Re: Solaris Signals

[Jon Masters]

Hi,

As a couple of people have pointed out off list when we discussed it, the
situation I am basically describing generally comes down to that you
shouldn't stick sensitive information in binaries - that was the
fundamental point - I think I was confusing a couple of things I have been
looking at and ended up not being terribly clear. Hope that makes sense.

Jon.

[Frank v Waveren]

On Wed, Feb 12, 2003 at 03:21:49AM +0000, Jon Masters wrote:
> We all know that old chestnut about tracing setuid programs or scripts,
> but what about non-setuid scripts which have been installed for users and
> given execute only permission. For example, a lot of sites provide scripts
> for users to run which perform some admin related function and thus have
> usernames or passwords within them - potentially free to users.

Making programs execute-only is no security for such things unless you
add a lot of weird-and-definately-not-wonderful special cases all over
the OS. Even if you stop programs from dumping core if
access(executable, R_OK), you can still do LD_PRELOAD/LD_LIBRARY tricks
and get access to the process' memory (or just log all library or system
calls which gets you all the interesting stuff too, usually), and with
a little creativity there's plenty of other ways to get around lack of
read rights.

--
Frank v Waveren Fingerprint: 21A7 C7F3
fvw@[var.cx|stack.nl|chello.nl] ICQ#10074100 1FF3 47FF 545C CB53
Public key: hkp://wwwkeys.pgp.net/fvw@var.cx 7BD9 09C0 3AC1 6DF2

[ari]

Actually, many systems (current versions of solaris included) disallow
user ptrace(2) and restrict /proc access for processes whose binaries
are not readable. If you compile the binary statically (due to its
sensitive nature), you needn't worry about trickery with dynamic library
instructions.

Note that i only bring this up to further the information; i do not
condone the act of putting sensitive information into a binary that
executes without modified privileges (or, indeed, putting sensitive
information into an executable at all).

ari

--
[http://www.episec.com/people/edelkind/]


fvw@var.cx said this stuff:

[...]
> Making programs execute-only is no security for such things unless you
> add a lot of weird-and-definately-not-wonderful special cases all over
> the OS. Even if you stop programs from dumping core if
> access(executable, R_OK), you can still do LD_PRELOAD/LD_LIBRARY tricks
> and get access to the process' memory (or just log all library or system
> calls which gets you all the interesting stuff too, usually), and with
> a little creativity there's plenty of other ways to get around lack of
> read rights.
>
> --
> Frank v Waveren Fingerprint: 21A7 C7F3
> fvw@[var.cx|stack.nl|chello.nl] ICQ#10074100 1FF3 47FF 545C CB53
> Public key: hkp://wwwkeys.pgp.net/fvw@var.cx 7BD9 09C0 3AC1 6DF2