Date: Sun, 27 Jul 2003 13:28:47 +0200 From: Socketd <db@traceroute.dk> To: freebsd-security@freebsd.org Subject: Re: suid bit files + securing FreeBSD (new program: LockDown) Message-ID: <20030727132847.5adc6b07.db@traceroute.dk> In-Reply-To: <20030726235710.GD4105@cirb503493.alcatel.com.au> References: <00d601c3539a$91576a40$3501a8c0@pro.sk> <20030726235710.GD4105@cirb503493.alcatel.com.au>
next in thread | previous in thread | raw e-mail | index | archive | help
This is a multi-part message in MIME format. --Multipart_Sun__27_Jul_2003_13:28:47_+0200_0891b600 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit On Sun, 27 Jul 2003 09:57:10 +1000 Peter Jeremy <PeterJeremy@optushome.com.au> wrote: > > But what files REALLY MUST have it ? > > There's no simple answer to this. It's a matter of going through each > file with setuid (or setgid) set, understanding why that file has the > set[gu]id bit and whether you need that functionality. Robert Watson is going through all the setuid files, to see which really need to be setuid. In -CURRENT he has removed the setuid bit from quota. Anyway I have been thinking about writing a program to make the default installation (with "extreme" security) even more secure. I have attached the configuration file, it should explain what the program can do. (not one line of code have been written yet). Btw setting noexec and nosuid on a mount point is a little redundante right? I mean since the user can't execute files, there is no point in also setting nosuid? Best regards Socketd ps: Please remember that the LockDown configuration file is only version 0.1, so nothing is final. --Multipart_Sun__27_Jul_2003_13:28:47_+0200_0891b600 Content-Type: application/octet-stream; name="lockdown.conf" Content-Disposition: attachment; filename="lockdown.conf" Content-Transfer-Encoding: base64 IyBMb2NrZG93biBjb25maWd1cmF0aW9uIGZpbGUKIyBZb3UgY2FuIGZyZWVseSBhZGQgeW91IG93 biBvcHRpb25zIGJ5IHVzaW5nIHRoZSBmb2xsb3dpbmcga2V5d29yZHM6CiMgZGVmaW5lPSIiIF90 