diff --git a/data/auditors.sgml b/data/auditors.sgml index d95338a7e4..b44065d6b4 100644 --- a/data/auditors.sgml +++ b/data/auditors.sgml @@ -1,5 +1,5 @@ + %includes; ]> @@ -14,7 +14,7 @@

General Information

-Last Updated: $Date: 1997-02-18 01:04:17 $ +Last Updated: $Date: 1997-02-19 13:49:10 $

Overview

@@ -84,9 +84,11 @@ into the 2.1 and 2.2 branches. complex that I have turned it into a FreeBSD Security Guide. Please read this now if you haven't already. -Another excellent document is the -Secure Programming Checklist, available from AUSCERT. +Secure Programming Checklist and the +Unix Security Checklist, both available from AUSCERT.

Sign-Up sheet:

@@ -109,24 +111,126 @@ auditors will be assuming that the other 10 items are handled!

To sign up for something, please send mail to jkh@FreeBSD.org. -

- - - - - - - - - - - - - - - - - +

Module Auditor(s) Reviewer(s) Status
lib pst,ak jkh,dg,gvr,imp gvr
libc ee gvr Open
libdisk open phk,gvr Open
libexec imp,crh,ee,witr gvr Open
telnetd ac,dn imp,gvr Open
bin ac,gvr,ee imp,md,gvr Open
sbin taob,imp,ee,or md,gvr Open
usr.sbin imp,rd,marc,ee,ejc,jm md,gvr Open
usr.bin rb,rjk,rd,jha,ee,ky,bob,jm md,gvr Open
eBones mrvm gvr Open
secure mrvm,dc gvr Open
games xaa,ab,ee gvr Open
lkm dob gvr Open
release open gvr Open
contrib cg gvr Open
+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
ModuleAuditor(s)Reviewer(s)Status
bin +ac +ee +gvr* +jh +ka +mu +vk +imp* md gvr* Open
contrib +cg +gvr* Open
eBones +mrvm* +gvr* Open
games +ab +ee +xaa +gvr* Open
init +gl +gvr* Open
lib +ak +bjn +pst* +dg* imp* jkh* gvr* Open
libc +ee +mu +gvr* Open
libexec +crh +ee +imp* +witr +gvr* Open
lkm +dob +gvr* Open
sbin +ee +imp* +or* +tao +md gvr* Open
secure +dc +mrvm* +gvr* Open
telnetd +ac +dn +imp* gvr* Open
usr.bin +bob +ee +jha +jm +ky* +rb +rd +rjk +vk +md gvr* Open
usr.sbin +ee +ejc +gl +imp* +jm +marc +rd +md gvr* Open

Auditor/Reviewer keys

@@ -141,65 +245,187 @@ reach just the auditors & reviewers for a specific category, say audit-usr.sbin@FreeBSD.org.

