OpenBSD Journal

Systrace toolkit and assistance

Contributed by jose on from the assisting-you dept.

Luiz Gustavo has put together a nice collection of policies and help for securing your system with systrace:

http://hades.uint8t.org/systrace.html

He's been at this for quite a while, and his policies and such are pretty well tested.

(Comments are closed)

Comments

  1. By Luiz Gustavo () on

    Feel free to send mails with complains and ideas, I'm already with some up here.
    Basically support is needed to provide policies addressing daemons and programs which I missed or don't use at all.

    Comments

    1. By Anonymous Coward () on

      Thanks for the collection.

  2. By raiten () julien.touche@lycos.com on mailto:julien.touche@lycos.com

    i've worked a lot on systrace but one thing i would love to get doc is template

    i don't know if template is only used on creation or always (like an #include) but it could be interesting

    but there is NO doc, except code ...

  3. By Anonymous Coward () on

    Sorry for this stupid question, but let say, I don't want user to be able to execute ifconfig, what do I put in /etc/systrace/sbin_ifconfig ?

    I tried to add:
    native-execve: filename eq "/sbin/ifconfig" and argv eq "/sbin/ifconfig" then deny, if user != root

    but i don't think that's right, since the user can still see the output. any help?

    Comments

    1. By bumby () on

      Just out of curiosity, you do exec /sbin/ifconfig with systrace, right?
      systrace -A /sbin/systrace

      I never used systrace before, tried it now for some minutes, so it may be possible to get systrace invoked without actually running processes directly through systrace. Like, having systrace as a daemon, and get the shell/kernel? to tell the systraced to start the app when you execute for instance /sbin/ifconfig. That would have been neat.

      Is it possible? Cause that could be usefull to restrict shell-users.

    2. By tedu () on

      you have to systrace their shell, which is what is calling exec.

      Comments

      1. By tedu () on

        note that nothing prevents them from compiling ifconfig on their own, calling it getsecretinfo, and running it, unless you have some default deny policy on exec.

    3. By Anonymous Coward () on

      actually, I'm using the stsh now, but I just want to see how can I block certain program that I don't want people to use (and I used ifconfig as the example). but yeah, I figured the policy was wrong though :(

    4. By Luiz Gustavo () on

      native-execve: filename eq "/sbin/ifconfig" then deny

      should be more than enough.

  4. By David Moreno Garza () damog@damog.net on http://damog.net

    The link es down.

    Comments

    1. By Damog () on

      s/es/is

    2. By Pedro Martelletto () on

      he's having problems with his adsl provider. it will be up again as soon as possible.

  5. By Luiz Gustavo () on

    My ADSL is back. :)

Latest Articles

Credits

Copyright © - Daniel Hartmeier. All rights reserved. Articles and comments are copyright their respective authors, submission implies license to publish on this web site. Contents of the archive prior to as well as images and HTML templates were copied from the fabulous original deadly.org with Jose's and Jim's kind permission. This journal runs as CGI with httpd(8) on OpenBSD, the source code is BSD licensed. undeadly \Un*dead"ly\, a. Not subject to death; immortal. [Obs.]