ZXh0XwkJV29ya3MgbGlrZSBDL0MrKydzICNkZWZpbmUKIyByY19jb25mPSIiCQkJTWVhbnMgdGhl IHRleHQgd2lsbCBiZSBhZGRlZCB0byAvZXRjL3JjLmNvbmYKIyBzeXNjdGw9IiIJCQlUaGUgdGV4 dCB3aWxsIGJlIGFkZGVkIHRvIC9ldGMvc3lzY3RsLmNvbmYKIyBrZXJuPSIiCQkJVGhlIHRleHQg d2lsbCBiZSBhZGRlZCB0byB5b3VyIGtlcm5lbCBjb25maWd1cmF0aW9uIGZpbGUKIyBtb3VudD0i IgkJCVRoZSB0ZXh0IHdpbGwgYmUgYWRkZWQgdG8gL2V0Yy9mc3RhYgojIGxvZ2luX2NsYXNzPSIi ICIiIAkJVGhlIHRleHQgd2lsbCBiZSBhZGRlZCB0byB0aGUgc3BlY2lmaWVkIGxvZ2luIGNsYXNz CiMgZmlsZSBfbW9kZV8gIiIgX2ZsYWdzXwlXaWxsIGdpdmUgdGhlIGZpbGUgdGhlIG1vZGUgX21v ZGVfIGFuZCBmbGFncyBfZmxhZ3NfCiMgb3BlbnNzaD0iIgkJCVRoZSB0ZXh0IHdpbGwgYmUgYWRk ZWQgdG8gL2V0Yy9zc2gvc3NoZF9jb25maWcgIAoKIyBMb2NrZG93biB3aWxsIG5vdCBzaW1wbHkg YWRkIHRoZSB0ZXh0IHRvIHRoZSBmaWxlcywgaXQgd2lsbCBzZWFyY2gKIyB0aGUgZmlsZSB0byBz ZWUgaWYgdGhlIG9wdGlvbnMgaXMgYWxyZWFkeSB0aGVyZSBhbmQgY2hhbmdlIGl0IGlmIG5lZWRl ZC4KIyBJZiBubyBtYXRjaCBpcyBmb3VuZCB0aGUgdGV4dCB3aWxsIGJlIGFkZGVkLgoKIyBQbGVh c2Ugc3BlY2lmeSBhIGZpbGUgdG8gYWRkIHRoZSBrZXJuZWwgb3B0aW9ucyB0by4Ka2Vybl9maWxl PSIvdXNyL3NyYy9zeXMvaTM4Ni9jb25mL0xPQ0tET1dOIgoKIyBXaGVuIHJlc3RyaWN0aW5nIGFj Y2VzcyB0byBzdWlkLCBnaWQgYW5kIGluZm9ybWF0aW9uIGZpbGVzLAojIHdlIHVzZSAiZGVmaW5l IiB0byBzZXQgdGhlIGZpbGUgbW9kZS4gWW91IGNhbiBhbHNvIHdyaXRlCiMgdGhlIG1vZGUgZGly ZWN0bHkgcHIgZmlsZSBiYXNpYy4KZGVmaW5lPSJub1dvcmxkIiAiMDAwNyIKZGVmaW5lPSJkaXNh YmxlIiAiNzc3NyIKCiMgSGVyZSBhcmUgc29tZSBleHNhbXBsZXMgb2YgaG93IHRvIHVzZSB0aGUg ZmlsZSBvcHRpb25zOgojIGZpbGUgMDAwNyAJIi9ldGMvcmMuY29uZiIKIyBmaWxlIG5vV29ybGQJ Ii9ldGMvcmMuY29uZiIKIyBmaWxlIG5vV29ybGQgCSIvZXRjL3JjLmNvbmYiICJzYXBwbmQsc2No ZyIKIyBkZWZpbmU9ImxvZ0ZpbGUiICJzYXBwbmQsc2NoZyIKIyBmaWxlIG5vV29ybGQgCSIvZXRj L3JjLmNvbmYiIExvZ0ZpbGUKCgojIyMjIyMjIyMjIyMjIyMjIyMjIwojIE1vdW50aW5nIG9wdGlv bnMgIwojIyMjIyMjIyMjIyMjIyMjIyMjIwojIElmIHRoZSBtb3VudCBwb2ludCBleGlzdHMsIG1v dW50IGl0IHdpdGggdGhlIHNwZWNpZmllZCBvcHRpb25zLgojIFBsZWFzZSByZW1lbWJlciB0aGF0 IC90bXAgaGFzIHRvIGJlIGV4ZWN1dGFibGUgdG8gIm1ha2Ugd29ybGQiCiMgYW5kIGlmIHlvdSBu