|
|
|
|
|
|
| Author |
Message |
Crist J. Clark
*nix forums beginner
Joined: 25 Apr 2002
Posts: 10
|
 Posted: Thu Apr 25, 2002 5:32 am Post subject:
Re: NOSUID and NOSUID_prog make knobs
|
|
|
On Thu, Apr 25, 2002 at 03:53:53AM +0200, Johan Karlsson wrote:
[snip]
Ick.
| Quote: | Index: share/examples/etc/make.conf
===================================================================
RCS file: /home/ncvs/src/share/examples/etc/make.conf,v
retrieving revision 1.186
diff -u -r1.186 make.conf
--- share/examples/etc/make.conf 2002/04/23 23:59:51 1.186
+++ share/examples/etc/make.conf 2002/04/25 01:29:12
@@ -88,6 +88,22 @@
# To enable installing ssh(1) with the setuid bit turned on
#ENABLE_SUID_SSH= true
#
+# To avoid installing various parts with the setuid/setgid bit turned on
+#
+#NOSUID= true # no setuid bit for any of the below
+#NOSUID_AT= true # no setuid bit for at
+#NOSUID_CHPASS= true # no setuid bit for chpass
+#NOSUID_K5SU= true # no setuid bit for k5su
+#NOSUID_PING= true # no setuid bit for ping
+#NOSUID_PING6= true # no setuid bit for ping6
+#NOSUID_PPP= true # no setuid bit for ppp
+#NOSUID_RCP= true # no setuid bit for rcp
+#NOSUID_SHUTDOWN= true # no setuid bit for shutdown
+#
+#NOSGID= true # no setgid bit for any of the below
+#NOSGID_DM= true # no setgid bit for dm
+#NOSGID_PS= true # no setgid bit for ps
|
ps(1) isn't setgid.
[snip]
| Quote: | Index: bin/rcp/Makefile
===================================================================
RCS file: /home/ncvs/src/bin/rcp/Makefile,v
retrieving revision 1.20
diff -u -r1.20 Makefile
--- bin/rcp/Makefile 2002/04/18 07:01:34 1.20
+++ bin/rcp/Makefile 2002/04/25 01:29:36
@@ -21,8 +21,10 @@
.PATH: ${.CURDIR}/../../crypto/kerberosIV/appl/bsd
.endif
+.if !defined(NOSUID) && !defined(NOSUID_RCP)
BINOWN= root
BINMODE=4555
INSTALLFLAGS=-fschg
+.endif
.include <bsd.prog.mk
|
This is a very painful, and difficult to maintain, way to do it. It
would be much better if it could be done inside the bsd.*.mk files. I
also think only then does there even exist a slim chance someone would
commit this. There are way too many make.conf(5) knobs already. There
are plenty of ways to customize your own installations without having
to add all of your localizations to FreeBSD itself.
--
Crist J. Clark | cjclark@alum.mit.edu
| cjclark@jhu.edu
http://people.freebsd.org/~cjc/ | cjc@freebsd.org
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-arch" in the body of the message |
|
| Back to top |
|
 |
Robert Watson
*nix forums Guru Wannabe
Joined: 22 Mar 2002
Posts: 218
|
| Posted: Thu Apr 25, 2002 2:06 am Post subject:
Re: NOSUID and NOSUID_prog make knobs
|
|
|
Seems like a basically good idea. However, 'ps' should already not be
setgid in -CURRENT, and you appear to have missed some setgid monitoring
tools that do actually exist. The style weenies may have something to say
about variable naming, but this seems like a good thing to do. I have
some custom local hacks that do much the same, actually, but in a less
finished way.
Robert N M Watson FreeBSD Core Team, TrustedBSD Project
robert@fledge.watson.org NAI Labs, Safeport Network Services
On Thu, 25 Apr 2002, Johan Karlsson wrote:
| Quote: | [bcc -security since the discussion started there ]
Hi all,
recently a discussion about removing the setuid bit popup again
http://docs.FreeBSD.org/cgi/getmsg.cgi?fetch=166393+0+current/freebsd-security
Jason noted that it had been discussed before and also that
introducing a make knob to disable installation of
various programs with the setuid bit turned on had been proposed.
I have started to implement this and would like to know
what you think of the concept.
Attached is an untested diff for some suid/sgid programs.
Basicly it protects the BINMODE assignment in the Makefile with
.if !defined(NOSUID) && !defined(NOSUID_prog)
I have also made changes to make.conf.5 and examples/etc/make.conf
to reflect the new knobs.
Please have a look at the attached diff and let me know what you think.
If there is interest and some commiter would consider to commit
something along those lines I'm willing to make a diff for most
of the suid/sgid programs we have in the tree.
/Johan K
--
Johan Karlsson mailto:k@numeri.campus.luth.se
|
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-arch" in the body of the message |
|
| Back to top |
|
|
Johan Karlsson
*nix forums beginner
Joined: 24 Apr 2002
Posts: 11
|
| Posted: Thu Apr 25, 2002 1:17 am Post subject:
Re: NOSUID and NOSUID_prog make knobs
|
|
|
In the discussion on -security I got the impression that the
granularity is wanted.
There are currently 29 suid and 14 sgid bits set it Makefile:s
that would be effected by this.
Some of them make sence to group togather e.g. lpr, ping, etc
I think it just makes more sence to provide all of them
(some grouped) than to only have 1 knob for all of them.
