From owner-kernel-audit@nl.linux.org Fri Jun  9 07:34:48 2000
Received: by humbolt.nl.linux.org id <S92168AbQFIFeg>;
	Fri, 9 Jun 2000 07:34:36 +0200
Received: from mail1.bna.bellsouth.net ([205.152.150.13]:28070 "EHLO
        mail1.bna.bellsouth.net") by humbolt.nl.linux.org with ESMTP
	id <S92167AbQFIFeG> convert rfc822-to-8bit; Fri, 9 Jun 2000 07:34:06 +0200
Received: from sQa.speedbros.org (adsl-78-129-55.mem.bellsouth.net [216.78.129.55])
	by mail1.bna.bellsouth.net (3.3.5alt/0.75.2) with SMTP id BAA28424
	for <kernel-audit@nl.linux.org>; Fri, 9 Jun 2000 01:34:04 -0400 (EDT)
From:   Bryan Paxton <evil7@bellsouth.net>
Reply-To: evil7@bellsouth.net
To:     kernel-audit@nl.linux.org
Subject: Mission statement for LKAP(rough draft)
Date:   Fri, 9 Jun 2000 00:29:56 -0500
X-Mailer: KMail [version 1.0.28]
Content-Type: text/plain
MIME-Version: 1.0
Message-Id: <00060900302703.01508@sQa.speedbros.org>
Content-Transfer-Encoding: 8BIT
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

######################### kernel auditing project ###########################

This is a mission statement for a project under way and ready to get going.
The Linux kernel auditing project(LKAP). 

The purpose of this project is self-explanatory. It's an attempt to audit the
linux kernel for any security vulnerabilities and/or holes and/or possible 
vulnerabilities and/or possible holes, and of course without adding more bugs or
drawbacks to the existing kernels. The suggested kernels to be audited are 
2.0.x kernel series , 2.2.x kernel series, and the 2.3.x/2.4.x kernel series.
The group and it's work shall be dealt and worked with via a mailing list. 
See #EOF on how to subscribe.

I feel that this project should have been done a long time ago, not to imply that
linux kernel is insecure, but for example the setuid() hole found on June 7 
which affected all 2.2.x kernels. This bug was patched in a matter of hours
(isn't open source great!). But here's the point, the flaw/function/hole 
should _NOT_ have existed in the first place. Which is where this project comes
into place. 

  There's a few things that differ from this project compared to a few others 
that are similar. 

1) To audit the kernel src code without affecting/breaking/disrupting any other
part of the kernel. These will not be additional patches you can downloads
(add-ons). This auditing is dealing with the current code in the src, not adding
or implementing new functions. 

2) To educate kernel developers/hackers on how to securely write code. It is
my hopes that kernel developers/hackers new and old will subscribe and post to 
this mailing list with questions and to share information, 
and to simply get help with their code(e.g.: Could this function() cause a 
possible security hole or lead to an exploit ?"), this is the true power of
open source and GNU/Linux

3) To be ahead of the game... A perfect example of this are certain proprietary
Operating Systems who sit around and wait for a security bug to come to them 
and not go to bug themselves. Of course this needs no explanation as to why this
never works. I feel that kernel developers/hackers are down to earth and pretty
logical people and realize that Linux is _NOT_ perfect, that a lot of the code
they write, submit, and gets plugged into the kernel is not flawless and more
than likely could be improved for security reasons.

4) To provide an operating system to the public. I want to see a linux where
the sysadmin doesn't have to watch his back all the time in fear of say some
new knfsd exploit or a way to fork()bomb his/her router via a simple mistake
in buffer.c 

5) To provide a safe linux to the end-user.. Linux is slowly but surely becoming
a choice for the desktop user. Most of these users are walking into linux with
no knowledge of what potential dangers lie at their finger tips and in their 
hard drive. Linux has proven to be one of the most secure operating systems, but
I feel as linux becomes more popular with the general public this will change, 
that more kernel security holes and exploits will arise from nowhere and give 
us a very unpleasant reality check. 

And at last, this will be no easy project, security auditing never is. 
It takes man power, skill, and just plain aching time. But I believe if the
community of gets together on this one, nothing will stop us and Linux will 
go on to become the #1 security wise operating system to do this date.

Sincerely 
Bryan Paxton

How to subscribe:

echo subscribe kernel-audit | mail majordomo@nl.linux.org

--
Bryan Paxton

"I don't need to sleep or eat, I'll smoke a thousand cigarettes."
- Sebadoh



Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Fri Jun  9 07:43:29 2000
Received: by humbolt.nl.linux.org id <S92168AbQFIFnR>;
	Fri, 9 Jun 2000 07:43:17 +0200
Received: from brutus.conectiva.com.br ([200.250.58.146]:13816 "EHLO
        duckman.distro.conectiva") by humbolt.nl.linux.org with ESMTP
	id <S92167AbQFIFmq>; Fri, 9 Jun 2000 07:42:46 +0200
Received: from localhost (riel@localhost)
	by duckman.distro.conectiva (8.9.3/8.8.7) with ESMTP id CAA26829;
	Fri, 9 Jun 2000 02:42:29 -0300
X-Authentication-Warning: duckman.distro.conectiva: riel owned process doing -bs
Date:   Fri, 9 Jun 2000 02:42:29 -0300 (BRST)
From:   Rik van Riel <riel@conectiva.com.br>
X-Sender: riel@duckman.distro.conectiva
To:     Bryan Paxton <evil7@bellsouth.net>
cc:     kernel-audit@nl.linux.org
Subject: Re: Mission statement for LKAP(rough draft)
In-Reply-To: <00060900302703.01508@sQa.speedbros.org>
Message-ID: <Pine.LNX.4.21.0006090239070.26008-100000@duckman.distro.conectiva>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

On Fri, 9 Jun 2000, Bryan Paxton wrote:

> This is a mission statement for a project under way and ready to
> get going. The Linux kernel auditing project(LKAP).

It is?  If it isn't, please don't lie... :)

> The purpose of this project is self-explanatory. It's an attempt
> to audit the linux kernel for any security vulnerabilities
> and/or holes and/or possible vulnerabilities and/or possible
> holes, and of course without adding more bugs or drawbacks to
> the existing kernels. The suggested kernels to be audited are
> 2.0.x kernel series , 2.2.x kernel series, and the 2.3.x/2.4.x
> kernel series. The group and it's work shall be dealt and worked
> with via a mailing list.  See #EOF on how to subscribe.

Sounds good. Maybe you want to put the subscription info both
here and at the end of the mail?

	[snip good reasons]

Also, you may want to line-wrap your email at 72 columns :)

Other than these minor gripes, I think your announcement is
ready for the world ;)

regards,

Rik
--
The Internet is not a network of computers. It is a network
of people. That is its real strength.

Wanna talk about the kernel?  irc.openprojects.net / #kernelnewbies
http://www.conectiva.com/		http://www.surriel.com/


Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Fri Jun  9 07:56:11 2000
Received: by humbolt.nl.linux.org id <S92167AbQFIFzz>;
	Fri, 9 Jun 2000 07:55:55 +0200
Received: from mail1.bna.bellsouth.net ([205.152.150.13]:57784 "EHLO
        mail1.bna.bellsouth.net") by humbolt.nl.linux.org with ESMTP
	id <S92168AbQFIFzU> convert rfc822-to-8bit; Fri, 9 Jun 2000 07:55:20 +0200
Received: from sQa.speedbros.org (adsl-78-129-55.mem.bellsouth.net [216.78.129.55])
	by mail1.bna.bellsouth.net (3.3.5alt/0.75.2) with SMTP id BAA11511;
	Fri, 9 Jun 2000 01:55:16 -0400 (EDT)
From:   Bryan Paxton <evil7@bellsouth.net>
Reply-To: evil7@bellsouth.net
To:     securedistros@nl.linux.org, security-audit@ferret.lmh.ox.ac.uk,
        lwn@lwn.net, linux-security@redhat.com,
        seifried@securityportal.com, BUGTRAQ@SECURITYFOCUS.COM
Subject: Mission statement for LKAP(Linux Kernel Auditing Project)
Date:   Fri, 9 Jun 2000 00:43:30 -0500
X-Mailer: KMail [version 1.0.28]
Content-Type: text/plain
Cc:     kernel-audit@nl.linux.org, kernelnewbies@nl.linux.org
MIME-Version: 1.0
Message-Id: <00060900513906.01508@sQa.speedbros.org>
Content-Transfer-Encoding: 8BIT
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

######################### kernel auditing project ###########################

This is a mission statement for a project under way and ready to get going.
The Linux kernel auditing project(LKAP). 

