security September 2013

security@lists.fedoraproject.org

26 participants
28 discussions

leaving setfcap in docker containers
by Matthew Miller 07 Oct '13

07 Oct '13

Quick backstory: unless run in privledged mode, Docker drops a bunch of capabilities when launching a container. One of these is setfcap. This breaks of binary RPMs like httpd where the daemon is installed with file capabilities instead. We're considering removing setfcap from the list of dropped capabilities. It seems safe to me (note that you run as root inside the container), but I'd like some security-minded review. Could this be used for evil? https://bugzilla.redhat.com/show_bug.cgi?id=1012952 Thanks! -- Matthew Miller ☁☁☁ Fedora Cloud Architect ☁☁☁ <mattdm(a)fedoraproject.org>

6 17

Re: F19 Firewall
by Lance Lassetter 03 Oct '13

03 Oct '13

Firewalld is just not workable enough for me. For instance I need to have quirky netfilter rules to make my squid proxy setup to work properly. There is no easy way to do this with firewalld. Also I set up an iptables queue so that netfilter supports suricata ips mode. This also, no easy way... Netfilter is just so diverse and firewalld seems to strip a lot of that diversity away. What about the idea that people who want to write their own iptables custom scripts that can be, after wiriting the script and implementening it, a smart way for the script to be imported...the whole script, into firewalld. Last I tried, my nat rules weren't compatible with firewalld. Like maybe a simpe iptables-save then a firewalld-save or the like. Then maybe ask if to import it into firewalld's 'home', 'work', 'public', etc. Lance Kurt Seifried <kseifried(a)redhat.com> wrote: >-----BEGIN PGP SIGNED MESSAGE----- >Hash: SHA1 > >Some random thoughts: > >1) it would be nice to have capabilities like "do you want to let >program X talk to the internet/receive connections" for client >software with a GUI notification (like basically all the windows >client/Mac OS X client firewall stuff). I would say this is probably >the biggest capability needed for normal end users. > >2) Tying firewall into networking detection, e.g. windows "is this >your home/business/public network" and then remembering it (I assume >IP/Mac address of default gateway would be a reasonably good way to >identify networks). > >3) Make it easy to modify policy, e.g. in section 1) if you choose to >block/deny something and realize that was the wrong decision how do >you go in an modify it? In Windows this is a PITA for normal users. > >Overall I'm not really sure firewalld solves much, anyone running a >server will probably be able to tweak iptables to allow incoming >services they want. So do we aim it at the end user/workstation style >usage primarily (especially ones that move around networks)? > >- -- >Kurt Seifried Red Hat Security Response Team (SRT) >PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993 >-----BEGIN PGP SIGNATURE----- >Version: GnuPG v1.4.14 (GNU/Linux) > >iQIcBAEBAgAGBQJSQdXYAAoJEBYNRVNeJnmTC6wQAIW3HNlAqfSkMSZqbFG6kbj/ >GOlnzjJOrUzt/LWwOGPCTmg/GgSOHrT4t1gT1577sL2LM5wPGCF/oll84RehiZd8 >PXNiyq3QnsOJFLjmEbm1YfGpDGae5+uR4IR3Bm1MVHBjvquhlqaje0b1yI2gs8Do >LY9sXeGmYh+YjKIUDJrOCCS/I/xE8Zl4D+aU/s1BumV9LxwsOURTzXv5x32C8zwS >5MH5rvX9LO5vJn0VMByRsoXrCSybyLnRmsDvAH9yYx+WjforKsU4wq2QVLYDtjU/ >0TO/n7qP1WO7doixYLymxwm+Fnk8J7HGa2t/2of2ZvX2AB3eRLmzj+tKzKohZR4H >jxCLImHLx/puPr6VA/4ENSrHltCCbTSDvlZGxTHAeHwszmQzYMXZ8Qv/leRf4ThO >E3wvuoIpgUWSEbE8RjVmXjX/Cd1GYz6ns35ydy2kZgHr4AfQifF+hdWHPP63/hrJ >C21iZylvIMJKF2cWOXwR4X+Zr9tDthf+UDeEE3J/uQAfj3LDvjdHXqd0xcgOSrae >nP0hPHj0apZrzY0zJfcn3JNipRDDl3qNgs8Q8tFAut5WvubCdLlVFXvLWMs6mOA2 >6TmN4ZzEh0zfeGLq+LZ1kAY0ZsIds9ziyKsxAPGlTQz3Ax9rjb40BOwClHc4wbOF >6DzOg7WN87fRSO/wCTy3 >=dDnL >-----END PGP SIGNATURE----- >-- >security mailing list >security(a)lists.fedoraproject.org >https://admin.fedoraproject.org/mailman/listinfo/security

