Improving security

[Steve G]

>Stack Smash Protection sounds like a cool feature to me. I don't know 
>what the performance impact is, but as a developer even if it is to slow 
>to use by default I would love to have it intergrated into the gcc 
>shipped by Fedora to make debugging easier.

I use a specially doctored version of gcc with propolice compiled in. I have
helped code review & submit corrections to propolice. I can say that its pretty
good, but not bulletproof. Its worth adding for the fact that it is one more
layer should there be holes in the other protection mechanisms. Performance is
pretty good. 5-10% performance hit. However, there is one small issue. It needs
to read from /dev/random and write to /dev/syslog. This is not in all policies
and has to be manually added. I see the avc messages all the time.

I also use libsafe which seems to catch more stack smashing attempts than
propolice. I have corrected a number of bugs in it and shared them with the
developers. I also extended libsafe to cover more vectors of attack. You can find
the updated copy here: www.web-insights.net/libsafe. There is a perfomance hit,
but its small. I'd rather a 2 Ghz machine with cycles to burn run with libsafe +
propolice than spend 2 days setting up the machine after its hacked. libsafe does
use an LDPRELOAD variable to intercept calls. This means that it offers no
protection to setuid/setgid programs. selinux may also object to it.

>But if I undertand it correctly PAX does more for example also make data 
>pages non executable, this might be something worth looking into.

Some of the things it does makes software debug impossible. valgrind sometimes
has problems with it. I think there are some bits of it that are good, as well as
the openwall linux patch set. It would be better if these were adopted into the
kernel rather than maintained as a patch to it.

But something that neither of these address, is plain logic errors. Every week I
find a pretty good problem that scanners (flawfinder/lint/valgrind), stack
protectors (propolice/libsafe), and se linux cannot catch. Part of the solution
has to be peer review.

-Steve Grubb


		
_______________________________
Do you Yahoo!?
Declare Yourself - Register online to vote today!
http://vote.yahoo.com