The purpose of this project is self-explanatory. It's an attempt to audit the
linux kernel for any security vulnerabilities and/or holes and/or possible 
vulnerabilities and/or possible holes, and of course without adding more bugs or
drawbacks to the existing kernels. The suggested kernels to be audited are 
2.0.x kernel series , 2.2.x kernel series, and the 2.3.x/2.4.x kernel series.
The group and it's work shall be dealt and worked with via a mailing list. 

How to subscribe:

echo subscribe kernel-audit | mail majordomo@nl.linux.org

I feel that this project should have been done a long time ago, not to imply that
the linux kernel is insecure, but for example the setuid() hole found on June 7 
which affected all 2.2.x kernels. This bug was patched in a matter of hours
(isn't open source great!). But here's the point, the flaw/function/hole 
should _NOT_ have existed in the first place. Which is where this project comes
into place. 

  There's a few things that differ from this project compared to a few others 
that are similar. 

1) To audit the kernel src code without affecting/breaking/disrupting any other
part of the kernel. These will not be additional patches you can downloads
(add-ons). This auditing is dealing with the current code in the src, not adding
or implementing new functions. 

2) To educate kernel developers/hackers on how to securely write code. It is
my hopes that kernel developers/hackers new and old will subscribe and post to 
this mailing list with questions and share information, 
and to simply get help with their code(e.g.: Could this function() cause a 
possible security hole or lead to an exploit ?"), this is the true power of
open source and GNU/Linux

3) To be ahead of the game... A perfect example of this are certain proprietary
Operating Systems who sit around and wait for a security bug to come to them 
and not go to bug themselves. Of course this needs no explanation as to why this
never works. I feel that kernel developers/hackers are down to earth and pretty
logical people and realize that Linux is _NOT_ perfect, that a lot of the code
they write, submit, and gets plugged into the kernel is not flawless and more
than likely could be improved for security reasons.

4) To provide an operating system to the public. I want to see a linux where
the sysadmin doesn't have to watch his back all the time in fear of say some
new knfsd exploit or a way to fork()bomb his/her router via a simple mistake
in buffer.c 

5) To provide a safe linux to the end-user.. Linux is slowly but surely becoming
a choice for the desktop user. Most of these users are walking into linux with
no knowledge of what potential dangers lie at their finger tips and in their 
hard drive. Linux has proven to be one of the most secure operating systems, but
I feel as linux becomes more popular with the general public this will change, 
that more kernel security holes and exploits will arise from nowhere and give 
us a very unpleasant reality check. 

And at last, this will be no easy project, security auditing never is. 
It takes man power, skill, and just plain aching time. But I believe if the
community of gets together on this one, nothing will stop us and Linux will 
go on to become the #1 security wise operating system to do this date.

Sincerely 
Bryan Paxton

How to subscribe:

echo subscribe kernel-audit | mail majordomo@nl.linux.org







Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Fri Jun  9 12:37:55 2000
Received: by humbolt.nl.linux.org id <S92168AbQFIKhj>;
	Fri, 9 Jun 2000 12:37:39 +0200
Received: from mail0.bna.bellsouth.net ([205.152.150.12]:46007 "EHLO
        mail0.bna.bellsouth.net") by humbolt.nl.linux.org with ESMTP
	id <S92167AbQFIKhS> convert rfc822-to-8bit; Fri, 9 Jun 2000 12:37:18 +0200
Received: from sQa.speedbros.org (adsl-78-129-55.mem.bellsouth.net [216.78.129.55])
	by mail0.bna.bellsouth.net (3.3.5alt/0.75.2) with SMTP id GAA08980
	for <kernel-audit@nl.linux.org>; Fri, 9 Jun 2000 06:37:14 -0400 (EDT)
From:   Bryan Paxton <evil7@bellsouth.net>
Reply-To: evil7@bellsouth.net
To:     kernel-audit@nl.linux.org
Subject: Letter to the subscribed
Date:   Fri, 9 Jun 2000 05:25:41 -0500
X-Mailer: KMail [version 1.0.28]
Content-Type: text/plain
MIME-Version: 1.0
Message-Id: <00060905333600.05226@sQa.speedbros.org>
Content-Transfer-Encoding: 8BIT
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

Hi everyone....... I'm sure most of you already read the my mission
statement and know what the goal of this mailing list. is.  
 I  would just like to say thank you for your interest in making the
Linux kernel more secure. 
 
 A brief note on encouragement: 
I urge everyone not to hesistate on asking questions, suggesting ideas
and patches, and sharing of information. I know starting the first
thread is always an itchy feeling, especially for mailing list of this
sort, but don't be shy... Even if you think your question/idea/patch is
silly. Even if you don't know how to code(personally I don't) and have
something to say, step forward and say it.. Remember voice == power.

May the src be with you and the threading begin....

 -- 
Bryan Paxton

"I don't need to sleep or eat, I'll smoke a thousand cigarettes."
- Sebadoh



Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Fri Jun  9 18:31:17 2000
Received: by humbolt.nl.linux.org id <S92175AbQFIQbD>;
	Fri, 9 Jun 2000 18:31:03 +0200
Received: from shafik-1.dsl.speakeasy.net ([216.254.73.173]:63241 "EHLO
        shafik.net") by humbolt.nl.linux.org with ESMTP id <S92167AbQFIQah>;
	Fri, 9 Jun 2000 18:30:37 +0200
Received: from localhost (shafik@localhost)
	by shafik.net (8.9.3/8.9.3) with ESMTP id MAA19986
	for <kernel-audit@nl.linux.org>; Fri, 9 Jun 2000 12:27:27 -0400
Date:   Fri, 9 Jun 2000 16:27:27 +0000 (/etc/localtime)
From:   shafik@shafik.net
To:     kernel-audit@nl.linux.org
Subject: Hello out there!
Message-ID: <Pine.LNX.4.10.10006091610480.19965-100000@shafik.net>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

	I am pretty excited about this list, I am currently working on my
Master's thesis in Intrusion Detection and I am learning the kernel to
build a proof of concept of some ideas I have. Since I have a strong
interest in security in general and I need to learn the kernel as
intimately as I can, this project came at a good time for me at least. I
usually learn the best by just diving into a project.

	BTW, is there a web page up yet? Do you guys need in helping
getting the project rolling, if so what?

==========================================================================
--"the more you know and understand the more you must know and understand
   .. knowledge is an unsatiable hunger .. which makes life easier and at
   the same time harder .... knowledge is a paradox w/ no resolution just
   a boundless function of human nature .... knowledge is a trap which we
   embrace and which we run away from .... and in the end the only escape
   is death .... or maybe not "<grin>--
==========================================================================
                     -Unite for Java! - http://www.javalobby.org-
                     -This message transmitted on 100% recycled electrons-
                     -Save the whales, Feed the hungry, Free the mallocs-


Two cats on a roof,
Which one falls off first?
The one with the smaller mew.



Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Fri Jun  9 19:42:29 2000
Received: by humbolt.nl.linux.org id <S92185AbQFIRmF>;
	Fri, 9 Jun 2000 19:42:05 +0200
Received: from brutus.conectiva.com.br ([200.250.58.146]:22256 "EHLO
        duckman.distro.conectiva") by humbolt.nl.linux.org with ESMTP
	id <S92167AbQFIRlj>; Fri, 9 Jun 2000 19:41:39 +0200
Received: from localhost (riel@localhost)
	by duckman.distro.conectiva (8.9.3/8.8.7) with ESMTP id OAA32692;
	Fri, 9 Jun 2000 14:40:47 -0300
X-Authentication-Warning: duckman.distro.conectiva: riel owned process doing -bs
Date:   Fri, 9 Jun 2000 14:40:47 -0300 (BRST)
From:   Rik van Riel <riel@conectiva.com.br>
X-Sender: riel@duckman.distro.conectiva
To:     shafik@shafik.net
cc:     kernel-audit@nl.linux.org
Subject: Re: Hello out there!
In-Reply-To: <Pine.LNX.4.10.10006091610480.19965-100000@shafik.net>
Message-ID: <Pine.LNX.4.21.0006091439310.31358-100000@duckman.distro.conectiva>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

On Fri, 9 Jun 2000 shafik@shafik.net wrote:

> 	I am pretty excited about this list, I am currently
> working on my Master's thesis in Intrusion Detection and I am
> learning the kernel to build a proof of concept of some ideas I
> have.

Cool...

> 	BTW, is there a web page up yet? Do you guys need in
> helping getting the project rolling, if so what?

