From mboxrd@z Thu Jan 1 00:00:00 1970 X-Msuck: nntp://news.gmane.org/gmane.linux.lib.musl.general/209 Path: news.gmane.org!not-for-mail From: Rich Felker Newsgroups: gmane.linux.lib.musl.general Subject: Re: holywar: malloc() vs. OOM Date: Sun, 24 Jul 2011 18:24:08 -0400 Message-ID: <20110724222408.GM132@brightrain.aerifal.cx> References: <20110724103325.GA24069@albatros> <20110724124034.GI132@brightrain.aerifal.cx> <20110724132913.GH27634@port70.net> <20110724132704.GK132@brightrain.aerifal.cx> <20110724183341.GC6429@albatros> Reply-To: musl@lists.openwall.com NNTP-Posting-Host: lo.gmane.org Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii X-Trace: dough.gmane.org 1311546903 1726 80.91.229.12 (24 Jul 2011 22:35:03 GMT) X-Complaints-To: usenet@dough.gmane.org NNTP-Posting-Date: Sun, 24 Jul 2011 22:35:03 +0000 (UTC) To: musl@lists.openwall.com Original-X-From: musl-return-293-gllmg-musl=m.gmane.org@lists.openwall.com Mon Jul 25 00:34:59 2011 Return-path: Envelope-to: gllmg-musl@lo.gmane.org Original-Received: from mother.openwall.net ([195.42.179.200]) by lo.gmane.org with smtp (Exim 4.69) (envelope-from ) id 1Ql7GE-0003i2-Pv for gllmg-musl@lo.gmane.org; Mon, 25 Jul 2011 00:34:58 +0200 Original-Received: (qmail 11967 invoked by uid 550); 24 Jul 2011 22:34:58 -0000 Mailing-List: contact musl-help@lists.openwall.com; run by ezmlm Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: Original-Received: (qmail 11956 invoked from network); 24 Jul 2011 22:34:57 -0000 Content-Disposition: inline In-Reply-To: <20110724183341.GC6429@albatros> User-Agent: Mutt/1.5.21 (2010-09-15) Xref: news.gmane.org gmane.linux.lib.musl.general:209 Archived-At: On Sun, Jul 24, 2011 at 10:33:41PM +0400, Vasiliy Kulikov wrote: > > As an > > admin I would be inclined to simply look for another program that > > performs the function I need, rather than trying to compile in > > workarounds, if I knew a program had code that bad.. > > It depends on the requirements and level of paranoia :) It could be the > only program in the required programs class. It could be the only > program you may use for non-technical reasons. Other programs could be > not much better (re: desktop). In the ideal world any hardening would be > redundant ;) I think there's a big difference in *actual* *risk* between attempting to harden a known-broken application to avoid getting stung by the flaws, and hardening an application that's written with security in mind. For instance OpenSSH's (or better yet vsftpd's) privsep model is a form of hardening, but it's not a band-aid for known-bad code. It's a second line of defense in case the primary line (good security-conscious design and auditing) fails. On the other hand, if you already *know* an application is full of flaws that would lead to privilege elevation without some hardening, it's reasonable to assume that's positively correlated with the existence of other flaws the hardening won't protect you from... Indeed there may be instances where you still need to run the buggy software anyway (hopefully isolating it from the outside world as much as possible and pre-screening any outside data it will be exposed to), but I'd always look for other options first... Rich