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - +
Key Auditor/Reviewer Name and Email address
ab Aaron Bornstein aaronb@j51.com
ac Adrian Chadd adrian@psinet.net.au
ak Adam Kubicki apk@itl.waw.pl
am Albert Mietus albert@gamp.hacom.nl
avk Alexander V. Kalganov top@sonic.cris.net
bb Bob Bishop rb@gid.co.uk
bob Bob Willcox bob@luke.pmr.com
btm Brian T. Michely brianm@cmhcsys.com
cg Coranth Gryphon gryphon@healer.com
cl Chris Lambertus cmlambertus@ucdavis.edu
crh Charles Henrich henrich@crh.cl.msu.edu
dc Dan Cross tenser@spitfire.ecsel.psu.edu
dg* David Greenman davidg@FreeBSD.org
din Dinesh Nair dinesh@alphaque.com
dn David Nugent davidn@labs.usn.blaze.net.au
dob* David E. O'Brien obrien@FreeBSD.org
dz Danny J. Zerkel dzerkel@phofarm.com
ee Eivind Eklund eivind@FreeBSD.org
eh Elijah Hempstone avatar@gandalf.bss.sol.net
eh Ernest Hua hua@chromatic.com
ejc Eric J. Chet ejc@gargoyle.bazzle.com
gl Giles Lean giles@nemeton.com.au
gvr* Guido van Rooij guido@FreeBSD.org
gw Graham Wheeler gram@oms.co.za
imp* Warner Losh imp@FreeBSD.org
jb Jim Bresler jfb11@inlink.com
jha John H. Aughey jha@cs.purdue.edu
jk Jerry Kendall Jerry@kcis.com
jkh* Jordan K. Hubbard jkh@FreeBSD.org
jm Josef Moellers mollers.pad@sni.de
jmb* Jonathan M. Bresler jmb@FreeBSD.org
joe* Joe Greco jgreco@solaria.sol.net
ki Kenneth Ingham ingham@i-pi.com
ky* Kazutaka YOKOTA yokota@zodiac.mech.utsunomiya-u.ac.jp
marc Marc Slemko marcs@znep.com
md Matt Dillon dillon@best.net
mr Mike Romaniw msr@cuc.com
mrvm* Mark Murray mark@grondar.za
or* Ollivier Robert roberto@keltia.freenix.fr
pb Peter Blake ppb@baloo.tcp.co.uk
peter* Peter Wemm peter@FreeBSD.org -
phk* Poul-Henning Kamp phk@FreeBSD.org
pst* Paul Traina pst@FreeBSD.org
rb Reinier Bezuidenhout rbezuide@oskar.nanoteq.co.za
rd Rajiv Dighe rajivd@sprynet.com
rel Roger Espel Llima espel@llaic.univ-bpclermont.fr
rjk Richard J Kuhns rjk@grauel.com -
rm Robin Melville robmel@nadt.org.uk
rs Robert Sexton robert@kudra.com
sc Sergei Chechetkin csl@whale.sunbay.crimea.ua
tao Brian Tao taob@risc.org
tdr Thomas David Rivers ponds!rivers@dg-rtp.dg.com
witr Robert Withrow witr@rwwa.com
xaa Mark Huizer xaa@stack.nl
+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
KeyAuditor/Reviewer Name and Email address
abAaron Bornstein +aaronb@j51.com
acAdrian Chadd +adrian@psinet.net.au
akAdam Kubicki +apk@itl.waw.pl
amAlbert Mietus +albert@gamp.hacom.nl
avkAlexander V. Kalganov +top@sonic.cris.net
bbBob Bishop +rb@gid.co.uk
bjnBrent J. Nordquist +nordquist@platinum.com
bobBob Willcox +bob@luke.pmr.com
btmBrian T. Michely +brianm@cmhcsys.com
cgCoranth Gryphon +gryphon@healer.com
clChris Lambertus +cmlambertus@ucdavis.edu
crhCharles Henrich +henrich@crh.cl.msu.edu
dcDan Cross +tenser@spitfire.ecsel.psu.edu
dg*David Greenman +davidg@FreeBSD.org
dinDinesh Nair +dinesh@alphaque.com
dnDavid Nugent +davidn@labs.usn.blaze.net.au
dobDavid E. O'Brien +obrien@NUXI.com
dzDanny J. Zerkel +dzerkel@phofarm.com
eeEivind Eklund +eivind@FreeBSD.org
ehElijah Hempstone +avatar@gandalf.bss.sol.net
ehuErnest Hua +hua@chromatic.com
ejcEric J. Chet +ejc@gargoyle.bazzle.com
glGiles Lean +giles@nemeton.com.au
gvr*Guido van Rooij +guido@FreeBSD.org
gwGraham Wheeler +gram@oms.co.za
imp*Warner Losh +imp@FreeBSD.org
jbJim Bresler +jfb11@inlink.com
jhJake Hamby +jehamby@lightside.com
jhaJohn H. Aughey +jha@cs.purdue.edu
jkJerry Kendall +Jerry@kcis.com
jkh*Jordan K. Hubbard +jkh@FreeBSD.org
jmJosef Moellers +mollers.pad@sni.de
jmb*Jonathan M. Bresler +jmb@FreeBSD.org
joe*Joe Greco +jgreco@solaria.sol.net
kaKalganov Alexander +top@bird.cris.net
kiKenneth Ingham +ingham@i-pi.com
ky*Kazutaka YOKOTA +yokota@zodiac.mech.utsunomiya-u.ac.jp
marcMarc Slemko +marcs@znep.com
mdMatt Dillon +dillon@best.net
mrMike Romaniw +msr@cuc.com
mrvm*Mark Murray +mark@grondar.za
muMudge +mudge@l0pht.com
or*Ollivier Robert +roberto@keltia.freenix.fr
pbPeter Blake +ppb@baloo.tcp.co.uk
peter*Peter Wemm +peter@FreeBSD.org
phk*Poul-Henning Kamp +phk@FreeBSD.org
pst*Paul Traina +pst@FreeBSD.org
rbReinier Bezuidenhout +rbezuide@oskar.nanoteq.co.za
rdRajiv Dighe +rajivd@sprynet.com
relRoger Espel Llima +espel@llaic.univ-bpclermont.fr
rjkRichard J Kuhns +rjk@grauel.com
rmRobin Melville +robmel@nadt.org.uk
rsRobert Sexton +robert@kudra.com
scSergei Chechetkin +csl@whale.sunbay.crimea.ua
taoBrian Tao +taob@risc.org
tdrThomas David Rivers +ponds!rivers@dg-rtp.dg.com
vkVadim Kolontsov +vadim@tversu.ac.ru
witrRobert Withrow +witr@rwwa.com
xaaMark Huizer +xaa@stack.nl
- -