I can provide you people with a virtualhost under nl.linux.org
or kernelnewbies.org, web space, and all the other things you
might need for an online presence.

Brian?  What direction do you want to take this project? What
do you want to organise?

regards,

Rik
--
The Internet is not a network of computers. It is a network
of people. That is its real strength.

Wanna talk about the kernel?  irc.openprojects.net / #kernelnewbies
http://www.conectiva.com/		http://www.surriel.com/


Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Fri Jun  9 20:56:10 2000
Received: by humbolt.nl.linux.org id <S92185AbQFISzq>;
	Fri, 9 Jun 2000 20:55:46 +0200
Received: from mail1.bna.bellsouth.net ([205.152.150.13]:51596 "EHLO
        mail1.bna.bellsouth.net") by humbolt.nl.linux.org with ESMTP
	id <S92182AbQFISz1> convert rfc822-to-8bit; Fri, 9 Jun 2000 20:55:27 +0200
Received: from sQa.speedbros.org (adsl-78-129-55.mem.bellsouth.net [216.78.129.55])
	by mail1.bna.bellsouth.net (3.3.5alt/0.75.2) with SMTP id OAA21989
	for <kernel-audit@nl.linux.org>; Fri, 9 Jun 2000 14:55:25 -0400 (EDT)
From:   Bryan Paxton <evil7@bellsouth.net>
Reply-To: evil7@bellsouth.net
To:     kernel-audit@nl.linux.org
Subject: LKAP webpage
Date:   Fri, 9 Jun 2000 13:46:34 -0500
X-Mailer: KMail [version 1.0.28]
Content-Type: text/plain
MIME-Version: 1.0
Message-Id: <00060913514503.00545@sQa.speedbros.org>
Content-Transfer-Encoding: 8BIT
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

I given this a second thought due to some feedback I got. 

Everyone is welcome to work on a webpage for LKAP

Simple rules to follow:

1) Keep it simple
2) it's gotta be pretty : )
3) informative, yet still easy to understand and look at. 
Nothing to complex or fancy
4)  Don't argue with other people that will work on this. try to come
to an agreement.

So, when ya got something.... post a url where your work can be viewed
at.

-- 
Bryan Paxton

"I don't need to sleep or eat, I'll smoke a thousand cigarettes."
- Sebadoh



Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Fri Jun  9 22:09:42 2000
Received: by humbolt.nl.linux.org id <S92186AbQFIUJT>;
	Fri, 9 Jun 2000 22:09:19 +0200
Received: from mail1.bna.bellsouth.net ([205.152.150.13]:57591 "EHLO
        mail1.bna.bellsouth.net") by humbolt.nl.linux.org with ESMTP
	id <S92182AbQFIUIr>; Fri, 9 Jun 2000 22:08:47 +0200
Received: from adsl-78-129-55.mem.bellsouth.net (adsl-78-129-55.mem.bellsouth.net [216.78.129.55])
	by mail1.bna.bellsouth.net (3.3.5alt/0.75.2) with ESMTP id QAA21755
	for <kernel-audit@nl.linux.org>; Fri, 9 Jun 2000 16:08:45 -0400 (EDT)
Date:   Fri, 9 Jun 2000 15:05:05 -0500 (CDT)
From:   Bryan Paxton <evil7@bellsouth.net>
X-Sender: evil7@sqa.speedbros.org
To:     kernel-audit@nl.linux.org
Subject: CAP_SETUID, does is have a family in the kernel ?
Message-ID: <Pine.LNX.4.21.0006091448220.705-100000@sqa.speedbros.org>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

I thought I would touch on the recent CAP_SETUID bug/hole in the kernel.
Better to start at the most recent problem IMHO.
As you know this affects kernels < 2.2.16 and 2.3.x kernels(with the
acception of -ac11). 

A good explanation of to exploit this and/or how it works can be found at

http://sendmail.net/?feed=000607linuxbug#two

Could this possibly have a cousin lying around else where in 
the kernel ? 

I think so, the probality of something like this having cousin is very
high. The critical value of stomping this out is also high. 
So I issue a first task: 
To audit the kernels 2.2.x and 2.3.x for a cousin or a function() similar.
But where does everyone begin ?

I feel that a security audit divided into sections will benifit more than 
everyman for his own diving into various parts of the kernel. 

Where do I personally think we should start ?
/usr/src/linux*/fs/

Where better to start than fs, particulary with our devil friend NFS.

All flame/feedback/whatever is encouraged.




 


Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Fri Jun  9 22:10:50 2000
Received: by humbolt.nl.linux.org id <S92187AbQFIUKd>;
	Fri, 9 Jun 2000 22:10:33 +0200
Received: from mail1.bna.bellsouth.net ([205.152.150.13]:24057 "EHLO
        mail1.bna.bellsouth.net") by humbolt.nl.linux.org with ESMTP
	id <S92185AbQFIUJ4>; Fri, 9 Jun 2000 22:09:56 +0200
Received: from adsl-78-129-55.mem.bellsouth.net (adsl-78-129-55.mem.bellsouth.net [216.78.129.55])
	by mail1.bna.bellsouth.net (3.3.5alt/0.75.2) with ESMTP id QAA23126;
	Fri, 9 Jun 2000 16:09:53 -0400 (EDT)
Date:   Fri, 9 Jun 2000 15:06:13 -0500 (CDT)
From:   Bryan Paxton <evil7@bellsouth.net>
X-Sender: evil7@sqa.speedbros.org
To:     linux-kernel@vger.rutgers.edu
cc:     kernel-audit@nl.linux.org
Subject: Mission statement for LKAP(Linux kernel auditing project)
Message-ID: <Pine.LNX.4.21.0006091422520.667-100000@sqa.speedbros.org>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

This is a mission statement for a project under way and ready to get going.
The Linux Kernel Auditing Project (LKAP). 

The purpose of this project is self-explanatory. It's an attempt to audit the
Linux kernel for any security vulnerabilities and/or holes and/or possible 
vulnerabilities and/or possible holes, and of course without adding more bugs or
drawbacks to the existing kernels. The suggested kernels to be audited are 
2.0.x kernel series , 2.2.x kernel series, and the 2.3.x/2.4.x kernel series.
The group and it's work shall be dealt and worked with via a mailing list. 

How to subscribe:

echo subscribe kernel-audit | mail majordomo@nl.Linux.org

I feel that this project should have been done a long time ago, not to imply that
the Linux kernel is insecure, but a case in which this project would've helped
would be the setuid() hole found on June 7 
which affected all 2.2.x kernels. This bug was patched in a matter of hours
(isn't open source great!). But here's the point, the flaw/function/hole 
should _NOT_ have existed in the first place. Which is where this project comes
into place. 

  There's a few things that differ from this project compared to a few others 
that are similar. 

1) To audit the kernel source code without affecting/breaking/disrupting any other
part of the kernel. These will not be additional patches you can downloads
(add-ons). This auditing is dealing with the current code in the source, not adding
or implementing new functions. 

2) To educate kernel developers/hackers on how to securely write code. It is
my hopes that kernel developers/hackers new and old will subscribe and post to 
this mailing list with questions and share information, 
and to simply get help with their code(e.g.: Could this function() cause a 
possible security hole or lead to an exploit ?"), this is the true power of
open source and GNU/Linux

3) To be ahead of the game... A perfect example of this are certain proprietary
Operating System developers who sit around and wait for a security bug to come to them 
and not go to find the bug themselves. Of course this needs no explanation as to why this
never works. I feel that kernel developers/hackers are down to earth and pretty
logical people and realize that Linux is _NOT_ perfect, that a lot of the code
they write, submit, and gets plugged into the kernel is not flawless and more
than likely could be improved for security reasons.

4) To provide an operating system to the public. I want to see a Linux where
the sysadmin doesn't have to watch his back all the time in fear of say some
new knfsd exploit or a way to fork()bomb his/her router via a simple mistake
in buffer.c 

5) To provide a safe Linux to the end-user.. Linux is slowly but surely becoming
a choice for the desktop user. Most of these users are walking into Linux with
no knowledge of what potential dangers lie at their finger tips and in their 
hard drive. Linux has proven to be one of the most secure operating systems, but
I feel as Linux becomes more popular with the general public this will change, 
that more kernel security holes and exploits will arise from nowhere and give 
us a very unpleasant reality check. 

And at last, this will be no easy project, security auditing never is. 
It takes man power, skill, and just plain aching time. But I believe if the
community gets together on this one, nothing will stop us and Linux will 
go on to become the #1 security-wise operating system to this date.