4 9

Emergency destruction of LUKS partition
by Eric Christensen 01 Oct '13

01 Oct '13

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Someone asked me about this recently and I haven't had a chance to fully wrap my head around the solution but thought it was an interesting scenario. Background: Someone knows you have encrypted your computer using LUKS. They convince you to enter (or otherwise provide) your passphrase via the large wrench method[0]. Realcrypt method: There is plausible deniability (if properly implemented) whereas you could provide the person with the alternate passphrase which would give them access to a portion of the encrypted partition but not your real working partition. LUKS: There is no way to provide plausible deniability. Proposed solution: LUKS provides four key slots to use for decrypting a partition. How about have one key slot that when used immediately implements a deletion of the encrypted partition (or at least the key record). Thoughts? [0] http://www.xkcd.org/538/ - -- Eric - -------------------------------------------------- Eric "Sparks" Christensen Fedora Project sparks(a)fedoraproject.org - sparks(a)redhat.com 097C 82C3 52DF C64A 50C2 E3A3 8076 ABDE 024B B3D1 - -------------------------------------------------- -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.14 (GNU/Linux) iQGcBAEBCgAGBQJSSaw6AAoJEB/kgVGp2CYvDTAL/jeuWo8r39Apq7QA6hQKmDI9 Oe+GB5SRk99ecqmBKcapC6nGewfVajoeuNo27AG9CfmQ97ZSk6Oabvt8OibgXXc5 S64me8zy+Rqx2uu8i271P8DGbf3IFENMMtCdkPCfJWNU5ZAepGwBXCQXRJwC09jn MWeQ9kDFmvHZE4a8bO/G6ZPkXI+Vm7BxJYsGq6f5SVcAnqWdKWSUiZPfEcAIGPzx AFDmiR8wQpQ2e3PiHEstLYK9DHr6ALIqZxbdwwlLM/vOi7N2Xk3PobIby3KREU4b yCh5lkp2oZKkWhGY2AYgFwm1uo7/jWSDFArcJDTtr9amU1mihrpmRPBxAzcplSFK oj9LJeYXXnpGFRHNyr68Zp8Dp5ckhDgUVMV1m8MCgVgmyn7cIexIvib4kng/c/aE Wo/32VXw8T/++Gszlv4AjLKjMlD4PEVWSO9saJLeQIlwEQFZYulpVkRa/6RKesYZ NbuMocam5uk2z0BeXCXjD5A1nvh7YHnhuCjv4HizqQ== =Tdc5 -----END PGP SIGNATURE-----

