Slashdot Mirror

It always surprised me there is no Linux distro that has gone trough the trouble of wrapping systrace around the Flash plugin (or the entire browser?)

I would definitely like to have a Flash-enabled browser that runs in a sandbox, and has only access to some of its own files (to store cookies/settings/etc.) but does not have access to the rest of my homedir.

At WOOT this year, Robert Watson presented a paper on how to evade popular system call interposition systems, including Systrace. For Systrace, Robert noticed that the arguments written to the stackgap could be replaced by a co-operating process after Systrace performed its policy check. The initial prototype of Systrace as described in the paper avoided this problem by using a look-aside buffer in the kernel. This imposes a slight performance penality but I hope that this obvious solution is going to be included in the OpenBSD and NetBSD kernel soon.

Or, taking it a step further, use Systrace which eliminiates the need to run e.g. OpenNTP in a chroot. It even eliminates the need to run it as root to bind to *:123.

With Systrace, you can define what each application can do on the system call level and with pattern matching on their arguments. You could even run OpenNTP as user nobody and provide an exception in the policy that raises its uid to 0 for the duration of the bind() system call only.

Cool stuff. Wasn't really aware of it although it exists for years now.

Does Windows have systrace?

I thought so.

One of the points basically comes down to "write perfect code".

Of course I fricking want to install it

On the same token though, any reputable person in the field would agree that a hardened version of Microsoft's OS is not any less secure than a hardened version of Linux.

Yes they would. There are heavily stripped versions of the Linux kernel in use. The remaining code has been analysed for vulnerabilities or extensively modified with in-kernel security features. Please show me where you can get a Microsoft kernel with the same features as systrace. There are tons of other useable kernel patches which demonstrate other impressive security features, not available on the windows platform.

Have you reviewed the paper? My guess is not. Before making straw man arguments make sure you have all the facts.


Yes I have read the paper. Try not to make spurious assumptions next time.

If you *need* secure systems you use old code that has been heavily audited, and I would actually recommend OpenBSD.

Currently, Systrace is integrated in NetBSD and OpenBSD, with a Linux port also being maintained. Similar functionality is available in the Okena (now Cisco) Security Agent for MS-Windows and Solaris, for $$$$.

And by buffer overflows being *easier* I meant more likely to escape detection. A shell being bound to a listening port is something that should *obviously* not be happening in most programs.

A real world example: I use systrace to run Opera. I cannot get source code for Opera, but by running it under a restricted profile, I can still have assurance as to the system calls which it can successfully make.

You can use systrace. There is even a GUI frontend that works on Mac OS.

...even those running AV software won't be protected from a super-fast-moving virus...

On OpenBSD and other Unix-like operating systems there is the free Systrace.

Windows and Solaris users can pay Cisco around $800 per server for "Cisco Security Agent" (Formerly Okena), which does the same thing as systrace, but with a nicer GUI and some packet filtering (I do not work for Cisco, I do not sell software.)

Workstation licenses were around $35 per seat.

When I tried to convince a Fortune 500 corporation of the value of deploying this type of security, the answer I received was "But this doesn't protect against SQL injection or Cross Site Scripting!"

So yes, Clueless people deserve it...