Sincerely 
Bryan Paxton

How to subscribe:

echo subscribe kernel-audit | mail majordomo@nl.Linux.org



Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Fri Jun  9 23:09:04 2000
Received: by humbolt.nl.linux.org id <S92185AbQFIVIi>;
	Fri, 9 Jun 2000 23:08:38 +0200
Received: from mail1.bna.bellsouth.net ([205.152.150.13]:34504 "EHLO
        mail1.bna.bellsouth.net") by humbolt.nl.linux.org with ESMTP
	id <S92182AbQFIVIG>; Fri, 9 Jun 2000 23:08:06 +0200
Received: from adsl-78-129-55.mem.bellsouth.net (adsl-78-129-55.mem.bellsouth.net [216.78.129.55])
	by mail1.bna.bellsouth.net (3.3.5alt/0.75.2) with ESMTP id RAA02468
	for <kernel-audit@nl.linux.org>; Fri, 9 Jun 2000 17:08:05 -0400 (EDT)
Date:   Fri, 9 Jun 2000 16:04:25 -0500 (CDT)
From:   Bryan Paxton <evil7@bellsouth.net>
X-Sender: evil7@sqa.speedbros.org
To:     kernel-audit@nl.linux.org
Subject: #kernel-audit on irc.openprojects.net
Message-ID: <Pine.LNX.4.21.0006091602520.845-100000@sqa.speedbros.org>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

I've set up a channel for this mailing list. 
Sometimes it's good for on the fly discussion, then again sometimes it's
not. We'll find out : )

connect to irc.openprojects.net with your favorite irc client 
/join #kernel-audit

Bryan Paxton



Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Fri Jun  9 23:34:23 2000
Received: by humbolt.nl.linux.org id <S92189AbQFIVd7>;
	Fri, 9 Jun 2000 23:33:59 +0200
Received: from 24.66.222.70.ab.wave.home.com ([24.66.222.70]:17426 "EHLO
        mail.com") by humbolt.nl.linux.org with ESMTP id <S92185AbQFIVdc>;
	Fri, 9 Jun 2000 23:33:32 +0200
Received: (from rayl@localhost)
	by mail.com (8.9.3/8.9.3) id PAA04756
	for kernel-audit@nl.linux.org; Fri, 9 Jun 2000 15:33:26 -0600
Date:   Fri, 9 Jun 2000 15:33:26 -0600
From:   Ray L <rayl@optitech.com>
To:     kernel-audit@nl.linux.org
Subject: OpenBSD
Message-ID: <20000609153326.G1970@optitech.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
X-Mailer: Mutt 1.0us
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list


hi folks

just heard about this list, and it sounds like a great idea.  i think OpenBSD
has done this exact thing a few years back, and has been actively auditing code
changes ever since with good results.  it may be worth investigating their
approach.  they do have a wider scope since they also audit the entire
userspace codebase.


-- 
-----------------------------------------------------------------------------
  Ray Lehtiniemi (rayl@mail.com) (rayl@optitech.com)


Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Sat Jun 10 00:18:15 2000
Received: by humbolt.nl.linux.org id <S92189AbQFIWR5>;
	Sat, 10 Jun 2000 00:17:57 +0200
Received: from ip172.gte26.rb1.bel.nwlink.com ([207.202.207.172]:28676 "EHLO
        speedbros.org") by humbolt.nl.linux.org with ESMTP
	id <S92193AbQFIWRR>; Sat, 10 Jun 2000 00:17:17 +0200
Received: from jasonc by speedbros.org with local (Exim 3.12 #1 (Debian))
	id 130X5R-0000UT-00
	for <kernel-audit@nl.linux.org>; Fri, 09 Jun 2000 15:17:09 -0700
Date:   Fri, 9 Jun 2000 15:17:09 -0700
To:     kernel-audit@nl.linux.org
Subject: Re: Mission statement for LKAP(Linux kernel auditing project)
Message-ID: <20000609151709.A1877@speedbros.org>
References: <Pine.LNX.4.21.0006091422520.667-100000@sqa.speedbros.org>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
User-Agent: Mutt/1.0.1i
In-Reply-To: <Pine.LNX.4.21.0006091422520.667-100000@sqa.speedbros.org>; from evil7@bellsouth.net on Fri, Jun 09, 2000 at 03:06:13PM -0500
From:   <jasonc@speedbros.org>
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

If anyone cares, I have put up a quick little webpage hack of the mission statment and will be adding more to it later as time goes on(and if i have any..) its at http://www.nixed.net/doc2.html

ANY comments suggestion etc.. let me/list know..


Jason
aka slaker


Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Sat Jun 10 00:25:16 2000
Received: by humbolt.nl.linux.org id <S92191AbQFIWYx>;
	Sat, 10 Jun 2000 00:24:53 +0200
Received: from mail1.bna.bellsouth.net ([205.152.150.13]:32165 "EHLO
        mail1.bna.bellsouth.net") by humbolt.nl.linux.org with ESMTP
	id <S92182AbQFIWY1> convert rfc822-to-8bit; Sat, 10 Jun 2000 00:24:27 +0200
Received: from sQa.speedbros.org (adsl-78-129-55.mem.bellsouth.net [216.78.129.55])
	by mail1.bna.bellsouth.net (3.3.5alt/0.75.2) with SMTP id SAA24423;
	Fri, 9 Jun 2000 18:24:23 -0400 (EDT)
From:   Bryan Paxton <evil7@bellsouth.net>
Reply-To: evil7@bellsouth.net
To:     <jasonc@speedbros.org>, kernel-audit@nl.linux.org
Subject: Re: Mission statement for LKAP(Linux kernel auditing project)
Date:   Fri, 9 Jun 2000 17:20:20 -0500
X-Mailer: KMail [version 1.0.28]
Content-Type: text/plain
References: <Pine.LNX.4.21.0006091422520.667-100000@sqa.speedbros.org> <20000609151709.A1877@speedbros.org>
In-Reply-To: <20000609151709.A1877@speedbros.org>
MIME-Version: 1.0
Message-Id: <00060917203807.00783@sQa.speedbros.org>
Content-Transfer-Encoding: 8BIT
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

Good work so far : )

On Fri, 09 Jun 2000, jasonc@speedbros.org wrote:
> If anyone cares, I have put up a quick little webpage hack of the mission statment and will be adding more to it later as time goes on(and if i have any..) its at http://www.nixed.net/doc2.html
> 
> ANY comments suggestion etc.. let me/list know..
> 
> 
> Jason
> aka slaker
> 
> 
> Kernel-audit:  discussion list for security and the linux kernel
> Archive:       http://mail.nl.linux.org/kernel-audit/
-- 
Bryan Paxton

"How should I know if it works? That's what beta testers are for. I
          only coded it."
 -- Linus Torvalds.



Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Sat Jun 10 01:00:06 2000
Received: by humbolt.nl.linux.org id <S92187AbQFIW7n>;
	Sat, 10 Jun 2000 00:59:43 +0200
Received: from brutus.conectiva.com.br ([200.250.58.146]:52980 "EHLO
        conectiva.com.br") by humbolt.nl.linux.org with ESMTP
	id <S92182AbQFIW7O>; Sat, 10 Jun 2000 00:59:14 +0200
Received: from localhost (riel@localhost)
	by conectiva.com.br (8.9.3/8.8.7) with ESMTP id TAA02568
	for <kernel-audit@nl.linux.org>; Fri, 9 Jun 2000 19:59:07 -0300
Date:   Fri, 9 Jun 2000 19:59:07 -0300 (BRST)
From:   Rik van Riel <riel@conectiva.com.br>
X-Sender: riel@duckman.distro.conectiva
To:     kernel-audit@nl.linux.org
Subject: where to start?
Message-ID: <Pine.LNX.4.21.0006091943150.31358-100000@duckman.distro.conectiva>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

Hi,

this list seems to have gathered about 100 people now,
presumably all interested in squishing out some bugs from
the Linux kernel.

What I'm curious about is which bugs people would be worried
about. Which bugs *should* we worry about?

AFAICS we should encounter 4 types of bugs when searching
through the code:

1) "crashme" bugs, system calls and other places where the
   kernel crashes when confronted with faulty data

2) security bugs, exploiting bugs in the code, a user is
   able to gain priveledges the user should not have
   (eg. the CAP_SETUID bug ... would there be more of these
   in the capability code???)

3) stability bugs where the user can "exploit" some special
   situation to make the kernel behave badly or crash
   (eg. write to a file you're truncating, confusing buffer.c
   and various other places)

4) other, non-security bugs in the code .. no doubt we'll
   encounter these when we take a closer look at the code
   (also, these could be outside of the scope of this
   project ???)


