7:26 p.m.
Not being a student of selinux I wonder if it would have protected users and the system
against the recently discovered firefox exploit.
https://blog.mozilla.org/security/2015/08/06/firefox-exploit-found-in-the...
--
If I wanted a blog or social media I'd go elsewhere
7:30 p.m.
On Sat, 2015-08-08 at 08:26 +0800, Ed Greshko wrote:
Not being a student of selinux I wonder if it would have protected
users and
the system against the recently discovered firefox exploit.
https://blog.mozilla.org/security/2015/08/06/firefox-exploit-found-in-the...
/
Normally firefox would run in your users context (unconfined_t), so no, this
would not have prevented it.
Unless you run a confined user, or firefox in a sandbox, these may have limited
the scope of the damage.
--
William Brown <william(a)blackhats.net.au>
7:43 p.m.
On 08/08/15 08:30, William Brown wrote:
On Sat, 2015-08-08 at 08:26 +0800, Ed Greshko wrote:
> Not being a student of selinux I wonder if it would have protected users and
> the system against the recently discovered firefox exploit.
>
> https://blog.mozilla.org/security/2015/08/06/firefox-exploit-found-in-the...
> /
>
Normally firefox would run in your users context (unconfined_t), so no, this
would not have prevented it.
Unless you run a confined user, or firefox in a sandbox, these may have limited
the scope of the damage.
Thank you.
Follow up. How about system files such as /etc/passwd ?
--
If I wanted a blog or social media I'd go elsewhere
7:51 p.m.
On Sat, 2015-08-08 at 08:43 +0800, Ed Greshko wrote:
On 08/08/15 08:30, William Brown wrote:
> On Sat, 2015-08-08 at 08:26 +0800, Ed Greshko wrote:
> > Not being a student of selinux I wonder if it would have protected users
> > and
> > the system against the recently discovered firefox exploit.
> >
> > https://blog.mozilla.org/security/2015/08/06/firefox-exploit-found-in-the-
> > wild
> > /
> >
> Normally firefox would run in your users context (unconfined_t), so no, this
> would not have prevented it.
>
> Unless you run a confined user, or firefox in a sandbox, these may have
> limited
> the scope of the damage.
>
>
Thank you.
Follow up. How about system files such as /etc/passwd ?
/etc/passwd doesn't really matter, it's /etc/shadow you should worry about.
But normally you can't even read shadow:
ls -al /etc/{passwd,shadow}
ls: cannot access /etc/shadow: Permission denied
-rw-r--r--. 1 root root 3252 Jun 28 17:30 /etc/passwd
As root you can see:
-rw-r--r--. 1 root root 3252 Jun 28 17:30 /etc/passwd
----------. 1 root root 1645 Jun 28 17:30 /etc/shadow
I'd be more worried about SSH keys in ~/.ssh that don't have a password (protip.
They should have passwords), and other things like that.
--
William Brown <william(a)blackhats.net.au>
4:34 a.m.
On 08/08/2015 02:43 AM, Ed Greshko wrote:
On 08/08/15 08:30, William Brown wrote:
> On Sat, 2015-08-08 at 08:26 +0800, Ed Greshko wrote:
>> Not being a student of selinux I wonder if it would have protected users and
>> the system against the recently discovered firefox exploit.
>>
>> https://blog.mozilla.org/security/2015/08/06/firefox-exploit-found-in-the...
>> /
>>
> Normally firefox would run in your users context (unconfined_t), so no, this
> would not have prevented it.
>
> Unless you run a confined user, or firefox in a sandbox, these may have limited
> the scope of the damage.
Exactly, You need to run SELinux in more strictly mode
as confined users.
Thank you.
Follow up. How about system files such as /etc/passwd ?
--
Lukas Vrabec
SELinux Solutions
Red Hat, Inc.
3182
days inactive
3184
days old
selinux@lists.fedoraproject.org
4 comments
3 participants
participants (3)
-
Ed Greshko -
Lukas Vrabec -
William Brown