ZWVkIHRvIGphaWwgYSBwcm9jZXNzIGluIGEgcGFydGl0aW9uLCBkb24ndCBtb3VudCBpdCB3aXRo ICJub2RldiIKCm1vdW50PSIvdG1wIiAJCSJub2V4ZWMsIG5vZGV2LCBub3N5bWZvbGxvdyIKbW91 bnQ9Ii92YXIvdG1wIiAJIm5vZXhlYywgbm9kZXYsIG5vc3ltZm9sbG93Igptb3VudD0iL2hvbWUi CQkibm9zdWlkLCBub2RldiIKbW91bnQ9Ii91c3IvaG9tZSIgCSJub3N1aWQsIG5vZGV2Igptb3Vu dD0iL3ZhciIJCSJub3N1aWQsIG5vZGV2Igptb3VudD0iL3Zhci9tYWlsIgkibm9leGVjLCBub2Rl diIKCiMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIwojIC9ldGMvcmMuY29uZiBvcHRpb25zICMKIyMj IyMjIyMjIyMjIyMjIyMjIyMjIyMjCiMgVGhpcyB3aWxsIGp1c3QgYWRkIHNvbWUgb3B0aW9ucyB0 byAvZXRjL3JjLmNvbmYKcmNfY29uZj0iZW5hYmxlX3NlbmRtYWlsPSJOT05FIiIKcmNfY29uZj0i a2Vybl9zZWN1cmVsZXZlbF9lbmFibGU9IllFUyIiCnJjX2NvbmY9Imtlcm5fc2VjdXJlbGV2ZWw9 IjMiIgpyY19jb25mPSJjbGVhcl90bXBfZW5hYmxlPSJZRVMiIgojcmNfY29uZj0idXBkYXRlX21v dGQ9Ik5PIiIKcmNfY29uZj0ic3lzbG9nZF9mbGFncz0iLXNzIiIJCSAgICAgLy9VbmNvbW1lbnQg dGhpcyBpZiB0aGlzIGlzIGEgbG9nIHNlcnZlcgoKIyMjIyMjIyMjIyMjIyMjIyMjCiMgU3RlYWx0 aCBzZXJ2ZXIgIwojIyMjIyMjIyMjIyMjIyMjIyMKIyBJZiB0aGlzIGlzIGEgbG9nIHNlcnZlciwg ZmlyZXdhbGwgb3IgZ2F0ZXdheSB5b3UgY2FuIHB1dCBpdCBpbnRvIHN0ZWFsdGggbW9kZS4gCiMg VGhpcyBpcyBOT1QgcmVjb21tZW5kZWQgZm9yIG5vcm1hbCBzZXJ2ZXIgdXNlLgojIE5vdGU6IEZv ciBhIHN0ZWFsdGhpZXIgc2VydmVyIHlvdSBzaG91bGQgYWxzbyBibG9jayBzb21lIGljbXAgcmVx dWVzdCBsaWtlOgojIFBJTkcsIGthanNka2FzZGhsa2FkIAojcmNfY29uZj0idGNwX2Ryb3Bfc3lu ZmluPSJZRVMiIgojc3lzY3RsPSJuZXQuaW5ldC50Y3AuYmxhY2tob2xlPTIiCiNzeXNjdGw9Im5l dC5pbmV0LnVkcC5ibGFja2hvbGU9MSIKI2tlcm49Im9wdGlvbnMJSVBTVEVBTFRIIgoja2Vybj0i b3B0aW9ucwlUQ1BfRFJPUF9TWU5GSU4iCgojIyMjIyMjIyMjIyMjIyMjIyMjIyMjCiMgTmV0d29y a2luZyBvcHRpb25zICMKIyMjIyMjIyMjIyMjIyMjIyMjIyMjIwpyY19jb25mPSJpY21wX2Ryb3Bf cmVkaXJlY3Q9IllFUyIiCnJjX2NvbmY9ImljbXBfbG9nX3JlZGlyZWN0PSJZRVMiIgpyY19jb25m PSJsb2dfaW5fdmFpbj0iWUVTIiIKa2Vybj0ib3B0aW9ucwlSQU5ET01fSVBfSUQiCm9wZW5zc2g9 IkFsbG93R3JvdXBzIHdoZWVsIgpvcGVuc3NoPSJQcm90b2NvbCAyIgojIENyZWF0ZXMgL2V0Yy9m dHB3ZWxjb21lIGFuZCBhZGQgIkJhbm5lciAvZXRjL3dhcm5pbmciIHRvIG9wZW5zc2guIC9ldGMv d2FybmluZyBpcyBhIHN5bWxpbmsgdG8gL2V0Yy9mdHB3ZWxjb21lCnNldF93YXJuaW5nPSJCbGFo