10 11

Re: F19 Firewall
by Lance Lassetter 30 Sep '13

30 Sep '13

I can surely wait as long as iptables is an available option (init scrips, iptables-save, etc) :-) Lance Jiri Popelka <jpopelka(a)redhat.com> wrote: >On 09/27/2013 03:04 PM, Lance Lassetter wrote: >> with firewalld can i import this rule: >> >> /sbin/iptables -I FORWARD -m mark ! --mark 1/1 -j NFQUEUE >> >> and these rules: >> >> /sbin/iptables -t nat -A OUTPUT -p tcp --dport 80 -m owner --gid-owner squid -j ACCEPT >> /sbin/iptables -t nat -A PREROUTING -p tcp --dport 80 -j DNAT --to 192.168.1.2:3129 >> /sbin/iptables -t nat -A OUTPUT -p tcp --dport 80 -m owner --uid-owner squid -j ACCEPT >> /sbin/iptables -t nat -A OUTPUT -p tcp --dport 3129 -m owner --uid-owner squid -j ACCEPT >> /sbin/iptables -t nat -A OUTPUT -p tcp --dport 80 -j REDIRECT --to-ports 3129 >> >> hence, Netfilter rules by user/group and using NFQUEUE target. >> >> because if firewalld alllows stuff like this, then problem solved. last checked, it does not. > >Should be possible with permanent direct rules. >I'd point you to firewalld.direct(5), but I've just noticed we actually >forgot to ship it :-( > >So just create /etc/firewalld/direct.xml with something like: ><?xml version="1.0" encoding="utf-8"?> ><direct> > [ <rule ipv="ipv4" table="filter" chain="FORWARD_direct" >priority="0"> -m mark ! --mark 1/1 -j NFQUEUE </rule> ] > [ <rule ipv="ipv4" table="nat" chain="PREROUTING_direct" >priority="0"> -p tcp --dport 80 -j DNAT --to 192.168.1.2:3129 </rule> ] > [ <rule ipv="ipv4" table="nat" chain="OUTPUT_direct" >priority="0"> -p tcp --dport 80 -m owner --gid-owner squid -j ACCEPT ></rule> ] > [ <rule ipv="ipv4" table="nat" chain="OUTPUT_direct" >priority="1"> -p tcp --dport 80 -m owner --uid-owner squid -j ACCEPT ></rule> ] > [ <rule ipv="ipv4" table="nat" chain="OUTPUT_direct" >priority="2"> -p tcp --dport 3129 -m owner --uid-owner squid -j ACCEPT ></rule> ] > [ <rule ipv="ipv4" table="nat" chain="OUTPUT_direct" >priority="3"> -p tcp --dport 80 -j REDIRECT --to-ports 3129 </rule> ] ></direct> > >The X_direct chains are created by firewalld and jumped into before >all the other chains (for zones etc.). > >> and, once again why not something simple like if 'execute some iptables script' , then 'iptables-save' , then 'firewalld-save' or even skip the middle step! > >I'm CCing Thomas who has already tried to write something similar, but >it's not that simple according to his words. > >-- >Jiri

1 0

F19 Firewall
by P J P 26 Sep '13

26 Sep '13

Hello, A long thread about firewall & Firewalld application+daemon is running on fedora-devel list. About F19 Firewall -> https://lists.fedoraproject.org/pipermail/devel/2013-September/189272.html The upstream authors are in the process of rewriting Firewalld in C (from Python). The current discussion is oscillating between features+complexity and usability+security that firewall has to offer. I thought may be folks here could offer valuable suggestions to authors while they are re-writing the application; So that it ends-up being usable & secure, instead of bloated and swollen. Thank you. --- Regards -Prasad http://feedmug.com

6 9

F19 Firewall
by P J P 24 Sep '13

24 Sep '13

1 0

cracklib dicts size (and fedora password policy)
by Matthew Miller 20 Sep '13

20 Sep '13

The cracklib dicts in Fedora is 8.3M. (I'm sure some of this is my fault, as I've added to it over the years.) The cracklib pam module supports a compressed dictionary, but apparently it has a serious performance impact (https://bugzilla.redhat.com/show_bug.cgi?id=1004896). Meanwhile, in many systems today, local passwords are entirely unused. Authentication is done via keys or by kerberos. At the same time, we have an increased need for smaller systems. That 8MB starts to be a meaningful fraction of a container or an ultra-small cloud image. I do recognize the value of protecting against dictionary-based attacks when passwords are used. Maybe we could have a policy which requires _longer_ passwords but uses a much smaller dictionary? -- Matthew Miller ☁☁☁ Fedora Cloud Architect ☁☁☁ <mattdm(a)fedoraproject.org>

