Date: Sat, 19 Dec 1998 05:22:57 -0500 From: Garance A Drosihn <drosih@rpi.edu> To: "Marco Molteni" <molter@tin.it> Cc: freebsd-security@FreeBSD.ORG Subject: Re: A better explanation (was: buffer overflows and chroot) Message-ID: <v04011701b2a129cee810@[128.113.24.47]> In-Reply-To: <Pine.BSF.3.96.981218193124.339A-100000@nympha> References: <62537.913989002@zippy.cdrom.com>
next in thread | previous in thread | raw e-mail | index | archive | help
At 7:57 PM +0100 12/18/98, Marco Molteni wrote: >Scenario: > > 1. Bob is a non privileged user. > 2. Bob actively searches for buffer overflows in suid binaries. > 3. if Bob is able to do his job, soon or later he'll get root. > 4. I don't mind if Bob is a good guy or a bad guy, I don't want > anybody to be root on my machines. > 5. I want to put him in a chroot jail full of suid binaries, but > suid not to root, to pseudoroot, where pseudoroot is a > non privileged user. > 6. Bob can do all his experiments in his nice jail. > 6. if Bob becomes pseudoroot, I am still safe, since: > 6.1 he is in a chroot jail > 6.2 in the jail there isn't any executable suid to a privileged > user (root, bin, whatever). > 6.3 from 6.2, he can't escape from the jail > > is 6.3 correct? >From #2, Bob is running setuid binaries. Presumably he's running a long list of common setuid binaries, otherwise it'd be pointless research. Chances are that some of those programs are ones which will only work if they run as root. (say he wanted to pursue buffer overflows in lpd, for instance. Well, to do that he needs to have lpd running, and if you're not running lpd as root then it will not run very well -- at the very least it's an invalid test of lpd). What makes you think that you can limit his research by refusing to let him run the whole class of real-world setuid programs which have to be run as root? I can just see the brief description of his research: "I am attempting to explore buffer overflows in programs which don't matter in the first place, because they have no special privs". Given the above, #6.2 is invalid. If you want #4 to be true, given #2 and #3, then Bob needs to be on a machine which is not your machine. I realize you have said that you don't have a spare machine to put him on. I am just saying that if you don't have an extra machine, then chances are good that he'll have root on your machine. And once he has root (real root) on your machine, any chroot environment that you put him in will be irrelevent. --- Garance Alistair Drosehn = gad@eclipse.its.rpi.edu Senior Systems Programmer or drosih@rpi.edu Rensselaer Polytechnic Institute To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?v04011701b2a129cee810>