Date: Sat, 1 Jun 2002 19:22:55 -0400 From: Niels Provos <provos@citi.umich.edu> To: karin@root66.org Cc: freebsd-hackers@FreeBSD.ORG, bfischer@Techfak.Uni-Bielefeld.DE Subject: Re: sandboxing untrusted binaries Message-ID: <20020601232254.GE19245@citi.citi.umich.edu> In-Reply-To: <20020531165629.H86421_root66.org@ns.sol.net> References: <20020531105059.GA720_no-support.loc@ns.sol.net> <20020531165629.H86421_root66.org@ns.sol.net>
next in thread | previous in thread | raw e-mail | index | archive | help
On Fri, May 31, 2002 at 02:56:53PM +0000, karin@root66.org wrote: > Netscape for instance needs to execute other binaries, the user should > be allowed to specify which binaries. Netscape needs to write cache > files, any hacker exploiting netscape can use that to create a new > process which isn't systrace-profiled. This is not correct. I suggest that you look at the systrace web page again and read all the information there. It is very feasible and desirable to run any third-party software under systrace. For example, it is not possible for netscape to create a process that is not monitored. I suggest that you look at the sample konquerer policy. > I suggest getting over the illusion hackers won't be able to hack the > system if you narrow them a bit, the binaries you run still need > capabilities to correctly function, which are always enough to hack the > system. This is not correct either. There is no illusion here. Please, give me an example where the capabilities needed "are always enough to hack the system." Say gaim or opera. > this is very specific for the program, you can't make judgements like > this without being sure for what applications this applies. In reverse, for which application is the assumption that read and write are frequently executed system calls incorrect? Niels. To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-hackers" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20020601232254.GE19245>