Bugs of category 1) and 3) could be found by non-programmers
too, by simply stressing the machine heavily until a bug is
hit. Typical "overload tests" and crashme could be of help in
this.

Category 2), though, will require people to take a look at the
code and actually audit code paths in the kernel. This will be
more difficult work, but more fun for some of us. In the process
of looking for category 2) bugs, we'll probably also uncover
some bugs of category 4) ... 


I guess some of the first steps we could take are:
- collecting some programs and test scripts to look for
  1) and 3) bugs .. and to make it easy for non-programmers
  to setup their box as stress-test machine
- identify "suspect" areas of the kernel that should be
  looked at in more detail


Does anybody have some ideas on where we should start?

Web hosting and other stuff can be done on nl.linux.org,
so no need to worry about needed facilities...


regards,

Rik
--
The Internet is not a network of computers. It is a network
of people. That is its real strength.

Wanna talk about the kernel?  irc.openprojects.net / #kernelnewbies
http://www.conectiva.com/		http://www.surriel.com/


Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Sat Jun 10 01:35:19 2000
Received: by humbolt.nl.linux.org id <S92189AbQFIXey>;
	Sat, 10 Jun 2000 01:34:54 +0200
Received: from mail2.bna.bellsouth.net ([205.152.150.14]:47088 "EHLO
        mail2.bna.bellsouth.net") by humbolt.nl.linux.org with ESMTP
	id <S92187AbQFIXe3> convert rfc822-to-8bit; Sat, 10 Jun 2000 01:34:29 +0200
Received: from sQa.speedbros.org (adsl-78-129-55.mem.bellsouth.net [216.78.129.55])
	by mail2.bna.bellsouth.net (3.3.5alt/0.75.2) with SMTP id TAA14160
	for <kernel-audit@nl.linux.org>; Fri, 9 Jun 2000 19:34:27 -0400 (EDT)
From:   Bryan Paxton <evil7@bellsouth.net>
Reply-To: evil7@bellsouth.net
To:     kernel-audit@nl.linux.org
Subject: Fwd: Re: where to start?
Date:   Fri, 9 Jun 2000 18:30:21 -0500
X-Mailer: KMail [version 1.0.28]
Content-Type: text/plain
MIME-Version: 1.0
Message-Id: <0006091830460A.00783@sQa.speedbros.org>
Content-Transfer-Encoding: 8BIT
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list



I agree with everything that you have posted.
revising on my previous post:
as I stated I think the first place to look would be in fs/ 
Not only could the coders do this, but the stress testers as well, via
exploits. 

Maybe dig up an old knfsd exploit againt the kernel it was written for,
see how the exploit worked/works. Then compare the code to the current
nfs src code in the kernel. 

> 
> Bugs of category 1) and 3) could be found by non-programmers
> too, by simply stressing the machine heavily until a bug is
> hit. Typical "overload tests" and crashme could be of help in
> this.

See above

> 
> Category 2), though, will require people to take a look at the
> code and actually audit code paths in the kernel. This will be
> more difficult work, but more fun for some of us. In the process
> of looking for category 2) bugs, we'll probably also uncover
> some bugs of category 4) ... 
> 

This is the tough part. What I propose is section by section of the
kernel. Lets look at some of the old kernels and their bugs and once
again compare it to current src code. Find bugs... improve the code. 
And yes I again I propose that this 'section by section' idea be
started in fs/  


> I guess some of the first steps we could take are:
> - collecting some programs and test scripts to look for
>   1) and 3) bugs .. and to make it easy for non-programmers
>   to setup their box as stress-test machine
> - identify "suspect" areas of the kernel that should be
>   looked at in more detail
> 
Some places where you can get old scripts and exploits:
rootshell.com, packetstorm.securify.com,  and securityfocus.com

Don't take any exploit code or text for granted. It all matters in the
improvement of the kernel

Final words:
Though I do suggest a 'section by section' this is only a sugestion...
If you feel you're better in mm/ then by all means go for it.
And always remember to express yourself freely on this list : )

Aside from fs/ 
Why don't we start in mm/ as I see this as a critical area of security
audit. Nothing worse than getting buffer overflowed and having a
production server go down that over 10,000 people rely on.

But how would we get started on this ?

Bryan Paxton

"How should I know if it works? That's what beta testers are for. I
          only coded it."
 -- Linus Torvalds.



Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Sat Jun 10 01:51:28 2000
Received: by humbolt.nl.linux.org id <S92189AbQFIXvF>;
	Sat, 10 Jun 2000 01:51:05 +0200
Received: from mail.arobas.net ([205.205.36.6]:24324 "EHLO mail.arobas.net")
	by humbolt.nl.linux.org with ESMTP id <S92187AbQFIXuh>;
	Sat, 10 Jun 2000 01:50:37 +0200
Received: from dialin156.arobas.net (qmailr@ppp22.arobas.net [205.205.36.92])
	by mail.arobas.net (8.9.3/8.9.3) with SMTP id TAA05882
	for <kernel-audit@nl.linux.org>; Fri, 9 Jun 2000 19:47:00 -0400 (EDT)
Received: (qmail 905 invoked by uid 1000); 9 Jun 2000 23:46:42 -0000
Date:   Fri, 9 Jun 2000 19:46:42 -0400
From:   Jerome Etienne <jetienne@arobas.net>
To:     Bryan Paxton <evil7@bellsouth.net>
Cc:     kernel-audit@nl.linux.org
Subject: Re: Fwd: Re: where to start?
Message-ID: <20000609194641.A894@long-haul.net>
Reply-To: jetienne@arobas.net
References: <0006091830460A.00783@sQa.speedbros.org>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
User-Agent: Mutt/1.0i
In-Reply-To: <0006091830460A.00783@sQa.speedbros.org>; from evil7@bellsouth.net on Fri, Jun 09, 2000 at 06:30:21PM -0500
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

On Fri, Jun 09, 2000 at 06:30:21PM -0500, Bryan Paxton wrote:
> as I stated I think the first place to look would be in fs/ 

I would suggest to first study the past to avoid to repeat it.
Maybe to establish a list of kernel bugs seen in the past and 
possibly classify them.
Some OSs (e.g. openbsd) have already done that in the past. How did
they proceed ? bruce shneier, well known in security, has a moto
'security is a process, not a product'.

Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Sat Jun 10 01:59:58 2000
Received: by humbolt.nl.linux.org id <S92189AbQFIX7e>;
	Sat, 10 Jun 2000 01:59:34 +0200
Received: from zzz-063254120005.splitrock.net ([63.254.120.5]:6869 "EHLO
        pony.arbros.com") by humbolt.nl.linux.org with ESMTP
	id <S92187AbQFIX7C>; Sat, 10 Jun 2000 01:59:02 +0200
Received: from arbros1.arbros.com (unknown [172.25.4.1])
	by pony.arbros.com (Postfix) with ESMTP
	id 8ACF41DF5D; Fri,  9 Jun 2000 23:55:30 +0000 (US/Eastern)
Received: by ARBROS1 with Internet Mail Service (5.5.2650.21)
	id <MFM9KHM4>; Fri, 9 Jun 2000 19:55:31 -0400
Message-ID: <F5EB2FEBDDE2D3118F2700508B6D7629020906@CHICAGO1>
From:   "Saraf, Suman" <ssaraf@arbros.com>
To:     "'jetienne@arobas.net'" <jetienne@arobas.net>,
        Bryan Paxton <evil7@bellsouth.net>
Cc:     kernel-audit@nl.linux.org
Subject: RE: Fwd: Re: where to start?
Date:   Fri, 9 Jun 2000 19:59:24 -0400 
MIME-Version: 1.0
X-Mailer: Internet Mail Service (5.5.2650.21)
Content-Type: text/plain;
	charset="iso-8859-1"
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

Hi All,
I seem to agree with this suggestion. Let all of us scout around for already
known bugs and then people with higher initiative quotient can put up a
webpage where we list them and referrably classify into the categories
pointed by Rik.