9 14

New contributor Loïc Maury
by Loïc Maury 20 Sep '13

20 Sep '13

Hello, My name is Loïc Maury, I am C/C++/Python/Haskell programmer, and I try to contribute to Fedora Project. I have spoken with some persons of Fedora (Infrastructure), and it seem I can help with this project. I have some experience with code audit/functional testing( job and personaly), static analysis tool, security programming. I hope I will can help and contribute. Thank you Loïc Maury

2 2

Compilation of Git Clone copy of Secure Coding Handbook
by Tristan Santore 19 Sep '13

19 Sep '13

Dear All, I am trying to compile the docs, however I get: make build-manualmkdir -p en-US/snippets python scripts/split-snippets.py . \ src/*.c src/*.cpp src/*.java src/*.py publican build --formats=html,epub,pdf --langs=en-US Setting up en-US Processing file tmp/en-US/xml/Common_Content/Conventions.xml -> tmp/en-US/xml/Common_Content/Conventions.xml Processing file tmp/en-US/xml/Common_Content/Feedback.xml -> tmp/en-US/xml/Common_Content/Feedback.xml Processing file tmp/en-US/xml/Common_Content/Legal_Notice.xml -> tmp/en-US/xml/Common_Content/Legal_Notice.xml Processing file tmp/en-US/xml_tmp/Author_Group.xml -> tmp/en-US/xml/Author_Group.xml Processing file tmp/en-US/xml_tmp/Book_Info.xml -> tmp/en-US/xml/Book_Info.xml Processing file tmp/en-US/xml_tmp/C-Allocators.xml -> tmp/en-US/xml/C-Allocators.xml Processing file tmp/en-US/xml_tmp/C-Language.xml -> tmp/en-US/xml/C-Language.xml Processing file tmp/en-US/xml_tmp/C-Libc.xml -> tmp/en-US/xml/C-Libc.xml *WARNING: Unvalidated tag: 'informalexample'. This tag may not be displayed correctly, may generate invalid xhtml, or may breach Section 508 Accessibility standards. Processing file tmp/en-US/xml_tmp/C-Other.xml -> tmp/en-US/xml/C-Other.xml Processing file tmp/en-US/xml_tmp/C.xml -> tmp/en-US/xml/C.xml Processing file tmp/en-US/xml_tmp/CXX-Language.xml -> tmp/en-US/xml/CXX-Language.xml Processing file tmp/en-US/xml_tmp/CXX-Std.xml -> tmp/en-US/xml/CXX-Std.xml Processing file tmp/en-US/xml_tmp/CXX.xml -> tmp/en-US/xml/CXX.xml Processing file tmp/en-US/xml_tmp/Defensive_Coding.xml -> tmp/en-US/xml/Defensive_Coding.xml Processing file tmp/en-US/xml_tmp/Features-Authentication.xml -> tmp/en-US/xml/Features-Authentication.xml Processing file tmp/en-US/xml_tmp/Features-TLS.xml -> tmp/en-US/xml/Features-TLS.xml Processing file tmp/en-US/xml_tmp/Java-Language.xml -> tmp/en-US/xml/Java-Language.xml Processing file tmp/en-US/xml_tmp/Java-LowLevel.xml -> tmp/en-US/xml/Java-LowLevel.xml Processing file tmp/en-US/xml_tmp/Java-SecurityManager.xml -> tmp/en-US/xml/Java-SecurityManager.xml Processing file tmp/en-US/xml_tmp/Java.xml -> tmp/en-US/xml/Java.xml Processing file tmp/en-US/xml_tmp/Python.xml -> tmp/en-US/xml/Python.xml Processing file tmp/en-US/xml_tmp/Revision_History.xml -> tmp/en-US/xml/Revision_History.xml Processing file tmp/en-US/xml_tmp/Tasks-Cryptography.xml -> tmp/en-US/xml/Tasks-Cryptography.xml Processing file tmp/en-US/xml_tmp/Tasks-Descriptors.xml -> tmp/en-US/xml/Tasks-Descriptors.xml Processing file tmp/en-US/xml_tmp/Tasks-File_System.xml -> tmp/en-US/xml/Tasks-File_System.xml Processing file tmp/en-US/xml_tmp/Tasks-Library_Design.xml -> tmp/en-US/xml/Tasks-Library_Design.xml Processing file tmp/en-US/xml_tmp/Tasks-Locking.xml -> tmp/en-US/xml/Tasks-Locking.xml Processing file tmp/en-US/xml_tmp/Tasks-Processes.xml -> tmp/en-US/xml/Tasks-Processes.xml Processing file tmp/en-US/xml_tmp/Tasks-Serialization.xml -> tmp/en-US/xml/Tasks-Serialization.xml Processing file tmp/en-US/xml_tmp/Tasks-Temporary_Files.xml -> tmp/en-US/xml/Tasks-Temporary_Files.xml Processing file tmp/en-US/xml_tmp/Web_Applications.xml -> tmp/en-US/xml/Web_Applications.xml not well-formed (invalid token) at line 46, column 43, byte 2693: Won't be escaped (DON'T DO THIS!) <h:outputText value="#{param.name}" escape=false> ==========================================^ </code> at /usr/lib64/perl5/vendor_perl/XML/Parser.pm line 187. make: *** [build-manual] Error 255 Also, may I suggest that we add that the dependencies publican, publican-fedora as requisites for compilation into the README ? Thank you. Regards, Tristan -- Tristan Santore BSc MBCS TS4523-RIPE Network and Infrastructure Operations InterNexusConnect Mobile +44-78-55069812 Tristan.Santore(a)internexusconnect.net Former Thawte Notary (Please note: Thawte has closed its WoT programme down, and I am therefore no longer able to accredit trust) For Fedora related issues, please email me at: TSantore(a)fedoraproject.org

