Re: tame userland diff

2015-10-06 Thread Remco
> > Be patient. I am not adding all the planned layers to this subsystem > in one go. There is something being designed for exec, and it will > show up when the time is right. Theo and Sebastien, Thanks for your explanations, My main concern was "What about programs that actually need exec ?"

Re: tame userland diff

2015-10-05 Thread Theo de Raadt
> The problem of exec(2) is if we permit it (without herited tame flags) > your program has a way to go out his expected behaviour. For example, if > a tamed program has a bug that permit execution of code, the attacker > would just has to do "exec(something-else)" to escape the imposed > policy. W

Re: tame userland diff

2015-10-05 Thread Sebastien Marie
Hi Remco, On Mon, Oct 05, 2015 at 07:47:26PM +0200, Remco wrote: > Sebastien Marie wrote: > > > Just a remark about "proc" request. It won't allow calling exec(2), but > > only fork(2) (and some others, see the man page for details). > > > > exec(2) is really special for a tamed program: allowin

Re: tame userland diff

2015-10-05 Thread Theo de Raadt
> Assume you have a bad program1 and you write your tame(2)-ed program2 that > disallows execution of program1. But you also have to use my un-tame(2)-ed > program3 that allows execution of program1. How does your tame(2)-ed > program2 protect you now against executing program1 ? You still risk

Re: tame userland diff

2015-10-05 Thread Remco
Sebastien Marie wrote: > Just a remark about "proc" request. It won't allow calling exec(2), but > only fork(2) (and some others, see the man page for details). > > exec(2) is really special for a tamed program: allowing it could permit > to defeat the purpose of tame. > I'm trying to understan

Re: tame userland diff

2015-10-04 Thread Mike Burns
On 2015-10-04 07.15.47 +0200, Sebastien Marie wrote: > On Sat, Oct 03, 2015 at 09:52:13PM +0200, Mike Burns wrote: > > On 2015-10-03 09.53.54 -0600, Theo de Raadt wrote: > > > > > > I don't know why you added "proc". I don't see a need for it. Do > > > you have a seperate test cases that prompts

Re: tame userland diff

2015-10-04 Thread Ted Unangst
Sebastien Marie wrote: > - if an exec'ed program starts with herited TAME flags: the > initialisation of the program would be difficult as it would be > already tamed. i've been thinking about this some more. true in some cases, but i think in many cases, what we are banning should be ba

Re: tame userland diff

2015-10-03 Thread Sebastien Marie
On Sat, Oct 03, 2015 at 09:52:13PM +0200, Mike Burns wrote: > On 2015-10-03 09.53.54 -0600, Theo de Raadt wrote: > > > > I don't know why you added "proc". I don't see a need for it. Do > > you have a seperate test cases that prompts this? > > Yes, here is a simple test for it: > > $ echo "!ec

Re: tame userland diff

2015-10-03 Thread Mike Burns
I see that I am too late: http://marc.info/?l=openbsd-cvs&m=144388023505289&w=2 http://marc.info/?l=openbsd-cvs&m=144388037405304&w=2 On 2015-10-03 22.44.22 +0200, Mike Burns wrote: > Fix tame(2) for patch(1). To recreate: > > /usr/src/regress/usr.bin/diff$ cat t2.1 > Below is an example license

Re: tame userland diff

2015-10-03 Thread Mike Burns
Fix tame(2) for patch(1). To recreate: /usr/src/regress/usr.bin/diff$ cat t2.1 Below is an example license to be used for new code in OpenBSD, modeled after the ISC license. It is important to specify the year of the copyright. Additional years should be separated by a comma, e.g. Copyright

Re: tame userland diff

2015-10-03 Thread Mike Burns
On 2015-10-03 09.53.54 -0600, Theo de Raadt wrote: > > Before, from the tame patch in snapshots: > > > > $ dc /dev/null > > Killed > > $ > > > > After the below patch: > > > > $ dc /dev/null > > $ > > > > Found via the regress tests. > > I don't know why you added "proc". I don't see a need

Re: tame userland diff

2015-10-03 Thread Theo de Raadt
> Before, from the tame patch in snapshots: > > $ dc /dev/null > Killed > $ > > After the below patch: > > $ dc /dev/null > $ > > Found via the regress tests. I don't know why you added "proc". I don't see a need for it. Do you have a seperate test cases that prompts this? So we can do bet

Re: tame userland diff

2015-10-03 Thread Mike Burns
Before, from the tame patch in snapshots: $ dc /dev/null Killed $ After the below patch: $ dc /dev/null $ Found via the regress tests. Index: dc.c === RCS file: /cvs/src/usr.bin/dc/dc.c,v retrieving revision 1.13 diff -u -p -r1.1

Re: tame userland diff

2015-10-02 Thread Gregor Best
On Fri, Oct 02, 2015 at 01:49:13PM +0200, Tim Kuijsten wrote: > [...] > that's a 403.. Whoops, fixed. -- Gregor -- Kirkland, Illinois, law forbids bees to fly over the village or through any of its streets.

Re: tame userland diff

2015-10-02 Thread Gregor Best
On Thu, Oct 01, 2015 at 06:55:21AM -0600, Theo de Raadt wrote: > For those who are curious, this is the tame diff which is currently > in snapshots. Yes, we are asking for testing and feedback. > [...] I'm getting ntpd(): syscall 97 with the patch applied. Kernel and ntpd sources ar

tame userland diff

2015-10-01 Thread Theo de Raadt
For those who are curious, this is the tame diff which is currently in snapshots. Yes, we are asking for testing and feedback. Index: bin/cat/cat.c === RCS file: /cvs/src/bin/cat/cat.c,v retrieving revision 1.21 diff -u -p -u -r1.21