Hello,
Just wanted to share with everyone the results of a data collection on various metrics of ELF files when installing just @Core group.
http://people.redhat.com/sgrubb/analysis/f32-analysis.slides.html#/
I recommend clicking on the "pop out" link and then you have more room to see the results. To use it grab SOURCERPM and dragh it just below "count", then drag FILE under SOURCERPM, then grab STACK_PROT and drag it to the right of count. Next click on the drop down and uncheck "ok". Click apply. Now you have the listing of all files without the right stack protector hardening.
Go back into the STACK_PROT, check ok, click apply. Drag STACK_PROT back to where it came from, grab USES_SECCOMP, drag it to the right of "count", click drop down, uncheck "no", click apply, now you have the list of programs using seccomp for confinement.
Have fun playing with the data. Just remember when you subset the data, it stays that way until you check all boxes. In case your curious, this is exported from a Jupyter Notebook.
-Steve
On Mon, Apr 6, 2020 at 10:04 AM Steve Grubb sgrubb@redhat.com wrote:
Just wanted to share with everyone the results of a data collection on various metrics of ELF files when installing just @Core group.
That is really cool. Thanks for sharing this, Steve.
Should I be able to see analysis for e.g. Ruby? I am asking, because I can't, so not sure if I am doing anything wrong.
Vít
Dne 06. 04. 20 v 18:03 Steve Grubb napsal(a):
Hello,
Just wanted to share with everyone the results of a data collection on various metrics of ELF files when installing just @Core group.
http://people.redhat.com/sgrubb/analysis/f32-analysis.slides.html#/
I recommend clicking on the "pop out" link and then you have more room to see the results. To use it grab SOURCERPM and dragh it just below "count", then drag FILE under SOURCERPM, then grab STACK_PROT and drag it to the right of count. Next click on the drop down and uncheck "ok". Click apply. Now you have the listing of all files without the right stack protector hardening.
Go back into the STACK_PROT, check ok, click apply. Drag STACK_PROT back to where it came from, grab USES_SECCOMP, drag it to the right of "count", click drop down, uncheck "no", click apply, now you have the list of programs using seccomp for confinement.
Have fun playing with the data. Just remember when you subset the data, it stays that way until you check all boxes. In case your curious, this is exported from a Jupyter Notebook.
-Steve
devel mailing list -- devel@lists.fedoraproject.org To unsubscribe send an email to devel-leave@lists.fedoraproject.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org
On Monday, April 6, 2020 1:22:15 PM EDT Vít Ondruch wrote:
Should I be able to see analysis for e.g. Ruby? I am asking, because I can't, so not sure if I am doing anything wrong.
Its likely not part of @Core package group. The analysis was run on a small subset of Fedora 32 to see what a minimal install would look like. This can certainly be run on a larger set of packages, but it would take some retooling to get them all. I am in the process of cleaning this up to put on github so that anyone can do this and see how things look on their system.
-Steve
Dne 06. 04. 20 v 18:03 Steve Grubb napsal(a):
Just wanted to share with everyone the results of a data collection on various metrics of ELF files when installing just @Core group.
http://people.redhat.com/sgrubb/analysis/f32-analysis.slides.html#/
I recommend clicking on the "pop out" link and then you have more room to see
the results. To use it grab SOURCERPM and dragh it just below
"count", then drag FILE under SOURCERPM, then grab STACK_PROT and drag it to the right of count. Next click on the drop down and uncheck "ok". Click apply. Now you have the listing of all files without the right stack protector hardening.>
Go back into the STACK_PROT, check ok, click apply. Drag STACK_PROT back to
where it came from, grab USES_SECCOMP, drag it to the right of
"count", click drop down, uncheck "no", click apply, now you have the list of programs using seccomp for confinement.
Have fun playing with the data. Just remember when you subset the data, it
stays that way until you check all boxes. In case your curious,
this is exported from a Jupyter Notebook.
-Steve
devel mailing list -- devel@lists.fedoraproject.org To unsubscribe send an email to devel-leave@lists.fedoraproject.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List
Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject. org
devel mailing list -- devel@lists.fedoraproject.org To unsubscribe send an email to devel-leave@lists.fedoraproject.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.or g
Dne 06. 04. 20 v 19:45 Steve Grubb napsal(a):
On Monday, April 6, 2020 1:22:15 PM EDT Vít Ondruch wrote:
Should I be able to see analysis for e.g. Ruby? I am asking, because I can't, so not sure if I am doing anything wrong.
Its likely not part of @Core package group.
Ah, right. I have missed that bit. Sorry for the noise.
Vít
The analysis was run on a small subset of Fedora 32 to see what a minimal install would look like. This can certainly be run on a larger set of packages, but it would take some retooling to get them all. I am in the process of cleaning this up to put on github so that anyone can do this and see how things look on their system.
