<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 TRANSITIONAL//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; CHARSET=UTF-8">
<META NAME="GENERATOR" CONTENT="GtkHTML/3.6.2">
</HEAD>
<BODY>
On Thu, 2006-05-25 at 20:09 -0400, Scott C. Ripley wrote:
<BLOCKQUOTE TYPE=CITE>
<PRE>
<FONT COLOR="#000000">hey all,</FONT>
<FONT COLOR="#000000">anyone get hassled by:</FONT>
<FONT COLOR="#000000"> - some web app is able to write to /tmp as nobody</FONT>
<FONT COLOR="#000000"> - able to run file as nobody user (say via perl) even with noexec on the</FONT>
<FONT COLOR="#000000"> partition (because perl simply reads/executes the file in /tmp)</FONT>
<FONT COLOR="#000000">some googling suggests it's going around... with suggestions like:</FONT>
<FONT COLOR="#000000"> - have separate /tmp partition (with noexec option on partition)</FONT>
<FONT COLOR="#000000"> - disable certain PHP functions (via php.ini)</FONT>
<FONT COLOR="#000000"> - (keep all your installed webapps patched/updated/etc.)</FONT>
<FONT COLOR="#000000"> - etc.</FONT>
<FONT COLOR="#000000">still a pain though... if anybody has a sure fire way to fight this... let me </FONT>
<FONT COLOR="#000000">know?</FONT>
</PRE>
</BLOCKQUOTE>
<BR>
Selinux is supposed to prevent this exact type of thing. It's complicated and needs careful crafting to make it suit web applications. <BR>
<BR>
In case you haven't heard of SeLinux, it's the NSA's contribution to Linux security. Essentially it's a firewall for system calls. One person who presented it to me said "There are two types of users on a Linux system. Users that can do everything, such as root, and users who can do almost everything." SElinux can control what users and applications can do. For example should you allow your httpd process to open ports other than 80 and 443?<BR>
<BR>
I want to start using SElinux but every chance I get, I don't have enough time. I figure it will take lots of getting used to.<BR>
<BR>
<TABLE CELLSPACING="0" CELLPADDING="0" WIDTH="100%">
<TR>
<TD>
-- <BR>
<TABLE CELLSPACING="0" WIDTH="500">
<TR>
<TD>
<B>John Van Ostrand</B>
</TD>
<TD ALIGN="right">
<B>Net Direct Inc.</B>
</TD>
<TD>
</TD>
</TR>
<TR>
<TD VALIGN="top">
<I>Chief Technology Officer</I>
</TD>
<TD ALIGN="right">
564 Weber St. N. Unit 12<BR>
Waterloo, ON N2L 5C6
</TD>
<TD VALIGN="top">
<A HREF="http://maps.google.ca/maps?q=Net+Direct+Inc.,+564+Weber+St.+N.+Unit+12,+Waterloo,+ON+N2L+5C6,+canada&ll=43.494599,-80.548222&spn=0.038450,0.073956&iwloc=A&hl=en">map</A>
</TD>
</TR>
<TR>
<TD>
<A HREF="mailto:john-Da48MpWaEp0CzWx7n4ubxQ@public.gmane.org">john-Da48MpWaEp0CzWx7n4ubxQ@public.gmane.org</A>
</TD>
<TD ALIGN="right">
Ph: 519-883-1172
</TD>
<TD>
ext.5102
</TD>
</TR>
<TR>
<TD>
<A HREF="http://www.netdirect.ca">Linux Solutions / IBM Hardware</A>
</TD>
<TD ALIGN="right">
Fx: 519-883-8533
</TD>
<TD>
</TD>
</TR>
</TABLE>
</TD>
</TR>
</TABLE>
</BODY>
</HTML>