IGJsYWggYmxhaCwgc29tZSB3YXJuaW5nLiIKCiMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjCiMgTG9n aW4gQ2xhc3Mgb3B0aW9ucyAjCiMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjCmxvZ2luX2NsYXNzPSJk ZWZhdWx0IiAibWlucGFzc3dvcmRsZW49OCIKbG9naW5fY2xhc3M9ImRlZmF1bHQiICJtaXhwYXNz d29yZGNhc2U9dHJ1ZSIKbG9naW5fY2xhc3M9ImRlZmF1bHQiICJ1bmFtZT0wNzciCiMgQWRkIGNy eXB0X2RlZmF1bHQ9YmxmIGluIC9ldGMvYXV0aC5jb25mIGFuZCBwYXNzd2RfZm9ybWF0PWJsZiB0 byBkZWZhdWx0IGxvZ2luLmNsYXNzCnVzZV9ibG93ZmlzaD0iWUVTIgoKIyMjIyMjIyMjIyMjIyMK IyBSb290IExvZ2luICMKIyMjIyMjIyMjIyMjIyMKbm9fZGlyZWN0X3Jvb3RfbG9naW49IllFUyIJ CQkjIFNldCB0dHkqIGluIC9ldGMvdHR5cyB0byBpbnNlY3VyZQpwYXNzd29yZF9wcm90ZWN0X3Np bmdsZXVzZXJfbW9kZT0iWUVTIgkJIyBTZXQgY29uc29sZSB0byBpbnNlY3VyZSBpbiAvZXRjL3R0 eXMKCiMjIyMjIyMjIyMjIyMjIyMjIyMjIwojIFJlc3RyaWN0IHRoZSB1c2VyICMKIyMjIyMjIyMj IyMjIyMjIyMjIyMjCmFsbG93X2Nyb249Ik5PIgphbGxvd19hdD0iTk8iCnN5c2N0bD0ic2VjdXJp dHkuYnNkLnNlZV9vdGhlcl91aWRzPTAiCQkjIFVzZSBrZXJuLnBzX3Nob3dhbGxwcm9jcyBmb3Ig NC5YCgojIyMjIyMjIyMjIyMjIyMjIyMKIyBLZXJuZWwgb3B0aW9ucyAjCiMjIyMjIyMjIyMjIyMj IyMjIwprZXJuPSJvcHRpb25zCVNDX05PX0hJU1RPUlkiCQkJIyBEb24ndCBrZWVwIGhpc3Rvcnks IHNvIHRoZXJlIGNhbid0IGJlIHNjcm9sbGVkCmtlcm49Im9wdGlvbnMJU0NfRElTQUJMRV9SRUJP T1QiCQkjIERpc2FibGUgY3RybCthbHQrZGVsCiNrZXJuPSJvcHRpb25zCVNDX0RJU0FCTEVfRERC S0VZIiAJCSMgVW5jb21tZW50IGlmIHVzaW5nIHRoZSBrZXJuZWwgZGVidWdnZXIKCiMjIyMjIyMj IyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIwojIFJlc3RyaWN0IGFjY2VzcyB0byBzdWlkIGZpbGVz ICMKIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjCmZpbGUgZGlzYWJsZSAiL2Jpbi9y Y3AiCmZpbGUgbm9Xb3JsZCAiL3NiaW4vbWtzbmFwX2ZmcyIgCmZpbGUgbm9Xb3JsZCAiL3NiaW4v cGluZyIKZmlsZSBub1dvcmxkICIvc2Jpbi9waW5nNiIKZmlsZSBub1dvcmxkICIvc2Jpbi9zaHV0 ZG93biIKZmlsZSBub1dvcmxkICIvdXNyL2Jpbi9hdCIgIApmaWxlIG5vV29ybGQgIi91c3IvYmlu L2F0cSIKZmlsZSBub1dvcmxkICIvdXNyL2Jpbi9hdHJtIgpmaWxlIG5vV29ybGQgIi91c3IvYmlu L2JhdGNoIiAKZmlsZSBub1dvcmxkICIvdXNyL2Jpbi9jaHBhc3MiCmZpbGUgbm9Xb3JsZCAiL3Vz