Suman

> -----Original Message-----
> From: Jerome Etienne [mailto:jetienne@arobas.net]
> Sent: Friday, June 09, 2000 7:47 PM
> To: Bryan Paxton
> Cc: kernel-audit@nl.linux.org
> Subject: Re: Fwd: Re: where to start?
> 
> 
> On Fri, Jun 09, 2000 at 06:30:21PM -0500, Bryan Paxton wrote:
> > as I stated I think the first place to look would be in fs/ 
> 
> I would suggest to first study the past to avoid to repeat it.
> Maybe to establish a list of kernel bugs seen in the past and 
> possibly classify them.
> Some OSs (e.g. openbsd) have already done that in the past. How did
> they proceed ? bruce shneier, well known in security, has a moto
> 'security is a process, not a product'.
> 
> Kernel-audit:  discussion list for security and the linux kernel
> Archive:       http://mail.nl.linux.org/kernel-audit/
> 

Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Sat Jun 10 09:20:18 2000
Received: by humbolt.nl.linux.org id <S92206AbQFJHTq>;
	Sat, 10 Jun 2000 09:19:46 +0200
Received: from mail1.bna.bellsouth.net ([205.152.150.13]:23206 "EHLO
        mail1.bna.bellsouth.net") by humbolt.nl.linux.org with ESMTP
	id <S92204AbQFJHTU>; Sat, 10 Jun 2000 09:19:20 +0200
Received: from adsl-78-129-55.mem.bellsouth.net (adsl-78-129-55.mem.bellsouth.net [216.78.129.55])
	by mail1.bna.bellsouth.net (3.3.5alt/0.75.2) with ESMTP id DAA15470
	for <kernel-audit@nl.linux.org>; Sat, 10 Jun 2000 03:19:14 -0400 (EDT)
Date:   Sat, 10 Jun 2000 02:15:32 -0500 (CDT)
From:   Bryan Paxton <evil7@bellsouth.net>
X-Sender: evil7@sqa.speedbros.org
To:     kernel-audit@nl.linux.org
Subject: Some fun ascii on how the webpage might go.... 
Message-ID: <Pine.LNX.4.21.0006100212470.986-100000@sqa.speedbros.org>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

This is how I think the webpage should be layed out, then again... 
I'm a pretty dry person when it comes to sites like these






Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Sat Jun 10 09:21:18 2000
Received: by humbolt.nl.linux.org id <S92208AbQFJHUh>;
	Sat, 10 Jun 2000 09:20:37 +0200
Received: from mail1.bna.bellsouth.net ([205.152.150.13]:43174 "EHLO
        mail1.bna.bellsouth.net") by humbolt.nl.linux.org with ESMTP
	id <S92204AbQFJHT5>; Sat, 10 Jun 2000 09:19:57 +0200
Received: from adsl-78-129-55.mem.bellsouth.net (adsl-78-129-55.mem.bellsouth.net [216.78.129.55])
	by mail1.bna.bellsouth.net (3.3.5alt/0.75.2) with ESMTP id DAA15792
	for <kernel-audit@nl.linux.org>; Sat, 10 Jun 2000 03:19:56 -0400 (EDT)
Date:   Sat, 10 Jun 2000 02:16:14 -0500 (CDT)
From:   Bryan Paxton <evil7@bellsouth.net>
X-Sender: evil7@sqa.speedbros.org
To:     kernel-audit@nl.linux.org
Subject: Sorry about the last post
Message-ID: <Pine.LNX.4.21.0006100215380.986-100000@sqa.speedbros.org>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

Here's a the ascii

------------------------------------------------------------------------------
                                title
------------------------------------------------------------------------------
                    ---------------------------------
                        Brief explanation and link
                        to the mission statement.
-----------------                                            ------------------
                |                                            | news
                |                                            |mail archives
task list       |                                            |talk back
bug archive     |                                            |People 
how to subscribe|                                            |etc.........
related sites   |                                            |
etc....         |                                            |
                |                                            |
                |                                            |
                |                                            |
                |                                            |
                |                                            |
                |                                            |
                |                                            |
----------------|                                            ------------------


                      -----------------------------
                                 credits
 


Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Sat Jun 10 09:50:40 2000
Received: by humbolt.nl.linux.org id <S92209AbQFJHuR>;
	Sat, 10 Jun 2000 09:50:17 +0200
Received: from finch-post-10.mail.demon.net ([194.217.242.38]:64262 "EHLO
        finch-post-10.mail.demon.net") by humbolt.nl.linux.org with ESMTP
	id <S92204AbQFJHti>; Sat, 10 Jun 2000 09:49:38 +0200
Received: from notatla.demon.co.uk ([194.222.156.169])
	by finch-post-10.mail.demon.net with esmtp (Exim 2.12 #1)
	id 130g1R-0001Tf-0A; Sat, 10 Jun 2000 07:49:37 +0000
Received: (from lists@localhost)
	by notatla.demon.co.uk (noyb/noyb) id IAA04327;
	Sat, 10 Jun 2000 08:50:12 +0100
Date:   Sat, 10 Jun 2000 08:50:12 +0100
From:   lists@notatla.demon.co.uk
Message-Id: <200006100750.IAA04327@notatla.demon.co.uk>
To:     kernel-audit@nl.linux.org, riel@conectiva.com.br
Subject: Re: where to start?
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list


> 4) other, non-security bugs in the code .. no doubt we'll
>    encounter these when we take a closer look at the code
>    (also, these could be outside of the scope of this
>    project ???)

I say these are in the scope of the project.

In OpenBSD they fix any bug they find and happen to fix
security bugs by chance.  An example I have heard Theo speak
about was an obscure combination of 5 minor bugs in lpd where
by the time they were announced OpenBSD had squished some of
them because they were bugs without noticing security implications.


Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Sat Jun 10 10:04:32 2000
Received: by humbolt.nl.linux.org id <S92204AbQFJID5>;
	Sat, 10 Jun 2000 10:03:57 +0200
Received: from mail2.bna.bellsouth.net ([205.152.150.14]:50873 "EHLO
        mail2.bna.bellsouth.net") by humbolt.nl.linux.org with ESMTP
	id <S92197AbQFJIDb> convert rfc822-to-8bit; Sat, 10 Jun 2000 10:03:31 +0200
Received: from sQa.speedbros.org (adsl-78-129-55.mem.bellsouth.net [216.78.129.55])
	by mail2.bna.bellsouth.net (3.3.5alt/0.75.2) with SMTP id EAA19678
	for <kernel-audit@nl.linux.org>; Sat, 10 Jun 2000 04:03:29 -0400 (EDT)
From:   Bryan Paxton <evil7@bellsouth.net>
Reply-To: evil7@bellsouth.net
To:     kernel-audit@nl.linux.org
Subject: Re: where to start?
Date:   Sat, 10 Jun 2000 02:59:19 -0500
X-Mailer: KMail [version 1.0.28]
Content-Type: text/plain
MIME-Version: 1.0
Message-Id: <00061002594702.01066@sQa.speedbros.org>
Content-Transfer-Encoding: 8BIT
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list


Totally agreed... Following bugs in other software and trying to trace
it back to the kernel is an awesome plan.

On Sat, 10 Jun 2000, you wrote:
> > 4) other, non-security bugs in the code .. no doubt we'll
> >    encounter these when we take a closer look at the code
> >    (also, these could be outside of the scope of this
> >    project ???)
> 
> I say these are in the scope of the project.
> 
> In OpenBSD they fix any bug they find and happen to fix
> security bugs by chance.  An example I have heard Theo speak
> about was an obscure combination of 5 minor bugs in lpd where
> by the time they were announced OpenBSD had squished some of
> them because they were bugs without noticing security implications.
> 
> 
> Kernel-audit:  discussion list for security and the linux kernel
> Archive:       http://mail.nl.linux.org/kernel-audit/
-- 
Bryan Paxton

"How should I know if it works? That's what beta testers are for. I
          only coded it."
 -- Linus Torvalds.

Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Sat Jun 10 10:58:43 2000
Received: by humbolt.nl.linux.org id <S92214AbQFJI6S>;
	Sat, 10 Jun 2000 10:58:18 +0200
Received: from imail.knoware.nl ([195.64.48.18]:38412 "EHLO imail.knoware.nl")
	by humbolt.nl.linux.org with ESMTP id <S92210AbQFJI5s>;
	Sat, 10 Jun 2000 10:57:48 +0200
Received: from mail.knoware.nl (mail.knoware.nl [195.64.48.17])
	by imail.knoware.nl (Postfix) with ESMTP
	id 82462BD709; Sat, 10 Jun 2000 10:57:42 +0200 (CEST)
Received: from heineken.thuis.knoware.nl (dynaisdn-80.knoware.nl [195.64.35.80])
	by mail.knoware.nl (Postfix) with ESMTP
	id 231D9A6CE6; Sat, 10 Jun 2000 10:57:41 +0200 (CEST)
Content-Length: 1214
Message-ID: <XFMail.20000610105831.mathijs@knoware.nl>
X-Mailer: XFMail 1.4.4 on Linux
X-Priority: 3 (Normal)
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 8bit
MIME-Version: 1.0
In-Reply-To: <Pine.LNX.4.21.0006091943150.31358-100000@duckman.distro.conectiva>
Date:   Sat, 10 Jun 2000 10:58:31 +0200 (CEST)
From:   Mathijs Mohlmann <mathijs@knoware.nl>
To:     Rik van Riel <riel@conectiva.com.br>
Subject: RE: where to start?
Cc:     kernel-audit@nl.linux.org
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list


On 09-Jun-2000 Rik van Riel wrote:
> 4) other, non-security bugs in the code .. no doubt we'll
>    encounter these when we take a closer look at the code
>    (also, these could be outside of the scope of this
>    project ???)