* = Has CVS commit privileges.

+

* = Has CVS commit privileges.

&footer; diff --git a/data/security.sgml b/data/security.sgml index 723a5b6b21..e37bf27861 100644 --- a/data/security.sgml +++ b/data/security.sgml @@ -1,5 +1,5 @@ + %includes; ]> @@ -14,7 +14,7 @@

FreeBSD Security Guide

-Last Updated: $Date: 1997-02-15 13:28:51 $ +Last Updated: $Date: 1997-02-19 13:49:11 $

This guide attempts to document some of the tips and tricks used by many FreeBSD security experts for securing systems and writing secure @@ -24,16 +24,20 @@ if and when they should happen. It also lists the various ways in which the systems programmer can become more security conscious and less likely to introduce security holes in the first place. +

We welcome your comments on the contents and correctness of this page. +Please send email to the +FreeBSD Security Officers if you have changes you'd like to see here. +

How to secure a FreeBSD system:

How to recover from a security compromise

Security Do's and Don'ts for Programmers:

@@ -50,8 +54,18 @@ to introduce security holes in the first place.
  • strcpy() and sprintf() calls from unbounded data. Use strncpy() and snprintf() when the length is known (or implement some other form of bounds-checking when it's not). + In fact, never use gets(3) or sprintf(3), period. -

  • Watch for strvis() and getenv() abuse. +

  • Watch for strvis(3) and getenv(3) abuse. + strvis() is easy to get the destination string wrong for, and getenv() + can return strings much longer than the user might expect - they are + one of the key ways an attack is often made on a program, causing it + to overwrite stack or variables by setting its environment variables + to unexpected values. If your program reads environment variables, + be paranoid! + +

  • Every time you see an open(2) or stat(2) call, ask yourself, "What + if it's a symbolic link?"

  • All uses of mktemp(), tempnam(), mkstemp(), etc.; make sure that they use mkstemp() instead. Also look for races in @@ -61,6 +75,9 @@ to introduce security holes in the first place.
  • Creating a directory. This will either succeed or fail.
  • Opening a file O_CREAT | O_EXCL + mkstemp(3) properly handles this for you, so all temp files should + use mkstemp to guarantee there's no race and that the permissions + are right.

  • If an attacker can force packets to go/come from another arbitrary system then that hacker has complete control @@ -144,6 +161,32 @@ to introduce security holes in the first place.

  • Pay special attention to realloc() usage - more often than not, it's not done correctly. + +

  • When using fixed-size buffers, use sizeof() to prevent lossage when + a buffer size is changed but the code which uses it isn't. For example: ++ char buf[1024]; + struct foo { ... }; + ... +BAD: + xxx(buf, 1024) + xxx(yyy, sizeof(struct foo)) +GOOD: + xxx(buf, sizeof(buf)) + xxx(yyy, sizeof(yyy)) + + +

  • Every time you see "char foo[###]", check every usage of foo to + make sure it can't be overflowed. If you can't avoid overflow + (and cases of this have been seen) then at least malloc the buffer + so you can't walk on the stack. + +

  • Always close file descriptors as soon as you can -- this makes it + more likely that the stdio buffer contents will be discarded. In + library routines, always set any file descriptors that you open to + close-on-exec. + +

    &footer; diff --git a/en/auditors.sgml b/en/auditors.sgml index d95338a7e4..b44065d6b4 100644 --- a/en/auditors.sgml +++ b/en/auditors.sgml @@ -1,5 +1,5 @@ + %includes; ]> @@ -14,7 +14,7 @@

    General Information

    -Last Updated: $Date: 1997-02-18 01:04:17 $ +Last Updated: $Date: 1997-02-19 13:49:10 $

    Overview

    @@ -84,9 +84,11 @@ into the 2.1 and 2.2 branches. complex that I have turned it into a FreeBSD Security Guide. Please read this now if you haven't already. -Another excellent document is the -Secure Programming Checklist, available from AUSCERT. +Secure Programming Checklist and the +Unix Security Checklist, both available from AUSCERT.

