Re: Syscall security

Maciej Zenczykowski
2003-09-26T16:26:03Z

> syscalltrack can do it, per executable / user / syscall parameters /
> whatever, but it's per syscall. Writing a perl script or C program to
> iterate over the supplied syscall list and write the allow/deny rules
> is pretty simple. Also, syscalltrack is meant for debugging, not
> security, so if you want something that's 100% tight you'd better go
> with one of the Linux security modules based on the LSM framework.

OK, thx, I'll take a look.

> Since it's a known binary, if you can handle the increased run time,
> strace is your best shot. syscalltrack and other kernel based
> solutions are best when you need something that is "system wide".

It's known only in the sense that I have it. The process is accept
submission from outside network (source code). Compile it (in a security
playbox) statically to produce a single binary. Then run this, time it,
verify correctness of outcoming data. Send the results back out to the
outside world. Iterate for each submission - sometimes one every couple
seconds other times one per hour (depends on the current data set etc).

> Previous discussion seemed to conclude that features like these are
> "not interesting enough to the majority of users". Maybe it's time to
> revise those discussions (c.f. the inclusion of SELinux, for
> example).

This is for an information technology algorithmic programming contest -
currently being used on a single comp, but likely to be required (in
time...) by all such online contests (like the one funded by IBM/ACM)
which might mean a few hundred maybe thousand worldwide.

Cheers,
MaZe.