu or Gentoo; Brad Spengler > claims this breaks nothing on Debian. On the other hand, this could > potentially squash the second most prevalent security bug. Yes I know, I've worked on distro with it as

Re: [PATCH] Filesystem linking protections

2005-02-07 Thread Chris Wright
* Lorenzo Hernández García-Hierro ([EMAIL PROTECTED]) wrote: > About what things it can break, I haven't noticed any issue on it (at > least regarding grSecurity or OpenWall), but of course I would > appreciate a lot any information on them, so, I could report to the > developers that are

Re: [PATCH] Filesystem linking protections

2005-02-07 Thread Lorenzo Hernández García-Hierro
El lun, 07-02-2005 a las 11:12 -0800, Chris Wright escribió: > * Lorenzo Hernández García-Hierro ([EMAIL PROTECTED]) wrote: > > This patch adds two checks to do_follow_link() and sys_link(), for > > prevent users to follow (untrusted) symlinks owned by other users in > > world-writable +t

Re: [PATCH] Filesystem linking protections

2005-02-07 Thread Lorenzo Hernández García-Hierro
El lun, 07-02-2005 a las 14:14 -0500, [EMAIL PROTECTED] escribió: > On Mon, 07 Feb 2005 19:57:06 +0100, Lorenzo =?ISO-8859-1?Q?Hern=E1ndez_?= > =?ISO-8859-1?Q?Garc=EDa-Hierro?= said: > > > This patch adds two checks to do_follow_link() and sys_link(), for > > prevent users to follow (untrusted)

Re: [PATCH] Filesystem linking protections

2005-02-07 Thread Valdis . Kletnieks
On Mon, 07 Feb 2005 19:57:06 +0100, Lorenzo =?ISO-8859-1?Q?Hern=E1ndez_?= =?ISO-8859-1?Q?Garc=EDa-Hierro?= said: > This patch adds two checks to do_follow_link() and sys_link(), for > prevent users to follow (untrusted) symlinks owned by other users in > world-writable +t directories (i.e.

Re: [PATCH] Filesystem linking protections

2005-02-07 Thread Chris Wright
* Lorenzo Hernández García-Hierro ([EMAIL PROTECTED]) wrote: > This patch adds two checks to do_follow_link() and sys_link(), for > prevent users to follow (untrusted) symlinks owned by other users in > world-writable +t directories (i.e. /tmp), unless the owner of the > symlink is the owner of

Re: [PATCH] Filesystem linking protections

2005-02-07 Thread Chris Wright
* Lorenzo Hernández García-Hierro ([EMAIL PROTECTED]) wrote: This patch adds two checks to do_follow_link() and sys_link(), for prevent users to follow (untrusted) symlinks owned by other users in world-writable +t directories (i.e. /tmp), unless the owner of the symlink is the owner of the

Re: [PATCH] Filesystem linking protections

2005-02-07 Thread Valdis . Kletnieks
On Mon, 07 Feb 2005 19:57:06 +0100, Lorenzo =?ISO-8859-1?Q?Hern=E1ndez_?= =?ISO-8859-1?Q?Garc=EDa-Hierro?= said: This patch adds two checks to do_follow_link() and sys_link(), for prevent users to follow (untrusted) symlinks owned by other users in world-writable +t directories (i.e. /tmp),

Re: [PATCH] Filesystem linking protections

2005-02-07 Thread Lorenzo Hernández García-Hierro
El lun, 07-02-2005 a las 14:14 -0500, [EMAIL PROTECTED] escribió: On Mon, 07 Feb 2005 19:57:06 +0100, Lorenzo =?ISO-8859-1?Q?Hern=E1ndez_?= =?ISO-8859-1?Q?Garc=EDa-Hierro?= said: This patch adds two checks to do_follow_link() and sys_link(), for prevent users to follow (untrusted)