2 3

[Secure Coding] master: Update the README file (a2df781)
by fweimer＠fedoraproject.org 19 Sep '13

19 Sep '13

Repository : http://git.fedorahosted.org/git/?p=secure-coding.git On branch : master >--------------------------------------------------------------- commit a2df781c2b364f3f8fc7cef13a820896019c8f0a Author: Florian Weimer <fweimer(a)redhat.com> Date: Thu Sep 19 17:07:03 2013 +0200 Update the README file >--------------------------------------------------------------- defensive-coding/README | 26 ++++++++++---------------- 1 files changed, 10 insertions(+), 16 deletions(-) diff --git a/defensive-coding/README b/defensive-coding/README index 934d2a2..58d0ae8 100644 --- a/defensive-coding/README +++ b/defensive-coding/README @@ -1,14 +1,17 @@ -TODO items ----------- +TODO and bug tracking +--------------------- -Suggested items for inclusion are listed here: +The secure-coding guide has its own component in Bugzilla: -https://engineering.redhat.com/trac/product-security/wiki/DefensiveCodingTODO +https://bugzilla.redhat.com/enter_bug.cgi?product=Fedora%20Documentation&component=defensive-coding-guide + +Please file bugs and suggestions there. Building HTML documentation --------------------------- -Just type "make". +Just type "make". If you do not want to build the example code, run +"make build-manual". When you type "make", the code examples in src/ are compiled (mainly to check for obvious syntax errors, but also for manual testing). If @@ -19,14 +22,5 @@ included in the manual. Dependencies ------------ -Building the manual needs the "publican" package and the -"publican-redhat-engservices" package available here: - -http://download.lab.bos.redhat.com/brewroot/packages/publican-redhat-engservices/ - -Version 0.4 of the publican-redhat-engservices package needs publican -3.0. This version of the package: - -http://download.lab.bos.redhat.com/brewroot/packages/publican-redhat-engservices/0.3/2.el6eng/noarch/publican-redhat-engservices-0.3-2.el6eng.noarch.rpm - -is known to work with publican 2.8 available in Fedora 17. +Building the manual needs the "publican" and the "publican-fedora" +packages.

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

security September 2013