4 ms·

Sigh. No, I didn't. Saying OpenBSD 'really really really hopes' an attacker doesn't get root is still 100% correct. They are still prioritizing removing bugs a

Sigh. No, I didn't. Saying OpenBSD 'really really really hopes' an attacker doesn't get root is still 100% correct. They are still prioritizing removing bugs ahead of time instead of providing stronger tools to prepare for a scenario where someone does exploit a bug they didn't get to. > Besides, by that logic, your systems are totally insecure because you're just really really really hoping the attacker doesn't get an unconfined process. Which is where things like SELinux come in, which is my whole point.....

yjftsjthsd-h 4y ago
> They are still prioritizing removing bugs ahead of time instead of providing stronger tools to prepare for a scenario where someone does exploit a bug they didn't get to. They're absolutely dealing with that situation as well. So let's say for instance that the default OpenBSD httpd turns out to have some bug that allows an attacker to execute any arbitrary code of their choosing on the server. That's a problem, but it's hardly the end of the world. First, the server is using pledge+unveil, so it can't actually do all that much other than serving web pages. Second, even if the attacker can work within those restrictions, they're running as a completely unprivileged user, because OpenBSD is actually a great fan of defense in depth. > Which is where things like SELinux come in, which is my whole point..... If we're assuming an attacker can run things as root, then obviously we have to assume that they can run things in an unconfined context as well, at which point you've just basically added a second word for root and nothing helps.
- anthk 4y ago
  Also, pledge would SIGABRT that's process under a milisecond upon trying a non-allowed syscall. So, as I said, good luck trying to call something outside pledge. Being root? You wish if you can even run something alonside the process. Because even the subprocesses from a pledged process are pledged too.
  - Zurrrrr 4y ago
    If someone has remote root pledge is basically irrelevant.
    - anthk 4y ago
      Getting remote root is not easy as you'd think under OpenBSD.
      - Zurrrrr 4y ago
        Jesus christ, once again, the point is it doesn't matter. There is nothing in place if someone does. Good security is preparing for different possibilities, not just hoping one never happens because it seems unlikely. You're just proving what I said above 100% correct, that the OBSD approach is to just really hope that no one ever gets remote root. Tell you what, getting root on a properly configured MAC system is 100% impossible, so I'll choose that over a system where the developers just really really hope something bad won't happen every day of the week.
        ori_b 4y ago
        Pledge means YOU HAVE NO SYSCALLS. There is no amount of root magic that can allow the code you've exploited to do IO.
        Zurrrrr 4y ago
        I honestly can't even imagine putting all my faith in pledge and chroot like you do. It genuinely boggles my mind that you think this is a good approach.
        ori_b 4y ago
        The only way a program can interact with the system is through system calls. Can you explain why irreversibly taking away a program's permissions to do anything interesting, especially as root, is a bad approach?
- Zurrrrr 4y ago
  > They're absolutely dealing with that situation as well. That's why I said they were prioritizing. The very use of that word obviously means they are not just working on one thing.... Why do you keep arguing against strawmen? I won't address your scenario because you chose one that is overly favorable to your point, it doesn't really show anything. > If we're assuming an attacker can run things as root, then obviously we have to assume that they can run things in an unconfined context as well, That's a really, really dumb assumption, because that kind of issue is addressed. It's an entirely different user from root that administers selinux policies....no reason at all to assume root can run unconfined when that's counter to the whole point of running SELinux.... These are really, really bad arguments you are making.

yjftsjthsd-h 4y ago

> They are still prioritizing removing bugs ahead of time instead of providing stronger tools to prepare for a scenario where someone does exploit a bug they didn't get to. They're absolutely dealing with that situation as well. So let's say for instance that the default OpenBSD httpd turns out to have some bug that allows an attacker to execute any arbitrary code of their choosing on the server. That's a problem, but it's hardly the end of the world. First, the server is using pledge+unveil, so it can't actually do all that much other than serving web pages. Second, even if the attacker can work within those restrictions, they're running as a completely unprivileged user, because OpenBSD is actually a great fan of defense in depth. > Which is where things like SELinux come in, which is my whole point..... If we're assuming an attacker can run things as root, then obviously we have to assume that they can run things in an unconfined context as well, at which point you've just basically added a second word for root and nothing helps.

anthk 4y ago
Also, pledge would SIGABRT that's process under a milisecond upon trying a non-allowed syscall. So, as I said, good luck trying to call something outside pledge. Being root? You wish if you can even run something alonside the process. Because even the subprocesses from a pledged process are pledged too.
- Zurrrrr 4y ago
  If someone has remote root pledge is basically irrelevant.
  - anthk 4y ago
    Getting remote root is not easy as you'd think under OpenBSD.
    - Zurrrrr 4y ago
      Jesus christ, once again, the point is it doesn't matter. There is nothing in place if someone does. Good security is preparing for different possibilities, not just hoping one never happens because it seems unlikely. You're just proving what I said above 100% correct, that the OBSD approach is to just really hope that no one ever gets remote root. Tell you what, getting root on a properly configured MAC system is 100% impossible, so I'll choose that over a system where the developers just really really hope something bad won't happen every day of the week.
      - ori_b 4y ago
        Pledge means YOU HAVE NO SYSCALLS. There is no amount of root magic that can allow the code you've exploited to do IO.
        Zurrrrr 4y ago
        I honestly can't even imagine putting all my faith in pledge and chroot like you do. It genuinely boggles my mind that you think this is a good approach.
        ori_b 4y ago
        The only way a program can interact with the system is through system calls. Can you explain why irreversibly taking away a program's permissions to do anything interesting, especially as root, is a bad approach?
Zurrrrr 4y ago
> They're absolutely dealing with that situation as well. That's why I said they were prioritizing. The very use of that word obviously means they are not just working on one thing.... Why do you keep arguing against strawmen? I won't address your scenario because you chose one that is overly favorable to your point, it doesn't really show anything. > If we're assuming an attacker can run things as root, then obviously we have to assume that they can run things in an unconfined context as well, That's a really, really dumb assumption, because that kind of issue is addressed. It's an entirely different user from root that administers selinux policies....no reason at all to assume root can run unconfined when that's counter to the whole point of running SELinux.... These are really, really bad arguments you are making.