I disagree here. Especially the bugs that look save in the 
beginning turn out te be security bugs. One strong point in
the OpenBSD audit was/is that every bug was fixed. There have
been a number of times, where security bugs in other BSDs 
where found and OpenBSD turned out to be save because they
fixed a seemingly hardless bug. (see there webpage)

Which brings me to my next question. How far should we go? 
Imagine a function that just can't take a null pointer as
argument. Every caller checks to make sure that no null 
pointer is passed. Should we introduce in extra sanity check
in that function to make absolutly sure? If we do that we
prevent a lot of future bugs from happening. On the other 
hand we can forget about mainstream kernel inclusion.

What is out goal? Writing an as-secure-as-possible kernel 
or an as-secure-as-alan-will-let-us kernel?

        me

By the way, i think the tcp/ip code needs a good looking 
over. A lot of DoS attacks have been seen here.

Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Sat Jun 10 12:32:04 2000
Received: by humbolt.nl.linux.org id <S92194AbQFJKbk>;
	Sat, 10 Jun 2000 12:31:40 +0200
Received: from gadolinium.btinternet.com ([194.73.73.111]:62382 "EHLO
        gadolinium") by humbolt.nl.linux.org with ESMTP id <S92193AbQFJKbP>;
	Sat, 10 Jun 2000 12:31:15 +0200
Received: from host213-1-188-235.btinternet.com ([213.1.188.235] helo=smtp.btinternet.com)
	by gadolinium with esmtp (Exim 3.03 #16)
	id 130iXl-0006gx-00; Sat, 10 Jun 2000 11:31:09 +0100
Received: from neo.local (IDENT:root@neo.local [172.16.0.4])
	by smtp.btinternet.com (8.9.3/8.9.3) with ESMTP id LAA02915;
	Sat, 10 Jun 2000 11:36:46 +0100
Received: from neo.local (IDENT:dave@neo.local [172.16.0.4])
	by neo.local (8.9.3/8.9.3) with ESMTP id LAA31801;
	Sat, 10 Jun 2000 11:37:47 +0100
Date:   Sat, 10 Jun 2000 11:37:40 +0100 (BST)
From:   Dave Jones <dave@denial.force9.co.uk>
X-Sender: dave@neo.local
To:     Mathijs Mohlmann <mathijs@knoware.nl>
cc:     kernel-audit@nl.linux.org
Subject: RE: where to start?
In-Reply-To: <XFMail.20000610105831.mathijs@knoware.nl>
Message-ID: <Pine.LNX.4.21.0006101123180.31706-100000@neo.local>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

On Sat, 10 Jun 2000, Mathijs Mohlmann wrote:

> Which brings me to my next question. How far should we go? 
> Imagine a function that just can't take a null pointer as
> argument. Every caller checks to make sure that no null 
> pointer is passed. Should we introduce in extra sanity check
> in that function to make absolutly sure? If we do that we
> prevent a lot of future bugs from happening. On the other 
> hand we can forget about mainstream kernel inclusion.

What you have to be aware of, is that some of the functions
allow NULL inputs and perform in slightly different ways.
As code gets more documented, this will become easier.

As an example, I recently made a patch that added a check
to kmalloc() for 0 byte allocations. When I booted the
kernel, I got messages every second from select()
allocating 0 bytes.  What I didn't know is that it's
perfectly valid (though aparently non-sensical) for
kmalloc to allocate 0 bytes. It actually returns a ptr
to a mem area where you can store 0 bytes :)

I think this was a perfect case of someone who didn't
really know what he was doing having what he thought
was a good idea.  Sometimes this pays off, but not
always, but don't be afraid to share results.
I think the important thing is that even if your
findings turn out to be wrong (as mine were in this
case), that the code is checked.


For the curious, a patch to find out who called a function
with 'invalid' arguments looks like this..

+   if (size==0) {
+       printk("DEBUG: kmalloc() called with size==0 !! caller=%p\n",
+           __builtin_return_address(0));
+   }

This will print out a hex address for the caller.
You can look up the nearest match in System.map to
find the function name.


regards,

-- 
Dave.


Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Sat Jun 10 17:16:43 2000
Received: by humbolt.nl.linux.org id <S92194AbQFJPQK>;
	Sat, 10 Jun 2000 17:16:10 +0200
Received: from sierra.newmex.com ([206.183.203.8]:40208 "EHLO
        sierra.newmex.com") by humbolt.nl.linux.org with ESMTP
	id <S92193AbQFJPPu>; Sat, 10 Jun 2000 17:15:50 +0200
Received: from jkintl.com (ppp174.newmex.com [206.183.203.174])
	by sierra.newmex.com (8.9.1a/8.9.1) with ESMTP id JAA31893;
	Sat, 10 Jun 2000 09:15:07 -0600
Message-ID: <39425CA0.4A1B6837@jkintl.com>
Date:   Sat, 10 Jun 2000 09:20:00 -0600
From:   John McDermott <jjm@jkintl.com>
Organization: J-K International, Ltd.
X-Mailer: Mozilla 4.73 [en] (Win98; I)
X-Accept-Language: en
MIME-Version: 1.0
To:     Rik van Riel <riel@conectiva.com.br>
CC:     kernel-audit@nl.linux.org
Subject: Re: where to start?
References: <Pine.LNX.4.21.0006091943150.31358-100000@duckman.distro.conectiva>
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

I supose type 3 includes "Misbehavior Bugs" where the system is supposed
to* do one thing and does another.  That fits somewhat in type 4, but
*could* be a security issue as with your truncating example.

*"supposed to" as documented by comments or manuals of some sort

--john

Rik van Riel wrote:

> 
> 3) stability bugs where the user can "exploit" some special
>    situation to make the kernel behave badly or crash
>    (eg. write to a file you're truncating, confusing buffer.c
>    and various other places)

> Rik
> --

-- 
John McDermott, Writer and Consultant
J-K International, Ltd.
V +1 505/377-6293  F +1 505/377-6313
jjm@jkintl.com

Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Sat Jun 10 20:02:18 2000
Received: by humbolt.nl.linux.org id <S92210AbQFJSBx>;
	Sat, 10 Jun 2000 20:01:53 +0200
Received: from terra.geo.uu.nl ([131.211.29.16]:60088 "EHLO terra.geo.uu.nl")
	by humbolt.nl.linux.org with ESMTP id <S92193AbQFJSB1>;
	Sat, 10 Jun 2000 20:01:27 +0200
Received: from newshub1-work.home.com (newshub1-work.home.com [24.0.0.24])
	by terra.geo.uu.nl (8.9.3/8.9.3/TvZ) with ESMTP id UAA24393
	for <kernel-audit@nl.linux.org>; Sat, 10 Jun 2000 20:01:25 +0200 (MET DST)
Received: from earthlink.net (omhas1A-hfc-0251-d1da1639.ne.coxatwork.com [209.218.22.57] (may be forged))
	by newshub1-work.home.com (8.9.1/8.9.1) with ESMTP id LAA00972
	for <kernel-audit@nl.linux.org>; Sat, 10 Jun 2000 11:01:10 -0700 (PDT)
Message-ID: <3942867B.16FDAB81@earthlink.net>
Date:   Sat, 10 Jun 2000 13:18:35 -0500
From:   Aaron Grothe <grothe@earthlink.net>
Organization: Heimdall LInux Incorporated
X-Mailer: Mozilla 4.72 [en] (X11; U; Linux 2.2.14 i586)
X-Accept-Language: en
MIME-Version: 1.0
To:     kernelaudit <kernel-audit@nl.linux.org>
Subject: A place to start
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

Hi,

A simple proposal : Total Bastard Linux (TBL)

TBL is designed to provide a higher barrier to programs that run on top
of linux as well as more of the kernel itself.  It is a new set of
kernel patches based upon including some of the well defined patches
(openwall, stackguard) and the rest of them, along with some other
tightening fixes.

