[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <CA+-XxSHAUfG=z0AU9LoT_N1mB-aOAtFvEz6NgL8b8iyY5vYEhQ@mail.gmail.com>
Date: Tue, 4 Jul 2017 18:07:13 +0300
From: Igor Seletskiy <i@...udlinux.com>
To: oss-security@...ts.openwall.com
Subject: Re: linux-distros list membership application - CloudLinux
>
>
>
> On Sun, Jul 02, 2017 at 05:29:25PM +0300, Igor Seletskiy wrote:
> > We typically have to patch local privilege escalations in kernel asap as
> > our customers are easily rooted using this type of vulnerabilities
> (anyone
> > can buy website or hack old wordpress instance & run any code).
>
> This may be a reason for you to harden your distro's userland against
> local privilege escalations as well, such as by adopting the
> owl-alt-sanitize-env glibc hardening patch maintained by ALT Linux:
>
> http://git.altlinux.org/gears/g/..git?p=glibc.git;a=commitdiff;h=496059f2
Thank you, we will analyze it / test how well it works with 3rd party
software.
>
>
> and getting rid of most or all world-accessible SUID programs, which is
> do-able like we have demonstrated with Owl. This shouldn't be
> unreasonably hard to implement and maintain in a fork of RHEL, although
> obviously you'll end up with more packages (including some core ones)
> that would no longer be mere rebuilds of RHEL's.
>
All the web applications, end users ssh sessions and cron jobs are executed
in
namespaced / chrooted environment with no SUID files accessible already.
We cannot completely get rid of SUID scripts as they are used by 3rd party
software (like cPanel/Plesk) that is used on most of customer's servers.
It is not perfect, but the best we were able to do so far.
Thank you for the advise,
Igor.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