/Johan K
On Wed, Apr 24, 2002 at 19:17 (-0700) +0000, David O'Brien wrote:
| Quote: | On Thu, Apr 25, 2002 at 03:53:53AM +0200, Johan Karlsson wrote:
Basicly it protects the BINMODE assignment in the Makefile with
.if !defined(NOSUID) && !defined(NOSUID_prog)
...
+# To avoid installing various parts with the setuid/setgid bit turned on
+#
+#NOSUID= true # no setuid bit for any of the below
Either do them all, or none. This flag per binary does not scale, nor do
I see any significant portion of our userbase utilizing the granularity.
|
--
Johan Karlsson mailto:k@numeri.campus.luth.se
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-arch" in the body of the message |
|
| Back to top |
|
|
Johan Karlsson
*nix forums beginner
Joined: 24 Apr 2002
Posts: 11
|
| Posted: Thu Apr 25, 2002 12:20 am Post subject:
Re: NOSUID and NOSUID_prog make knobs
|
|
|
Hi
this patch was just to demostrate the concept it is by no means
a compleate patch. I know that ps is not suid already, but since the
BINMODE line only is commented out I made the change.
/Johan K
On Wed, Apr 24, 2002 at 22:06 (-0400) +0000, Robert Watson wrote:
| Quote: | Seems like a basically good idea. However, 'ps' should already not be
setgid in -CURRENT, and you appear to have missed some setgid monitoring
tools that do actually exist. The style weenies may have something to say
about variable naming, but this seems like a good thing to do. I have
some custom local hacks that do much the same, actually, but in a less
finished way.
Robert N M Watson FreeBSD Core Team, TrustedBSD Project
robert@fledge.watson.org NAI Labs, Safeport Network Services
On Thu, 25 Apr 2002, Johan Karlsson wrote:
[bcc -security since the discussion started there ]
Hi all,
recently a discussion about removing the setuid bit popup again
http://docs.FreeBSD.org/cgi/getmsg.cgi?fetch=166393+0+current/freebsd-security
Jason noted that it had been discussed before and also that
introducing a make knob to disable installation of
various programs with the setuid bit turned on had been proposed.
I have started to implement this and would like to know
what you think of the concept.
Attached is an untested diff for some suid/sgid programs.
Basicly it protects the BINMODE assignment in the Makefile with
.if !defined(NOSUID) && !defined(NOSUID_prog)
I have also made changes to make.conf.5 and examples/etc/make.conf
to reflect the new knobs.
Please have a look at the attached diff and let me know what you think.
If there is interest and some commiter would consider to commit
something along those lines I'm willing to make a diff for most
of the suid/sgid programs we have in the tree.
/Johan K
--
Johan Karlsson mailto:k@numeri.campus.luth.se
|
--
Johan Karlsson mailto:k@numeri.campus.luth.se
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-arch" in the body of the message |
|
| Back to top |
|
|
David O'Brien
*nix forums beginner
Joined: 25 Apr 2002
Posts: 1
|
| Posted: Thu Apr 25, 2002 12:17 am Post subject:
Re: NOSUID and NOSUID_prog make knobs
|
|
|
On Thu, Apr 25, 2002 at 03:53:53AM +0200, Johan Karlsson wrote:
| Quote: | Basicly it protects the BINMODE assignment in the Makefile with
.if !defined(NOSUID) && !defined(NOSUID_prog)
....
+# To avoid installing various parts with the setuid/setgid bit turned on
+#
+#NOSUID= true # no setuid bit for any of the below
|
Either do them all, or none. This flag per binary does not scale, nor do
I see any significant portion of our userbase utilizing the granularity.
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-arch" in the body of the message |
|
| Back to top |
|
|
Johan Karlsson
*nix forums beginner
Joined: 24 Apr 2002
Posts: 11
|
| Posted: Wed Apr 24, 2002 11:53 pm Post subject:
NOSUID and NOSUID_prog make knobs
|
|
|
[bcc -security since the discussion started there ]
Hi all,
recently a discussion about removing the setuid bit popup again
http://docs.FreeBSD.org/cgi/getmsg.cgi?fetch=166393+0+current/freebsd-security
Jason noted that it had been discussed before and also that
introducing a make knob to disable installation of
various programs with the setuid bit turned on had been proposed.
I have started to implement this and would like to know
what you think of the concept.
Attached is an untested diff for some suid/sgid programs.
Basicly it protects the BINMODE assignment in the Makefile with
..if !defined(NOSUID) && !defined(NOSUID_prog)
I have also made changes to make.conf.5 and examples/etc/make.conf
to reflect the new knobs.
Please have a look at the attached diff and let me know what you think.
If there is interest and some commiter would consider to commit
something along those lines I'm willing to make a diff for most
of the suid/sgid programs we have in the tree.
/Johan K
--
Johan Karlsson mailto:k@numeri.campus.luth.se |
|
| Back to top |
|
|
Google
|
|
| Back to top |
|
|
|
|
The time now is Thu Jan 08, 2009 6:10 am | All times are GMT
|
|
Loans | Loans | RC51 | Watch American Dad | Loans
|
|
Copyright © 2004-2005 DeniX Solutions SRL
|
|
|
|
Other DeniX Solutions sites:
Unix/Linux blog |
electronics forum |
medicine forum |
science forum |
|
|
Privacy Policy
|
Powered by phpBB © 2001, 2005 phpBB Group
|
|
FAQ
Search
Memberlist
Usergroups
Register
Profile
Log in to check your private messages
Log in
Forum index
»
*nix
»
BSD
»
FreeBSD
»
mail-lists
»
Architecture
