Date: Sat, 26 Jan 2002 15:40:26 -0500 From: Will Andrews <will@csociety.org> To: ports@FreeBSD.org Subject: Re: Improved install-time ports security audit patches Message-ID: <20020126154026.Y18609@squall.waterspout.com> In-Reply-To: <20020125180735.A71558@xor.obsecurity.org> References: <20020125180735.A71558@xor.obsecurity.org>
next in thread | previous in thread | raw e-mail | index | archive | help
On Fri, Jan 25, 2002 at 06:07:36PM -0800, Kris Kennaway wrote:
> I've made patches to improve the security auditing which is done at
> 'make install' time for a port. The new code searches for network
> client/servers by checking for the accept() or recvfrom() syscalls,
> and checks for unsafe functions like gets, mktemp, tempnam, and tmpnam
> (and if you have the PORTS_AUDIT env variable set, also sprintf,
> strcat and strcpy), and reports on their occurrence in a binary if
> they occur in conjunction with the binary being setugid, or a network
> client/server.
Nice work, Kris! :)
> +# Scan PLIST for:
> +# 1. setugid files
> +# 2. accept()/recvfrom() which indicates network listening capability
> +# 3. insecure functions (gets/mktemp/tempnam/[XXX])
> +# 4. startup scripts, in conjunction with 2.
> +#
> +# TODO: world-writable files/dirs
> +#
You may want to place this information nearer the top, and
mention the conditionals required. Also, are you going to add
some information about this feature to the Porter's Handbook?
> + -@rm -f ${WRKDIR}/.PLIST.setuid ${WRKDIR}/.PLIST.stupid \
> + ${WRKDIR}/.PLIST.network; \
> + if [ -n "$$PORTS_AUDIT" ]; then \
> + stupid_functions_regexp=' (gets|mktemp|tempnam|tmpnam|strcpy|strcat|sprintf)$$'; \
> + else \
> + stupid_functions_regexp=' (gets|mktemp|tempnam|tmpnam)$$'; \
Is it really necessary to use the name "stupid"? :)
> + fi; \
> + for i in `${GREP} -v '^@' ${TMPPLIST}`; do \
> + if [ ! -L ${PREFIX}/$$i -a -f ${PREFIX}/$$i ]; then \
> + /usr/bin/objdump -R ${PREFIX}/$$i > \
You may wish to add an OBJDUMP variable.
--
wca
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-ports" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20020126154026.Y18609>