Date: Wed, 2 Apr 2008 22:38:59 +0200 From: Roland Smith <rsmith@xs4all.nl> To: Forrest Aldrich <forrie@forrie.com> Cc: freebsd-stable@freebsd.org Subject: Re: Digitally Signed Binaries w/ Kernel support, etc. Message-ID: <20080402203859.GB80314@slackbox.xs4all.nl> In-Reply-To: <47F3DA07.4020209@forrie.com> References: <47F3DA07.4020209@forrie.com>
next in thread | previous in thread | raw e-mail | index | archive | help
--St7VIuEGZ6dlpu13 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Wed, Apr 02, 2008 at 03:09:59PM -0400, Forrest Aldrich wrote: > Does FreeBSD have support for digitally signed binary checking, similar t= o=20 > what Linux has with bsign and DigSig, where system binaries are signed an= d=20 > this signature is verified before being run in the kernel? If an attacker can modify binaries, he already has root privileges. In that case, what will stop him from creating a new pgp key and re-sign his doctered binaries? > This would be very useful to have to further tighen-down the system. As an alternative, on FreeBSD you can set the system immutable flag on binaries (see chflags(1)), and set the securelevel > 0. See init(8). Once this is set, not even root can undo this. You have to reboot to reset the securelevel to -1. The only weakness is that the securelevel is set quite late in the boot process. An attacker could compromise the system if he gets access before the securelevel is set. Roland --=20 R.F.Smith http://www.xs4all.nl/~rsmith/ [plain text _non-HTML_ PGP/GnuPG encrypted/signed email much appreciated] pgp: 1A2B 477F 9970 BA3C 2914 B7CE 1277 EFB0 C321 A725 (KeyID: C321A725) --St7VIuEGZ6dlpu13 Content-Type: application/pgp-signature Content-Disposition: inline -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.8 (FreeBSD) iEYEARECAAYFAkfz7uMACgkQEnfvsMMhpyW8UgCaAorua/3SI0KpmLNHX/fD9Wv8 TzMAn2H2BXBL6W0rIgUGvDMUYFaGP+TK =FiqD -----END PGP SIGNATURE----- --St7VIuEGZ6dlpu13--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20080402203859.GB80314>