Messages in this thread | | | From | Johannes Schlumberger <> | Date | Thu, 21 Jun 2007 20:21:42 +0200 | Subject | Re: [PATCH] signed binaries support [0/4] |
| |
Hi,
> > Even if it does not really improve security too much it can be helpful as a > > part of a larger system. For example around here we use a 'sbit-checker' that > > basically does a 'find' and 'chmod', which we would be able to replace by this > > patch. > > Something that sounds as if it would increase security but doesn't > really increase security is actually bad since it gives users a false > impression of security.
We are aware of the limitations, this approach has. It is not designed to make every bit of executed code trusted, because that what just be the same as before. Everything would be given the same amount of trust. What we do, is establish a caste of binaries and processes more trusted than the rest, which could be used for special tasks.
> > Also our patch is not solely about suid-binaries, we just implemented > > suid-checking because it seemed a simple and obvious thing to do. Our real aim > > was to implement binary signatures, which can be used in numerous security > > related checks around the kernel. Btw. if you have any good ideas where one > > could use them, please tell us :)
> Does writing an ELF loader in perl circumvent everything you want to do?
No, it does not. We do check any executable pages. regards, Johannes
-- Johannes Schlumberger Department of Computer Science IV Martensstrasse 1 D-91058 Erlangen Germany University of Erlangen-Nuremberg http://wwwcip.informatik.uni-erlangen.de/~spjsschl - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |