Re: holywar: malloc() vs. OOM

[Rich Felker <dalias@aerifal.cx>]

On Sun, Jul 24, 2011 at 10:33:41PM +0400, Vasiliy Kulikov wrote:
> > As an
> > admin I would be inclined to simply look for another program that
> > performs the function I need, rather than trying to compile in
> > workarounds, if I knew a program had code that bad..
> 
> It depends on the requirements and level of paranoia :)  It could be the
> only program in the required programs class.  It could be the only
> program you may use for non-technical reasons.  Other programs could be
> not much better (re: desktop).  In the ideal world any hardening would be
> redundant ;)

I think there's a big difference in *actual* *risk* between attempting
to harden a known-broken application to avoid getting stung by the
flaws, and hardening an application that's written with security in
mind. For instance OpenSSH's (or better yet vsftpd's) privsep model is
a form of hardening, but it's not a band-aid for known-bad code. It's
a second line of defense in case the primary line (good
security-conscious design and auditing) fails.

On the other hand, if you already *know* an application is full of
flaws that would lead to privilege elevation without some hardening,
it's reasonable to assume that's positively correlated with the
existence of other flaws the hardening won't protect you from...

Indeed there may be instances where you still need to run the buggy
software anyway (hopefully isolating it from the outside world as much
as possible and pre-screening any outside data it will be exposed to),
but I'd always look for other options first...

Rich