    Sign-Up sheet:

    @@ -109,24 +111,126 @@ auditors will be assuming that the other 10 items are handled!

    To sign up for something, please send mail to jkh@FreeBSD.org. -

    - - - - - - - - - - - - - - - - - +

    Module Auditor(s) Reviewer(s) Status
    lib pst,ak jkh,dg,gvr,imp gvr
    libc ee gvr Open
    libdisk open phk,gvr Open
    libexec imp,crh,ee,witr gvr Open
    telnetd ac,dn imp,gvr Open
    bin ac,gvr,ee imp,md,gvr Open
    sbin taob,imp,ee,or md,gvr Open
    usr.sbin imp,rd,marc,ee,ejc,jm md,gvr Open
    usr.bin rb,rjk,rd,jha,ee,ky,bob,jm md,gvr Open
    eBones mrvm gvr Open
    secure mrvm,dc gvr Open
    games xaa,ab,ee gvr Open
    lkm dob gvr Open
    release open gvr Open
    contrib cg gvr Open
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    ModuleAuditor(s)Reviewer(s)Status
    bin +ac +ee +gvr* +jh +ka +mu +vk +imp* md gvr* Open
    contrib +cg +gvr* Open
    eBones +mrvm* +gvr* Open
    games +ab +ee +xaa +gvr* Open
    init +gl +gvr* Open
    lib +ak +bjn +pst* +dg* imp* jkh* gvr* Open
    libc +ee +mu +gvr* Open
    libexec +crh +ee +imp* +witr +gvr* Open
    lkm +dob +gvr* Open
    sbin +ee +imp* +or* +tao +md gvr* Open
    secure +dc +mrvm* +gvr* Open
    telnetd +ac +dn +imp* gvr* Open
    usr.bin +bob +ee +jha +jm +ky* +rb +rd +rjk +vk +md gvr* Open
    usr.sbin +ee +ejc +gl +imp* +jm +marc +rd +md gvr* Open

    Auditor/Reviewer keys

    @@ -141,65 +245,187 @@ reach just the auditors & reviewers for a specific category, say audit-usr.sbin@FreeBSD.org.

