On Fri, Jan 22, 2010 at 12:19:49PM +0100, Miloslav Trmač wrote:
Hello,
In Fedora 12 several daemons (e.g. dhclient) were modified to drop
unnecessary capabilities, most importantly the "dac_override"
capability, allowing the daemon to ignore file permission bits. This,
in combination with removing some permissions from important system
directories and files (such as /etc/shadow), has restricted the amount
of damage that can be done by exploiting such daemons.
We can extend the protection to all executables by a simple addition to
redhat-rpm-config (
https://bugzilla.redhat.com/show_bug.cgi?id=556897 ).
After applying this patch, executable files in all rebuilt packages
would not be writeable, most often using mode 0555.
Is it possible we could remove unreadable binaries with the same
change? See:
http://www.redhat.com/archives/rhl-devel-list/2009-October/thread.html#00987
Rich.
--
Richard Jones, Virtualization Group, Red Hat
http://people.redhat.com/~rjones
virt-df lists disk usage of guests without needing to install any
software inside the virtual machine. Supports Linux and Windows.
http://et.redhat.com/~rjones/virt-df/