ci9iaW4vY2hmbiIKZmlsZSBub1dvcmxkICIvdXNyL2Jpbi9jaHNoIgpmaWxlIG5vV29ybGQgIi91 c3IvYmluL3lwY2hwYXNzIgpmaWxlIG5vV29ybGQgIi91c3IvYmluL3lwY2hmbiIKZmlsZSBub1dv cmxkICIvdXNyL2Jpbi95cGNoc2giCmZpbGUgbm9Xb3JsZCAiL3Vzci9iaW4vbG9jayIKZmlsZSBu b1dvcmxkICIvdXNyL2Jpbi9sb2dpbiIKZmlsZSBub1dvcmxkICIvdXNyL2Jpbi9vcGllaW5mbyIK ZmlsZSBub1dvcmxkICIvdXNyL2Jpbi9vcGllcGFzc3dkIgpmaWxlIG5vV29ybGQgIi91c3IvYmlu L3Bhc3N3ZCIKZmlsZSBub1dvcmxkICIvdXNyL2Jpbi95cHBhc3N3ZCIKZmlsZSBub1dvcmxkICIv dXNyL2Jpbi9xdW90YSIKZmlsZSBkaXNhYmxlICIvdXNyL2Jpbi9ybG9naW4iCmZpbGUgZGlzYWJs ZSAiL3Vzci9iaW4vcnNoIgpmaWxlIG5vV29ybGQgIi91c3IvYmluL3N1IgpmaWxlIG5vV29ybGQg Ii91c3IvYmluL2Nyb250YWIiCmZpbGUgbm9Xb3JsZCAiL3Vzci9iaW4vbHBxIgpmaWxlIG5vV29y bGQgIi91c3IvYmluL2xwciIKZmlsZSBub1dvcmxkICIvdXNyL2Jpbi9scHJtIgpmaWxlIG5vV29y bGQgIi91c3IvbGliZXhlYy9wdF9jaG93biIKZmlsZSBub1dvcmxkICIvdXNyL3NiaW4vbXJpbmZv IgpmaWxlIG5vV29ybGQgIi91c3Ivc2Jpbi9tdHJhY2UiCmZpbGUgbm9Xb3JsZCAiL3Vzci9zYmlu L3NsaXBsb2dpbiIKZmlsZSBub1dvcmxkICIvdXNyL3NiaW4vdGltZWRjIgpmaWxlIG5vV29ybGQg Ii91c3Ivc2Jpbi90cmFjZXJvdXRlIgpmaWxlIG5vV29ybGQgIi91c3Ivc2Jpbi90cmFjZXJvdXRl NiIKZmlsZSBub1dvcmxkICIvdXNyL3NiaW4vcHBwIgpmaWxlIG5vV29ybGQgIi91c3Ivc2Jpbi9w cHBkIgoKIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMKIyBSZXN0cmljdCBhY2Nlc3Mg dG8gZ2lkIGZpbGVzICMKIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMKZmlsZSBub1dv cmxkICIvdXNyL2Jpbi9mc3RhdCIKZmlsZSBub1dvcmxkICIvdXNyL2Jpbi9uZXRzdGF0IgpmaWxl IG5vV29ybGQgIi91c3IvYmluL3Ztc3RhdCIKZmlsZSBub1dvcmxkICIvdXNyL2Jpbi93YWxsIgpm aWxlIG5vV29ybGQgIi91c3IvYmluL3dyaXRlIgpmaWxlIG5vV29ybGQgIi91c3IvYmluL2xwcSIK ZmlsZSBub1dvcmxkICIvdXNyL2Jpbi9scHIiCmZpbGUgbm9Xb3JsZCAiL3Vzci9iaW4vbHBybSIK ZmlsZSBub1dvcmxkICIvdXNyL2xpYmV4ZWMvc2VuZG1haWwvc2VuZG1haWwiCmZpbGUgbm9Xb3Js ZCAiL3Vzci9zYmluL3RycHQiCmZpbGUgbm9Xb3JsZCAiL3Vzci9zYmluL2xwYyIKCiMjIyMjIyMj IyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMKIyBSZXN0cmljdCBhY2Nlc3MgdG8gaW5m b3JtYXRpb24gZmlsZXMgIwojIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMj