ProactiveSecurityRoadmap

Differences between revisions 30 and 31
Revision 30 as of 2005-04-29 02:57:16
Size: 6266
Editor: intern146
Comment: scope & uses cases
Revision 31 as of 2005-04-29 03:05:45
Size: 6390
Editor: intern146
Comment:
Deletions are marked like this. Additions are marked like this.
Line 34: Line 34:
If a community members supplies packages, we will have modified gcc packages with hardened patches available in universe.

Reviewer feedback:

  • Address unix_chkpwd in the implementation plan?
  • "Scope and use cases" contained a draft agenda; this needs a few use cases and a description of the scope of the implementation plan

Proactive Security Roadmap

Status

Introduction

Establish a strategy for implementing proactive security features in Ubuntu.

Rationale

We want to reduce the risk of security holes in Ubuntu systems by reducing the number of potential attack vectors and find general solutions for preventing common classes of vulnerabilities. This helps to reduce the number of security updates we have to do after a release, and confines the impact of actual vulnerabilities to a minimum.

Scope and Use Cases

We will patch the Ubuntu kernel to provide protection against common attacks and reduce the privileges of system daemons so that they run with least privileges. Users may find that some programs need fixed as a result of these protections, and so we will provide a method to disable the kernel improvements at runtime. If a community members supplies packages, we will have modified gcc packages with hardened patches available in universe.

Implementation Plan

Data Preservation and Migration

Does not apply here.

Packages Affected

Kernel:

  • Port the OpenWall patch that prevents exploitation of unsafe temporary file creation; it is really trivial; add a proc file to be able to enable/disable at runtime.

  • Provide a grsecurity kernel in universe, if a community member is interested to care about it; [http://people.ubuntu.com/~pitti/arch/martin.pitt@canonical.com--2005/linux-hardened--devel--2.6.10/ packaging] is available.

  • Extract and port some of grsecurity's /proc restrictions which can be enabled/disabled at runtime:

    • Users can only see their own processes; this will keep them from e. g. seeing confidential command line arguments of other processes, which is still a very common mistake.
    • Hide memory addresses from map files: make it harder to deploy successful exploitations of heap overflows.
  • Extract and port randomization patches from grsecurity:
    • PID: Prevent the prediction of PIDs for child processes to make it harder to exploit race conditions, and avoid information leaks.
    • TCP sequence numbers: Make it harder to hijack TCP connections.
    • TCP source ports: Drastically increase the average time for TCP reset attacks.

prelink:

  • Prelinked applications leave a huge /var/log/prelink.log which contains memory address; patch prelink to not dump addresses.

gcc:

  • If a community member is interested, we can provide SSP/Fortify/etc. gcc packages in universe, but we will not put them into main and use them as a default as long as upstream does not adopt a solution.

dhcp3-client:

  • Currently dhclient runs as root, which is much more than necessary.

  • Privilege requirements: normal users with CAP_NET_RAW and CAP_NET_BIND_SERVICE; needs a suid wrapper to call /etc/dhcp3/dhclient-script
  • dhclient-script must be security reviewed (proper quoting, etc.).

  • MartinPitt has a prototypical package, will upload it into Breezy soon.

dhcp3-server:

  • Currently dhcpd runs as root, which is much more than necessary.

  • Privilege requirements: normal user with CAP_NET_RAW and CAP_NET_BIND_SERVICE for initialization phase; these can be dropped after socket creation.
  • MartinPitt has a prototypical package, will upload it into Breezy soon.

inetd:

  • This package is currently installed by default as part of the base system; since it is a daemon running as root, but is not used much any more, it is desirable to throw it out to Supported.
  • MartinPitt compiled a list of all packages in main which use inetd on the InetdUsage page.

Outstanding Issues

Desirable for the future:

  • Exponentially delay the respawning of repeatedly crashing applications to prevent brute force attacks (eventually finding the correct offset of memory locations for buffer overflow attacks).
  • Evaluate chroot hardening patches.
  • Memory protection: Jamie will research whether there are things exploitable in exec-shield which aren't in PaX.
  • Compile-time stack protection.
  • Reduce the privileges of cron.
    • Parsing the crontabs as normal user and introducing a minimal setuid wrapper for actually executing the commands as the target user will not help to improve security; the remaining stuff (timer and signal handling) does not accept user input and thus is not very error prone. I do not really have a good idea about this. (Note: atd also runs with root privileges, it just hides them pretty well; I do not have an idea how to deroot this either, it's the same problem.)

UDU BOF Agenda

  • Privilege reduction
    • Run cron as non-root?
    • Run dhclient3 as non-root?
    • Run dhcpd3 as non-root?
    • Change unix_chkpwd from suid root to sgid shadow (see [http://bugs.debian.org/155583 #155583])

  • Compile-time stack protection?
  • Non-executable stack for i386?
  • MAC (SELinux, grsecurity, etc.) -> [wiki:SELinux Separate BoF]

  • Find ways to prevent exploitations of common vulnerabilities.

UDU Pre-Work

UbuntuDownUnder/BOFs/ProactiveSecurityRoadmap (last edited 2008-08-06 16:18:54 by localhost)