-Steve
Dne 06. 04. 20 v 18:03 Steve Grubb napsal(a):
Just wanted to share with everyone the results of a data collection on various metrics of ELF files when installing just @Core group.
http://people.redhat.com/sgrubb/analysis/f32-analysis.slides.html#/
I recommend clicking on the "pop out" link and then you have more room to see
the results. To use it grab SOURCERPM and dragh it just below
"count", then drag FILE under SOURCERPM, then grab STACK_PROT and drag it to the right of count. Next click on the drop down and uncheck "ok". Click apply. Now you have the listing of all files without the right stack protector hardening.>
Go back into the STACK_PROT, check ok, click apply. Drag STACK_PROT back to
where it came from, grab USES_SECCOMP, drag it to the right of
"count", click drop down, uncheck "no", click apply, now you have the list of programs using seccomp for confinement.
Have fun playing with the data. Just remember when you subset the data, it
stays that way until you check all boxes. In case your curious,
this is exported from a Jupyter Notebook.
-Steve
devel mailing list -- devel@lists.fedoraproject.org To unsubscribe send an email to devel-leave@lists.fedoraproject.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List
Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject. org
devel mailing list -- devel@lists.fedoraproject.org To unsubscribe send an email to devel-leave@lists.fedoraproject.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.or g
On Mon, Apr 06, 2020 at 12:03:46PM -0400, Steve Grubb wrote:
Just wanted to share with everyone the results of a data collection on various metrics of ELF files when installing just @Core group.
http://people.redhat.com/sgrubb/analysis/f32-analysis.slides.html#/
I recommend clicking on the "pop out" link and then you have more room to see the results. To use it grab SOURCERPM and dragh it just below "count", then drag FILE under SOURCERPM, then grab STACK_PROT and drag it to the right of count. Next click on the drop down and uncheck "ok". Click apply. Now you have the listing of all files without the right stack protector hardening.
Go back into the STACK_PROT, check ok, click apply. Drag STACK_PROT back to where it came from, grab USES_SECCOMP, drag it to the right of "count", click drop down, uncheck "no", click apply, now you have the list of programs using seccomp for confinement.
Have fun playing with the data. Just remember when you subset the data, it stays that way until you check all boxes. In case your curious, this is exported from a Jupyter Notebook.
This is a nice visual. I'd like to ensure the check in rpminspect is doing the same thing. What are you using to check for your STACK_PROT and USES_SECCOMP?
Thanks,
On Wednesday, April 8, 2020 11:11:36 AM EDT David Cantrell wrote:
Just wanted to share with everyone the results of a data collection on various metrics of ELF files when installing just @Core group.
http://people.redhat.com/sgrubb/analysis/f32-analysis.slides.html#/
I recommend clicking on the "pop out" link and then you have more room to see the results. To use it grab SOURCERPM and dragh it just below "count", then drag FILE under SOURCERPM, then grab STACK_PROT and drag it to the right of count. Next click on the drop down and uncheck "ok". Click apply. Now you have the listing of all files without the right stack protector hardening.
Go back into the STACK_PROT, check ok, click apply. Drag STACK_PROT back to where it came from, grab USES_SECCOMP, drag it to the right of "count", click drop down, uncheck "no", click apply, now you have the list of programs using seccomp for confinement.
Have fun playing with the data. Just remember when you subset the data, it stays that way until you check all boxes. In case your curious, this is exported from a Jupyter Notebook.
This is a nice visual.
I'm hoping it inspires people to do some poking around to help harden the OS a little more. For example, you can click on CLASS and uncheck everything but daemons. Then go down to CHANGES_UID and make only the no checked. This is how many daemons are not changing to another account and still using root.
I'd like to ensure the check in rpminspect is doing the same thing. What are you using to check for your STACK_PROT
This is annocheck
and USES_SECCOMP?
readelf -s $f 2>/dev/null | grep FUNC | egrep 'seccomp_rule_add|seccomp'
This detects either direct use of seccomp or use of libseccomp.
Best Regards, -Steve
What are you using to check for your STACK_PROT
This is annocheck
Alternate: ----- $ readelf --segments ./the_app Program Headers: Type Offset VirtAddr PhysAddr FileSiz MemSiz Flags Align GNU_STACK 0x0000000000000000 0x0000000000000000 0x0000000000000000 0x0000000000000000 0x0000000000000000 RW 0x10 ----- where this app uses only "RW" and not "X", so the stack is not executable.
On 4/11/20 4:38 AM, Kevin Kofler wrote:
Steve Grubb wrote:
readelf -s $f 2>/dev/null | grep FUNC | egrep 'seccomp_rule_add|seccomp'
Since seccomp is a substring of seccomp_rule_add, it is pointless to grep for both.
Yes, the output is the same. But the documentation is not as explicit. A comment might be helpful: ... | grep seccomp # also covers seccomp_rule_add
On Saturday, April 11, 2020 8:58:48 AM EDT John Reiser wrote:
On 4/11/20 4:38 AM, Kevin Kofler wrote:
Steve Grubb wrote:
readelf -s $f 2>/dev/null | grep FUNC | egrep 'seccomp_rule_add|seccomp'
Since seccomp is a substring of seccomp_rule_add, it is pointless to grep for both.
Yes, the output is the same. But the documentation is not as explicit. A comment might be helpful: ... | grep seccomp # also covers seccomp_rule_add
Precisely. The grep is to explicitly document there are 2 ways you can get into this. Direct use of the syscall, and use of libseccomp. There is a comment above explaining this, at least in my script..
-Steve