CiMgaWYgeW91IGNoYW5nZSBwZXJtaXNzaW9ucyBvbiBmaWxlcyBhbHNvIGxpc3RlZCBpbiAvZXRj L25ld3N5c2xvZy5jb25mLCAKIyBMb2NrZG93biB3aWxsIGFsc28gYWRqdXN0IC9ldGMvbmV3c3lz bG9nLmNvbmYgYWNjb3JkaW5nbHkKZmlsZSBub1dvcmxkICIvc2Jpbi9zeXNjdGwiCmZpbGUgbm9X b3JsZCAiL3Vzci9iaW4vdW5hbWUiCmZpbGUgbm9Xb3JsZCAiL3NiaW4va2xkc3RhdCIKI2ZpbGUg bm9Xb3JsZCAiL3Vzci9iaW4vbmV0c3RhdCIJCSNVbmNvbW1lbnQgaWYgdXNpbmcgNC5YCmZpbGUg bm9Xb3JsZCAiL3NiaW4vcm91dGUiCmZpbGUgbm9Xb3JsZCAiL3Vzci9zYmluL2FycCIKZmlsZSBu b1dvcmxkICIvc2Jpbi9kbWVzZyIKZmlsZSBub1dvcmxkICIvdmFyL3J1bi9kbWVzZy5ib290Igpm aWxlIG5vV29ybGQgIi9ldGMvaG9zdHMiCmZpbGUgbm9Xb3JsZCAiL2V0Yy9mc3RhYiIKZmlsZSBu b1dvcmxkICIvZXRjL3NzaC9zc2hkX2NvbmZpZyIKZmlsZSBub1dvcmxkICIvZXRjL2Nyb250YWIi CmZpbGUgbm9Xb3JsZCAiL2V0Yy9mdHB1c2VycyIKZmlsZSBub1dvcmxkICIvZXRjL2hvc3RzLmFs bG93IgpmaWxlIG5vV29ybGQgIi9ldGMvaG9zdC5jb25mIgpmaWxlIG5vV29ybGQgIi9ldGMvaG9z dHMuZXF1aXYiCmZpbGUgbm9Xb3JsZCAiL2V0Yy9ob3N0cy5scGQiCmZpbGUgbm9Xb3JsZCAiL2V0 Yy9pbmV0ZC5jb25mIgpmaWxlIG5vV29ybGQgIi9ldGMvbG9naW4uYWNjZXNzIgpmaWxlIG5vV29y bGQgIi9ldGMvbG9naW4uY29uZiIKZmlsZSBub1dvcmxkICIvZXRjL3N5c2N0bC5jb25mIgpmaWxl IG5vV29ybGQgIi9ldGMvc3lzbG9nLmNvbmYiCmZpbGUgbm9Xb3JsZCAiL2V0Yy90dHlzIgpmaWxl IG5vV29ybGQgIi9ldGMvcmMuY29uZiIKZmlsZSBub1dvcmxkICIvZXRjL21hYy5jb25mIgpmaWxl IG5vV29ybGQgIi9ldGMvZ3JvdXAiCmZpbGUgbm9Xb3JsZCAiL2V0Yy9wYXNzd2QiCmZpbGUgbm9X b3JsZCAiL2V0Yy9uZXdzeXNsb2cuY29uZiIKZmlsZSAwMDA3ICAgICIvZXRjL3BlcmlvZGljLyIK ZmlsZSAwMDA3ICAgICIvdmFyL2RiL3BrZy8iCmZpbGUgbm9Xb3JsZCAiL3Vzci9zYmluL3BrZ192 ZXJzaW9uIgpmaWxlIG5vV29ybGQgIi91c3Ivc2Jpbi9wa2dfaW5mbyIKZmlsZSBub1dvcmxkICIv dXNyL2Jpbi9sYXN0IgpmaWxlIG5vV29ybGQgIi91c3Ivc2Jpbi9sYXN0bG9naW4iCmZpbGUgbm9X b3JsZCAiL3NiaW4vaXBmdyIKZmlsZSBub1dvcmxkICIvc2Jpbi9tb3VudCIKZmlsZSBub1dvcmxk ICIvdXNyL2Jpbi91c2VycyIKZmlsZSBub1dvcmxkICIvdXNyL2Jpbi93IgpmaWxlIG5vV29ybGQg Ii91c3IvYmluL3dobyIKZmlsZSBub1dvcmxkICIvdXNyL2Jpbi9sYXN0Y29tbSIKZmlsZSBub1dv cmxkICIvdXNyL3NiaW4vamxzIg== --Multipart_Sun__27_Jul_2003_13:28:47_+0200_0891b600--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20030727132847.5adc6b07.db>