    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - +
    Key Auditor/Reviewer Name and Email address
    ab Aaron Bornstein aaronb@j51.com
    ac Adrian Chadd adrian@psinet.net.au
    ak Adam Kubicki apk@itl.waw.pl
    am Albert Mietus albert@gamp.hacom.nl
    avk Alexander V. Kalganov top@sonic.cris.net
    bb Bob Bishop rb@gid.co.uk
    bob Bob Willcox bob@luke.pmr.com
    btm Brian T. Michely brianm@cmhcsys.com
    cg Coranth Gryphon gryphon@healer.com
    cl Chris Lambertus cmlambertus@ucdavis.edu
    crh Charles Henrich henrich@crh.cl.msu.edu
    dc Dan Cross tenser@spitfire.ecsel.psu.edu
    dg* David Greenman davidg@FreeBSD.org
    din Dinesh Nair dinesh@alphaque.com
    dn David Nugent davidn@labs.usn.blaze.net.au
    dob* David E. O'Brien obrien@FreeBSD.org
    dz Danny J. Zerkel dzerkel@phofarm.com
    ee Eivind Eklund eivind@FreeBSD.org
    eh Elijah Hempstone avatar@gandalf.bss.sol.net
    eh Ernest Hua hua@chromatic.com
    ejc Eric J. Chet ejc@gargoyle.bazzle.com
    gl Giles Lean giles@nemeton.com.au
    gvr* Guido van Rooij guido@FreeBSD.org
    gw Graham Wheeler gram@oms.co.za
    imp* Warner Losh imp@FreeBSD.org
    jb Jim Bresler jfb11@inlink.com
    jha John H. Aughey jha@cs.purdue.edu
    jk Jerry Kendall Jerry@kcis.com
    jkh* Jordan K. Hubbard jkh@FreeBSD.org
    jm Josef Moellers mollers.pad@sni.de
    jmb* Jonathan M. Bresler jmb@FreeBSD.org
    joe* Joe Greco jgreco@solaria.sol.net
    ki Kenneth Ingham ingham@i-pi.com
    ky* Kazutaka YOKOTA yokota@zodiac.mech.utsunomiya-u.ac.jp
    marc Marc Slemko marcs@znep.com
    md Matt Dillon dillon@best.net
    mr Mike Romaniw msr@cuc.com
    mrvm* Mark Murray mark@grondar.za
    or* Ollivier Robert roberto@keltia.freenix.fr
    pb Peter Blake ppb@baloo.tcp.co.uk
    peter* Peter Wemm peter@FreeBSD.org -
    phk* Poul-Henning Kamp phk@FreeBSD.org
    pst* Paul Traina pst@FreeBSD.org
    rb Reinier Bezuidenhout rbezuide@oskar.nanoteq.co.za
    rd Rajiv Dighe rajivd@sprynet.com
    rel Roger Espel Llima espel@llaic.univ-bpclermont.fr
    rjk Richard J Kuhns rjk@grauel.com -
    rm Robin Melville robmel@nadt.org.uk
    rs Robert Sexton robert@kudra.com
    sc Sergei Chechetkin csl@whale.sunbay.crimea.ua
    tao Brian Tao taob@risc.org
    tdr Thomas David Rivers ponds!rivers@dg-rtp.dg.com
    witr Robert Withrow witr@rwwa.com
    xaa Mark Huizer xaa@stack.nl
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    KeyAuditor/Reviewer Name and Email address
    abAaron Bornstein +aaronb@j51.com
    acAdrian Chadd +adrian@psinet.net.au
    akAdam Kubicki +apk@itl.waw.pl
    amAlbert Mietus +albert@gamp.hacom.nl
    avkAlexander V. Kalganov +top@sonic.cris.net
    bbBob Bishop +rb@gid.co.uk
    bjnBrent J. Nordquist +nordquist@platinum.com
    bobBob Willcox +bob@luke.pmr.com
    btmBrian T. Michely +brianm@cmhcsys.com
    cgCoranth Gryphon +gryphon@healer.com
    clChris Lambertus +cmlambertus@ucdavis.edu
    crhCharles Henrich +henrich@crh.cl.msu.edu
    dcDan Cross +tenser@spitfire.ecsel.psu.edu
    dg*David Greenman +davidg@FreeBSD.org
    dinDinesh Nair +dinesh@alphaque.com
    dnDavid Nugent +davidn@labs.usn.blaze.net.au
    dobDavid E. O'Brien +obrien@NUXI.com
    dzDanny J. Zerkel +dzerkel@phofarm.com
    eeEivind Eklund +eivind@FreeBSD.org
    ehElijah Hempstone +avatar@gandalf.bss.sol.net
    ehuErnest Hua +hua@chromatic.com
    ejcEric J. Chet +ejc@gargoyle.bazzle.com
    glGiles Lean +giles@nemeton.com.au
    gvr*Guido van Rooij +guido@FreeBSD.org
    gwGraham Wheeler +gram@oms.co.za
    imp*Warner Losh +imp@FreeBSD.org
    jbJim Bresler +jfb11@inlink.com
    jhJake Hamby +jehamby@lightside.com
    jhaJohn H. Aughey +jha@cs.purdue.edu
    jkJerry Kendall +Jerry@kcis.com
    jkh*Jordan K. Hubbard +jkh@FreeBSD.org
    jmJosef Moellers +mollers.pad@sni.de
    jmb*Jonathan M. Bresler +jmb@FreeBSD.org
    joe*Joe Greco +jgreco@solaria.sol.net
    kaKalganov Alexander +top@bird.cris.net
    kiKenneth Ingham +ingham@i-pi.com
    ky*Kazutaka YOKOTA +yokota@zodiac.mech.utsunomiya-u.ac.jp
    marcMarc Slemko +marcs@znep.com
    mdMatt Dillon +dillon@best.net
    mrMike Romaniw +msr@cuc.com
    mrvm*Mark Murray +mark@grondar.za
    muMudge +mudge@l0pht.com
    or*Ollivier Robert +roberto@keltia.freenix.fr
    pbPeter Blake +ppb@baloo.tcp.co.uk
    peter*Peter Wemm +peter@FreeBSD.org
    phk*Poul-Henning Kamp +phk@FreeBSD.org
    pst*Paul Traina +pst@FreeBSD.org
    rbReinier Bezuidenhout +rbezuide@oskar.nanoteq.co.za
    rdRajiv Dighe +rajivd@sprynet.com
    relRoger Espel Llima +espel@llaic.univ-bpclermont.fr
    rjkRichard J Kuhns +rjk@grauel.com
    rmRobin Melville +robmel@nadt.org.uk
    rsRobert Sexton +robert@kudra.com
    scSergei Chechetkin +csl@whale.sunbay.crimea.ua
    taoBrian Tao +taob@risc.org
    tdrThomas David Rivers +ponds!rivers@dg-rtp.dg.com
    vkVadim Kolontsov +vadim@tversu.ac.ru
    witrRobert Withrow +witr@rwwa.com
    xaaMark Huizer +xaa@stack.nl
    - -

