[kernel-hardening] Security vulnerability tools

[kernel-hardening] Security vulnerability tools

[Corey Bryant]

Hi,

I'd like to get a better understanding of tools used in the open source 
community (kernel and user space) to detect security vulnerabilities.

I have a list below to get started.  If anyone has any input, I'd 
appreciate it!

I'll plan on updating http://oss-security.openwall.org/wiki/tools with 
anything it doesn't already have.

pscan
-----
Scans C/C++ source code for problematic uses of printf style functions

rats
----
Rough auditing tool for security.  A general purpose scanner for 
detecting potential security problems in a wide range of languages.

flawfinder
----------
A general purpose scanner for finding and reporting upon potential flaws 
in both C and C++ source code

Valgrind
--------
Detect many memory management and threading bugs, and profile your 
programs in detail

KEDR
----
Provides runtime analysis of Linux kernel modules including device 
drivers, file system modules, etc

kmemcheck, kmemleak
-------------------
Linux Kernel debugging features for detecting memory issues

Smatch
------
A static analysis tool for C

Coverity
--------
Provides static analysis tools for C, C++, and other languages (requires 
license, Red Hat has one)

Coccinelle
----------
A tool for matching and fixing source code for C, C++, and other languages

Clang
-----
Static analysis tool for C/C++

Metasploit
----------
Used for identifying security issues. It includes many capabilities, 
including fuzzer support

Trinity
-------
A Linux system call fuzzer

fsfuzzer
--------
File system fuzzer

scapy
-----
Network packet fuzzer

-- 
Regards,
Corey Bryant

Re: [kernel-hardening] Security vulnerability tools

[Tim Brown]

[-- Attachment #1: Type: Text/Plain, Size: 1294 bytes --]

On Wednesday 27 Mar 2013 19:54:04 Corey Bryant wrote:
> Hi,
> 
> I'd like to get a better understanding of tools used in the open source
> community (kernel and user space) to detect security vulnerabilities.
> 
> I have a list below to get started.  If anyone has any input, I'd
> appreciate it!
> 
> I'll plan on updating http://oss-security.openwall.org/wiki/tools with
> anything it doesn't already have.
> 

Hey Corey,

One you might want to add is unix-privesc-check from myself, @inquisb and 
@pentestmonkey.  There are two versions in existence:

1.x - @pentestmonkey's quick and dirty with some hacks by me
trunk - a full blown privesc check framework designed by me with contributions 
from the other two, it has multiple modes of operation, a standard library 
which can be leveraged for new checks and (already) enhanced capabilities.   
Its not perfect yet, I still need to clean it up and port it to the commercial 
UNIX platforms we support but it should give a good idea of where we're going

Once I've stabilised the API of trunk, it will become 2.x and we'll open it up 
formerly for contributions.

It's on Google Code if people want to take a look:

* http://code.google.com/p/unix-privesc-check

Tim
-- 
Tim Brown
<mailto:tmb@65535.com>

[-- Attachment #2: This is a digitally signed message part. --]
[-- Type: application/pgp-signature, Size: 836 bytes --]

[kernel-hardening] Re: Security vulnerability tools

[Solar Designer]

Hi,

Guys, can we continue this thread on oss-security only, please?  It is a
topic for oss-security, but less so for kernel-hardening.  Anyone on
kernel-hardening who is interested in this topic should join oss-security.

Just drop kernel-hardening from further replies.

On Wed, Mar 27, 2013 at 03:54:04PM -0400, Corey Bryant wrote:
> I'll plan on updating http://oss-security.openwall.org/wiki/tools with
> anything it doesn't already have.

Yes, please!

> Clang
> -----
> Static analysis tool for C/C++

Clang and very recent GCC also have dynamic "sanitizers":

http://clang.llvm.org/docs/AddressSanitizer.html
http://clang.llvm.org/docs/ThreadSanitizer.html
http://clang.llvm.org/docs/MemorySanitizer.html

Thanks,

Alexander

Re: [kernel-hardening] Re: Security vulnerability tools

[Corey Bryant]

On 03/27/2013 04:12 PM, Solar Designer wrote:
> Hi,
>
> Guys, can we continue this thread on oss-security only, please?  It is a
> topic for oss-security, but less so for kernel-hardening.  Anyone on
> kernel-hardening who is interested in this topic should join oss-security.
>
> Just drop kernel-hardening from further replies.
>

Sure, sorry about that.  I am interested in tools that are applicable to 
the kernel too though, if that changes anything.

