Hi,
> > Even if it does not really improve security too much it can be helpful as a
> > part of a larger system. For example around here we use a 'sbit-checker' that
> > basically does a 'find' and 'chmod', which we would be able to replace by this
> > patch.
>
> Something that sounds as if it would increase security but doesn't
> really increase security is actually bad since it gives users a false
> impression of security.
We are aware of the limitations, this approach has. It is not designed to make
every bit of executed code trusted, because that what just be the same as
before. Everything would be given the same amount of trust.
What we do, is establish a caste of binaries and processes more trusted than the
rest, which could be used for special tasks.
> > Also our patch is not solely about suid-binaries, we just implemented
> > suid-checking because it seemed a simple and obvious thing to do. Our real aim
> > was to implement binary signatures, which can be used in numerous security
> > related checks around the kernel. Btw. if you have any good ideas where one
> > could use them, please tell us :)
> Does writing an ELF loader in perl circumvent everything you want to do?
No, it does not. We do check any executable pages.
regards,
Johannes
--
Johannes Schlumberger Department of Computer Science IV
Martensstrasse 1 D-91058 Erlangen Germany University of Erlangen-Nuremberg
http://wwwcip.informatik.uni-erlangen.de/~spjsschl
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[Index of Archives]
[Kernel Newbies]
[Netfilter]
[Bugtraq]
[Photo]
[Stuff]
[Gimp]
[Yosemite News]
[MIPS Linux]
[ARM Linux]
[Linux Security]
[Linux RAID]
[Video 4 Linux]
[Linux for the blind]
[Linux Resources]
