On Wed, Sep 01, 2010 at 05:24:21PM -0400, Kenneth Gober wrote:
it looks like an interesting idea, but I'm not sure what vulnerability it
protects you from.
Stupid things as dumb as someone diddling your path to run a trojan
instead of ls, replacing a library file (or doing the same with
LD_LIBRARY_PATH) or someone slipping trojans into system files.
if you don't want users to replace system files, it
seems like a better idea to prevent them from being replaced, rather than
allowing replacement but then preventing access.
Partially but veriexec will prevent unknown binaries running if you
set the right flags so you are protected from running things that are
not part of the validated file set.
not that the 'preventing access' problem is much of an obstacle. the
article I found via google didn't have a lot of details, but it seems like
if you have rights to replace the files, you probably also have rights to
write an updated signature to /dev/veriexec.
The signatures are loaded at a low securelevel and once the
securelevel is raised new signatures are not allowed to be loaded so
you cannot just overwrite signatures.
if you're not going to require
the signatures to themselves be signed I really don't see the point.
Sure, but this requires crypto in the kernel. There are not many
respected crypto implementations with an acceptable licence for
incorporating into the kernel.
still, if some developer were interested enough to write a diff, there's
nothing stopping them.
Go look for openbsd stephanie, it existed but was never integrated.
--
Brett Lymn
Warning:
The information contained in this email and any attached files is
confidential to BAE Systems Australia. If you are not the intended
recipient, any use, disclosure or copying of this email or any
attachments is expressly prohibited. If you have received this email
in error, please notify us immediately. VIRUS: Every care has been
taken to ensure this email and its attachments are virus free,
however, any loss or damage incurred in using this email is not the
sender's responsibility. It is your responsibility to ensure virus
checks are completed before installing any data sent in this email to
your computer.