    * = Has CVS commit privileges.

    +

    * = Has CVS commit privileges.

    &footer; diff --git a/en/security.sgml b/en/security.sgml index 723a5b6b21..e37bf27861 100644 --- a/en/security.sgml +++ b/en/security.sgml @@ -1,5 +1,5 @@ + %includes; ]> @@ -14,7 +14,7 @@

    FreeBSD Security Guide

    -Last Updated: $Date: 1997-02-15 13:28:51 $ +Last Updated: $Date: 1997-02-19 13:49:11 $

    This guide attempts to document some of the tips and tricks used by many FreeBSD security experts for securing systems and writing secure @@ -24,16 +24,20 @@ if and when they should happen. It also lists the various ways in which the systems programmer can become more security conscious and less likely to introduce security holes in the first place. +

    We welcome your comments on the contents and correctness of this page. +Please send email to the +FreeBSD Security Officers if you have changes you'd like to see here. +

    How to secure a FreeBSD system:

    How to recover from a security compromise

    Security Do's and Don'ts for Programmers:

    @@ -50,8 +54,18 @@ to introduce security holes in the first place.
  • strcpy() and sprintf() calls from unbounded data. Use strncpy() and snprintf() when the length is known (or implement some other form of bounds-checking when it's not). + In fact, never use gets(3) or sprintf(3), period. -

  • Watch for strvis() and getenv() abuse. +

  • Watch for strvis(3) and getenv(3) abuse. + strvis() is easy to get the destination string wrong for, and getenv() + can return strings much longer than the user might expect - they are + one of the key ways an attack is often made on a program, causing it + to overwrite stack or variables by setting its environment variables + to unexpected values. If your program reads environment variables, + be paranoid! + +

  • Every time you see an open(2) or stat(2) call, ask yourself, "What + if it's a symbolic link?"

  • All uses of mktemp(), tempnam(), mkstemp(), etc.; make sure that they use mkstemp() instead. Also look for races in @@ -61,6 +75,9 @@ to introduce security holes in the first place.
  • Creating a directory. This will either succeed or fail.
  • Opening a file O_CREAT | O_EXCL + mkstemp(3) properly handles this for you, so all temp files should + use mkstemp to guarantee there's no race and that the permissions + are right.

  • If an attacker can force packets to go/come from another arbitrary system then that hacker has complete control @@ -144,6 +161,32 @@ to introduce security holes in the first place.

  • Pay special attention to realloc() usage - more often than not, it's not done correctly. + +

  • When using fixed-size buffers, use sizeof() to prevent lossage when + a buffer size is changed but the code which uses it isn't. For example: ++ char buf[1024]; + struct foo { ... }; + ... +BAD: + xxx(buf, 1024) + xxx(yyy, sizeof(struct foo)) +GOOD: + xxx(buf, sizeof(buf)) + xxx(yyy, sizeof(yyy)) + + +

  • Every time you see "char foo[###]", check every usage of foo to + make sure it can't be overflowed. If you can't avoid overflow + (and cases of this have been seen) then at least malloc the buffer + so you can't walk on the stack. + +

  • Always close file descriptors as soon as you can -- this makes it + more likely that the stdio buffer contents will be discarded. In + library routines, always set any file descriptors that you open to + close-on-exec. + +

    &footer;