oss-sec mailing list archives
Re: linux-distros list membership application - CloudLinux
From: Igor Seletskiy <i () cloudlinux com>
Date: Tue, 4 Jul 2017 18:07:13 +0300
On Sun, Jul 02, 2017 at 05:29:25PM +0300, Igor Seletskiy wrote:We typically have to patch local privilege escalations in kernel asap as our customers are easily rooted using this type of vulnerabilities(anyonecan buy website or hack old wordpress instance & run any code).This may be a reason for you to harden your distro's userland against local privilege escalations as well, such as by adopting the owl-alt-sanitize-env glibc hardening patch maintained by ALT Linux: http://git.altlinux.org/gears/g/..git?p=glibc.git;a=commitdiff;h=496059f2
Thank you, we will analyze it / test how well it works with 3rd party software.
and getting rid of most or all world-accessible SUID programs, which is do-able like we have demonstrated with Owl. This shouldn't be unreasonably hard to implement and maintain in a fork of RHEL, although obviously you'll end up with more packages (including some core ones) that would no longer be mere rebuilds of RHEL's.
All the web applications, end users ssh sessions and cron jobs are executed in namespaced / chrooted environment with no SUID files accessible already. We cannot completely get rid of SUID scripts as they are used by 3rd party software (like cPanel/Plesk) that is used on most of customer's servers. It is not perfect, but the best we were able to do so far. Thank you for the advise, Igor.
Current thread:
- linux-distros list membership application - CloudLinux Igor Seletskiy (Jul 02)
- Re: linux-distros list membership application - CloudLinux Solar Designer (Jul 02)
- RE: linux-distros list membership application - CloudLinux Bobby Broughton (Jul 02)
- Re: linux-distros list membership application - CloudLinux Igor Seletskiy (Jul 02)
- Re: linux-distros list membership application - CloudLinux Dmitry V. Levin (Jul 04)
- Re: linux-distros list membership application - CloudLinux Solar Designer (Jul 04)
- Re: linux-distros list membership application - CloudLinux Leonid Kanter (Jul 04)
- Re: linux-distros list membership application - CloudLinux Solar Designer (Jul 04)
- Re: linux-distros list membership application - CloudLinux Solar Designer (Jul 04)
- Re: linux-distros list membership application - CloudLinux Solar Designer (Jul 02)
- Re: linux-distros list membership application - CloudLinux Solar Designer (Jul 04)
- Re: linux-distros list membership application - CloudLinux Igor Seletskiy (Jul 04)