5 ms·
That actually makes setting up SELinux seem like the simpler route.
by mhurron 12y ago
That actually makes setting up SELinux seem like the simpler route.
- mschuster91 12y agoiirc SELinux can only restrict the process groups that are able to read the file, which doesn't help you in a remote code execution exploit inside openssh. The question is, is is possible to use the keys without having them in RAM any more?
- falcolas 12y ago> which doesn't help you in a remote code execution exploit inside openssh To be fair, If it gets to the point where they are executing arbitrary code in the openssh process, your key is already compromised. SELinux would help with most other causes of key leaks, however. > The question is, is is possible to use the keys without having them in RAM any more? In my (albeit limited) experience, no. Even if only because context switching would push the key out of the CPU registers and into RAM if it occurred at the wrong time.
- jamiesonbecker 12y ago> To be fair, If it gets to the point where they are executing arbitrary code in the openssh process, your key is already compromised. This. Exactly.
- tedunangst 12y agohttp://en.wikipedia.org/wiki/TRESOR http://en.wikipedia.org/wiki/TRESOR