Re: systrace insecure [was: Re: chroot browser]

2009-04-04 Thread Edd Barrett
Howdy, On Thu, Mar 26, 2009 at 09:12:42AM -0600, Theo de Raadt wrote: > That said, this is not enough reason to entirely delete the code. It > still has uses. It's useful for checking ports are not dumping junk all over the file-system. Please keep it. Best Regards Edd Barrett (Freelance softw

Re: systrace insecure [was: Re: chroot browser]

2009-04-03 Thread Niels Provos
On Thu, Mar 26, 2009 at 8:23 AM, Jonathan Schleifer wrote: > It was removed when I reported a bug in NETBSD-5-0 that would crash > the Kernel when you tried to use systrace. Instead of fixing that, > they removed it. Looks like you will have to run OpenBSD then. For my personal use, I find syst

Re: systrace insecure [was: Re: chroot browser]

2009-03-26 Thread Theo de Raadt
> On Thu, Mar 26, 2009 at 10:12 AM, Theo de Raadt > wrote: > > > real; systrace does have the ability to "grant root" unless you build > > Should that read "does not"? > > > the policy specifically to do such a stupid thing (actually, I am not Oh, indeed. Sorry. systrace cannot grant root u

Re: systrace insecure [was: Re: chroot browser]

2009-03-26 Thread Gregg Reynolds
On Thu, Mar 26, 2009 at 10:12 AM, Theo de Raadt wrote: > real; systrace does have the ability to "grant root" unless you build Should that read "does not"? > the policy specifically to do such a stupid thing (actually, I am not -g

Re: systrace insecure [was: Re: chroot browser]

2009-03-26 Thread Jonathan Schleifer
Am 26.03.2009 um 16:12 schrieb Theo de Raadt: > They freaked out and did the wrong thing. It was removed when I reported a bug in NETBSD-5-0 that would crash the Kernel when you tried to use systrace. Instead of fixing that, they removed it. > systrace has a small problem. It is a very diff

Re: systrace insecure [was: Re: chroot browser]

2009-03-26 Thread Theo de Raadt
> > I guess you should take a look at Systrace: > > http://en.wikipedia.org/wiki/Systrace > > > This was removed from NetBSD some time ago because it is vulnerable. > They said it's not only possible to circumvent it, but also gain root > using it. Is this fixed in OpenBSD somehow? They frea

systrace insecure [was: Re: chroot browser]

2009-03-26 Thread Jonathan Schleifer
Am 26.03.2009 um 07:17 schrieb Tobias Weisserth: > I guess you should take a look at Systrace: > http://en.wikipedia.org/wiki/Systrace This was removed from NetBSD some time ago because it is vulnerable. They said it's not only possible to circumvent it, but also gain root using it. Is this