5 ms·

With SIP you can't change some things even as root. SIP has definitely made macos a harder target, though it is still lagging Windows in some areas. Linux is al

With SIP you can't change some things even as root. SIP has definitely made macos a harder target, though it is still lagging Windows in some areas. Linux is almost comically unprotected. @grishka Edit because I'm rate limited: I've not seen anything that does executable validation for linux and actually works. Needs lots of kernel support. See the response from the old DigSig author: https://stackoverflow.com/questions/1732927/signed-executables-under-linux/ https://stackoverflow.com/questions/1732927/signed-executabl... You can check binary signatures on disk (tripwire) but that is extremely tiresome to maintain and does not prevent straight loading of shellcode into memory. More recently: https://lwn.net/Articles/733431/ https://lwn.net/Articles/733431/ Signed kernel modules is on its way though: https://www.kernel.org/doc/html/latest/admin-guide/module-signing.html https://www.kernel.org/doc/html/latest/admin-guide/module-si... I guess that would be a place to start for implementing SIP...

andy_ppp 6y ago
Interesting thanks, what would be the Linux equivalent of SIP?
- grishka 6y ago
  SIP relies on entitlements, which rely on code signing. I'm not sure code signing is at all a thing on Linux.
  - damnyou 6y ago
    Package signing is definitely a thing on Linux.
    - iso1210 6y ago
      On installation sure, but not on execution. /usr/bin/vim was installed by my package manager, but there's no guarentee the version I'm running matches the version that was installed. Now in debian there is a file which has a checksum of the version the package installed, but that's not checked on execution, nor is it itself signed (so the process that replaced vim could just as easilly replace the checksum, or the process that checks the checksum)
curt15 6y ago
>I've not seen anything that does executable validation for linux and actually works. ChromeOS uses dm-verity to verify the root partition at runtime, similar to Mac OS's signed system volume.
- grishka 6y ago
  So does Android. But the executable binaries themselves aren't signed, this only verifies the integrity of the system partition at boot time.
deleted 6y ago
[deleted]

andy_ppp 6y ago

Interesting thanks, what would be the Linux equivalent of SIP?

grishka 6y ago
SIP relies on entitlements, which rely on code signing. I'm not sure code signing is at all a thing on Linux.
- damnyou 6y ago
  Package signing is definitely a thing on Linux.
  - iso1210 6y ago
    On installation sure, but not on execution. /usr/bin/vim was installed by my package manager, but there's no guarentee the version I'm running matches the version that was installed. Now in debian there is a file which has a checksum of the version the package installed, but that's not checked on execution, nor is it itself signed (so the process that replaced vim could just as easilly replace the checksum, or the process that checks the checksum)

curt15 6y ago

>I've not seen anything that does executable validation for linux and actually works. ChromeOS uses dm-verity to verify the root partition at runtime, similar to Mac OS's signed system volume.

grishka 6y ago
So does Android. But the executable binaries themselves aren't signed, this only verifies the integrity of the system partition at boot time.

deleted 6y ago

[deleted]