> On Wed, Mar 27, 2013 at 03:54:04PM -0400, Corey Bryant wrote:
>> I'll plan on updating http://oss-security.openwall.org/wiki/tools with
>> anything it doesn't already have.
>
> Yes, please!
>
>> Clang
>> -----
>> Static analysis tool for C/C++
>
> Clang and very recent GCC also have dynamic "sanitizers":
>
> http://clang.llvm.org/docs/AddressSanitizer.html
> http://clang.llvm.org/docs/ThreadSanitizer.html
> http://clang.llvm.org/docs/MemorySanitizer.html

Great, thanks!

>
> Thanks,
>
> Alexander
>
>

-- 
Regards,
Corey Bryant

[kernel-hardening] Re: Security vulnerability tools

[Solar Designer]

On Wed, Mar 27, 2013 at 05:17:08PM -0400, Corey Bryant wrote:
> On 03/27/2013 04:12 PM, Solar Designer wrote:
> >Guys, can we continue this thread on oss-security only, please?  It is a
> >topic for oss-security, but less so for kernel-hardening.  Anyone on
> >kernel-hardening who is interested in this topic should join oss-security.
> >
> >Just drop kernel-hardening from further replies.
> 
> Sure, sorry about that.  I am interested in tools that are applicable to 
> the kernel too though, if that changes anything.

It makes sense for you to post a summary of the relevant ones of your
updates to http://oss-security.openwall.org/wiki/tools to
kernel-hardening after this discussion thread on oss-security is mostly
over.  Other than that, I think it's best to keep the thread on
oss-security only.  Cross-posting all or almost all of it is a mess.

(Hopefully, this is the last cross-post I have to make in this thread.)

Thanks!

Alexander

Re: [kernel-hardening] Re: Security vulnerability tools

[Hasinoliva MIARIMANJATO]

[-- Attachment #1: Type: text/plain, Size: 1211 bytes --]

Hi i want to get so more information about pohmelfs ; i want to get
pohmelfs server and pohmelfs client that i don't find it in the internet ,
please help me

 thank you.


2013/3/28 Solar Designer <solar@openwall.com>

> On Wed, Mar 27, 2013 at 05:17:08PM -0400, Corey Bryant wrote:
> > On 03/27/2013 04:12 PM, Solar Designer wrote:
> > >Guys, can we continue this thread on oss-security only, please?  It is a
> > >topic for oss-security, but less so for kernel-hardening.  Anyone on
> > >kernel-hardening who is interested in this topic should join
> oss-security.
> > >
> > >Just drop kernel-hardening from further replies.
> >
> > Sure, sorry about that.  I am interested in tools that are applicable to
> > the kernel too though, if that changes anything.
>
> It makes sense for you to post a summary of the relevant ones of your
> updates to http://oss-security.openwall.org/wiki/tools to
> kernel-hardening after this discussion thread on oss-security is mostly
> over.  Other than that, I think it's best to keep the thread on
> oss-security only.  Cross-posting all or almost all of it is a mess.
>
> (Hopefully, this is the last cross-post I have to make in this thread.)
>
> Thanks!
>
> Alexander
>

[-- Attachment #2: Type: text/html, Size: 1770 bytes --]

[kernel-hardening] Re: [oss-security] Security vulnerability tools

[Russ Allbery]

Corey Bryant <coreyb@linux.vnet.ibm.com> writes:

> Clang
> -----
> Static analysis tool for C/C++

Clang is, properly speaking, a compiler.  It happens to also have a static
analyzer available as part of the same code base.

If you're going to mention Clang, it's probably also pointing out that
good old GCC has very extensive warning flags that can, among other
things, find possible security vulnerabilities by locating variables that
are used before being set, dangerous printf formats, mismatches between
printf formats and arguments, and so forth.  For example, I currently use:

WARNINGS = -g -O -D_FORTIFY_SOURCE=2 -Wall -Wextra -Wendif-labels           \
        -Wformat=2 -Winit-self -Wswitch-enum -Wdeclaration-after-statement  \
        -Wshadow -Wpointer-arith -Wbad-function-cast -Wcast-align           \
        -Wwrite-strings -Wjump-misses-init -Wlogical-op                     \
        -Wstrict-prototypes -Wmissing-prototypes -Wredundant-decls          \
        -Wnested-externs -Werror

with GCC (4.6 or later) with all of my software.  Many of those are not
security-related, of course, but -Wformat=2 certainly is, and some of the
-Wall and -Wextra warnings are as well.

-- 
Russ Allbery (rra@stanford.edu)             <http://www.eyrie.org/~eagle/>