Red Hat Security Roadmap

RHEL5 SELinux Enhancements  Greatly improved logging, with easy-to-decipher information OLD: Red Hat Enterprise Linux 4 /var/log/messages entry time->Thu Aug 24 15:50:58 2006 type=AVC_PATH msg=audit(1156449058.917:552): path=”/var/www/html/index.html” type=SYSCALL msg=audit(1156449058.917:552): arch=40000003 syscall=196 success=no exi t=-13 a0=8d4d4d0 a1=bfb5e97c a2=434ff4 a3=2008171 items=0 ppid=23799 pid=23805 auid=3267 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) comm=”httpd” exe=”/usr/sbin/httpd” subj=user_u:system_r:httpd_t:s0 key=(null) type=AVC msg=audit(1156449058.917:552): avc: denied { getattr } for pid=23805 com m=”httpd” name=”index.html” dev=dm-0 ino=6260297 scontext=user_u:system_r:httpd_t:s0 tcontext=system_u:object_r:user_home_t:s0 tclass=file NEW: Red Hat Enterprise Linux 5 /var/log/messages entry Aug 24 15:53:10 localhost /usr/sbin/setroubleshootd: SELinux is preventing /usr/sbin/httpd “getattr” access to /var/www/html/index.html. See audit.log for complete SELinux messages. 22

RHEL5 SELinux Enhancements  ExecShield This enhancement can prevent any memory that was writable from becoming executable. This prevents an attacker from writing his code into memory and then executing it  Stack Smashing protection (Canary values) The system will place a canary value at a randomized point above the stack. This canary value is verified during normal operation. If the stack has been smashed, the canary value will have been overwritten, indicating that the stack has been smashed. This is a method to detect buffer overflows early.  FORTIFY_SOURCE GCC option When the compiler knows the size of a buffer, functions operate on the buffer to make sure it will not overflow at runtime. This works to help catch format string flaws as well as buffer overflows. 23