Re: [PATCH] Filesystem linking protections

2005-02-07 Thread Lorenzo Hernández García-Hierro
El lun, 07-02-2005 a las 11:12 -0800, Chris Wright escribió: * Lorenzo Hernández García-Hierro ([EMAIL PROTECTED]) wrote: This patch adds two checks to do_follow_link() and sys_link(), for prevent users to follow (untrusted) symlinks owned by other users in world-writable +t directories

Re: [PATCH] Filesystem linking protections

2005-02-07 Thread Chris Wright
* Lorenzo Hernández García-Hierro ([EMAIL PROTECTED]) wrote: About what things it can break, I haven't noticed any issue on it (at least regarding grSecurity or OpenWall), but of course I would appreciate a lot any information on them, so, I could report to the developers that are currently

Re: [PATCH] Filesystem linking protections

2005-02-07 Thread Chris Wright
* John Richard Moser ([EMAIL PROTECTED]) wrote: I've yet to see this break anything on Ubuntu or Gentoo; Brad Spengler claims this breaks nothing on Debian. On the other hand, this could potentially squash the second most prevalent security bug. Yes I know, I've worked on distro with it as

Re: [PATCH] Filesystem linking protections

2005-02-07 Thread John Richard Moser
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Chris Wright wrote: * Lorenzo Hernández García-Hierro ([EMAIL PROTECTED]) wrote: This patch adds two checks to do_follow_link() and sys_link(), for prevent users to follow (untrusted) symlinks owned by other users in world-writable +t directories

Re: [PATCH] Filesystem linking protections

2005-02-07 Thread Valdis . Kletnieks
On Mon, 07 Feb 2005 20:34:33 +0100, Lorenzo =?ISO-8859-1?Q?Hern=E1ndez_?= =?ISO-8859-1?Q?Garc=EDa-Hierro?= said: But It's better to give users a secure-by-default status, at least on those parts that don't affect negatively the stability or the performance itself. It's still policy, and

Re: [PATCH] Filesystem linking protections

2005-02-07 Thread Lorenzo Hernández García-Hierro
El lun, 07-02-2005 a las 16:45 -0500, [EMAIL PROTECTED] escribió: On Mon, 07 Feb 2005 20:34:33 +0100, Lorenzo =?ISO-8859-1?Q?Hern=E1ndez_?= =?ISO-8859-1?Q?Garc=EDa-Hierro?= said: But It's better to give users a secure-by-default status, at least on those parts that don't affect negatively

Re: [PATCH] Filesystem linking protections

2005-02-07 Thread Valdis . Kletnieks
On Mon, 07 Feb 2005 23:00:33 +0100, Lorenzo =?ISO-8859-1?Q?Hern=E1ndez_?= =?ISO-8859-1?Q?Garc=EDa-Hierro?= said: A sysctl can be a good option, creating a CTL_SECURITY and then registering stuff under it, but this requires to have the kernel hackers agree with implementing a new security

Re: [PATCH] Filesystem linking protections

2005-02-07 Thread John Richard Moser
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Chris Wright wrote: * John Richard Moser ([EMAIL PROTECTED]) wrote: I've yet to see this break anything on Ubuntu or Gentoo; Brad Spengler claims this breaks nothing on Debian. On the other hand, this could potentially squash the second most

Re: [PATCH] Filesystem linking protections

2005-02-07 Thread Chris Wright
* John Richard Moser ([EMAIL PROTECTED]) wrote: Yes, mkdtemp() and mkstemp(). Of course we can't always rely on programmers to get it right, so the idea here is to make sure we ask broken code to behave nicely, and stab it in the face if it doesn't. Please try to examine this in that scope.

Re: [PATCH] Filesystem linking protections

2005-02-07 Thread John Richard Moser
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Chris Wright wrote: * John Richard Moser ([EMAIL PROTECTED]) wrote: Yes, mkdtemp() and mkstemp(). Of course we can't always rely on programmers to get it right, so the idea here is to make sure we ask broken code to behave nicely, and stab it in