The goal is to make a version of the Linux kernel that is intolerant of
bad programs and bad modules.  It will of course run a subset of the
programs available for linux.

An example of what I'm referring  to is the development of libsafe.
Many of the distributions include but do not make libsafe part of the
default installation because it will stop some programs from working.
However TBL, is designed more to say tough, fix it.

Years ago, I had to port a large program from SunOS 4.1.1 on a sparc to
SCO unix running on an intel box.  Unfortunately we had taken advantage
of a variety of nice features in the way SunOS did memory management
like padding to word boundaries allowing off by 1 errors in a variety of
sections.  We eventually ended up writing a malloc replacement to
replicate the behavior on SunOS to raise the bar on the SunOS box to the
same level as the SCO box.

TBL is designed to set a higher bar.  If a programmer can get his/her
module to run with TBL it is more than likely going to run on other
versions of Linux and will be more secure since it has had to comply
with a tighter environment.  TBL may also have advantages to application
writers how can take advantage of a stricter environment.

TBL is not designed to replace the hand audit process that the kernel
audit project is going to pursue.  It is intended to help find those
areas that should be audited first.  It will also help provide a tool to
help make sure that our changes do not introduce new unexpected side
effects.

I think TBL could be a good first project for the audit project and
would provide us with the possibility of gathering some more information
on the Linux kernel base.  If there is enough interest we could probably
put together a reasonable set of patches against the standard kernel.

What do you think?

Aaron Grothe
==========
"The Journey is the Reward" - Old Zen Buddhist Saying


Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Sat Jun 10 20:12:17 2000
Received: by humbolt.nl.linux.org id <S92193AbQFJSLl>;
	Sat, 10 Jun 2000 20:11:41 +0200
Received: from gadolinium.btinternet.com ([194.73.73.111]:58499 "EHLO
        gadolinium") by humbolt.nl.linux.org with ESMTP id <S92208AbQFJSLR>;
	Sat, 10 Jun 2000 20:11:17 +0200
Received: from host213-1-161-198.btinternet.com ([213.1.161.198] helo=smtp.btinternet.com)
	by gadolinium with esmtp (Exim 3.03 #16)
	id 130piz-00019f-00; Sat, 10 Jun 2000 19:11:14 +0100
Received: from neo.local (IDENT:root@neo.local [172.16.0.4])
	by smtp.btinternet.com (8.9.3/8.9.3) with ESMTP id TAA04377;
	Sat, 10 Jun 2000 19:16:52 +0100
Received: from neo.local (IDENT:dave@neo.local [172.16.0.4])
	by neo.local (8.9.3/8.9.3) with ESMTP id TAA07242;
	Sat, 10 Jun 2000 19:17:49 +0100
Date:   Sat, 10 Jun 2000 19:17:48 +0100 (BST)
From:   Dave Jones <dave@denial.force9.co.uk>
X-Sender: dave@neo.local
To:     Aaron Grothe <grothe@earthlink.net>
cc:     kernelaudit <kernel-audit@nl.linux.org>
Subject: Re: A place to start
In-Reply-To: <3942867B.16FDAB81@earthlink.net>
Message-ID: <Pine.LNX.4.21.0006101916390.7239-100000@neo.local>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

On Sat, 10 Jun 2000, Aaron Grothe wrote:

> TBL is designed to provide a higher barrier to programs that run on top
> of linux as well as more of the kernel itself.  It is a new set of
> kernel patches based upon including some of the well defined patches
> (openwall, stackguard) and the rest of them, along with some other
> tightening fixes.
> What do you think?

I think you've missed the point.
This is about auditting what we have already, not about
bolting on extra security features.


regards,

-- 
Dave.


Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Sat Jun 10 21:49:19 2000
Received: by humbolt.nl.linux.org id <S92210AbQFJTsp>;
	Sat, 10 Jun 2000 21:48:45 +0200
Received: from mail1.bna.bellsouth.net ([205.152.150.13]:23027 "EHLO
        mail1.bna.bellsouth.net") by humbolt.nl.linux.org with ESMTP
	id <S92193AbQFJTsF> convert rfc822-to-8bit; Sat, 10 Jun 2000 21:48:05 +0200
Received: from sQa.speedbros.org (adsl-78-129-55.mem.bellsouth.net [216.78.129.55])
	by mail1.bna.bellsouth.net (3.3.5alt/0.75.2) with SMTP id PAA09243
	for <kernel-audit@nl.linux.org>; Sat, 10 Jun 2000 15:48:02 -0400 (EDT)
From:   Bryan Paxton <evil7@bellsouth.net>
Reply-To: evil7@bellsouth.net
To:     kernel-audit@nl.linux.org
Subject: Webpage: Something to work with......
Date:   Sat, 10 Jun 2000 14:42:17 -0500
X-Mailer: KMail [version 1.0.28]
Content-Type: text/plain
MIME-Version: 1.0
Message-Id: <00061014441800.00775@sQa.speedbros.org>
Content-Transfer-Encoding: 8BIT
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

I put together a lil something..... http://www.nixed.net/evil7/ 
Of course I'm horrid with html and graphics, none the less just a rough
draft of what I think the webpage should be like.......

All feedback/comments/suggestions/flame are welcome


-- 
Bryan Paxton

"How should I know if it works? That's what beta testers are for. I
          only coded it."
 -- Linus Torvalds.



Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Sat Jun 10 23:08:10 2000
Received: by humbolt.nl.linux.org id <S92211AbQFJVHh>;
	Sat, 10 Jun 2000 23:07:37 +0200
Received: from tele-post-20.mail.demon.net ([194.217.242.20]:40969 "EHLO
        tele-post-20.mail.demon.net") by humbolt.nl.linux.org with ESMTP
	id <S92207AbQFJVG4>; Sat, 10 Jun 2000 23:06:56 +0200
Received: from notatla.demon.co.uk ([194.222.156.169])
	by tele-post-20.mail.demon.net with esmtp (Exim 2.12 #2)
	id 130sSx-0001jb-0K; Sat, 10 Jun 2000 21:06:52 +0000
Received: (from lists@localhost)
	by notatla.demon.co.uk (noyb/noyb) id VAA03343;
	Sat, 10 Jun 2000 21:43:33 +0100
Date:   Sat, 10 Jun 2000 21:43:33 +0100
From:   lists@notatla.demon.co.uk
Message-Id: <200006102043.VAA03343@notatla.demon.co.uk>
To:     jjm@jkintl.com, riel@conectiva.com.br
Subject: Re: where to start?
Cc:     kernel-audit@nl.linux.org
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

From: John McDermott <jjm@jkintl.com>

> I supose type 3 includes "Misbehavior Bugs" where the system is supposed
> to* do one thing and does another.  That fits somewhat in type 4, but
> *could* be a security issue as with your truncating example.
> 
> *"supposed to" as documented by comments or manuals of some sort

And POSIX standards; which I for one could do with knowing better.

Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Sat Jun 10 23:52:12 2000
Received: by humbolt.nl.linux.org id <S92210AbQFJVvg>;
	Sat, 10 Jun 2000 23:51:36 +0200
Received: from oz.uchicago.edu ([128.135.102.11]:9732 "EHLO oz.uchicago.edu")
	by humbolt.nl.linux.org with ESMTP id <S92207AbQFJVvK>;
	Sat, 10 Jun 2000 23:51:10 +0200
Received: from oz.uchicago.edu (IDENT:marty@localhost [127.0.0.1])
	by oz.uchicago.edu (8.11.0.Beta1/8.11.0.Beta1) with ESMTP id e5ALp7j01446
	for <kernel-audit@mail.nl.linux.org>; Sat, 10 Jun 2000 16:51:08 -0500
Message-Id: <200006102151.e5ALp7j01446@oz.uchicago.edu>
X-Mailer: exmh version 2.1.1 10/15/1999
To:     kernel-audit@nl.linux.org
Subject: 
Date:   Sat, 10 Jun 2000 16:51:07 -0500
From:   "Marty Dippel" <marty@hep.uchicago.edu>
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

auth 4c3f2313 subscribe kernel-audit marty@hep.uchicago.edu



Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Sun Jun 11 00:14:51 2000
Received: by humbolt.nl.linux.org id <S92214AbQFJWOH>;
	Sun, 11 Jun 2000 00:14:07 +0200
Received: from octopus.phy.bg.ac.yu ([147.91.80.4]:43844 "EHLO
        octopus.phy.bg.ac.yu") by humbolt.nl.linux.org with ESMTP
	id <S92207AbQFJWNk>; Sun, 11 Jun 2000 00:13:40 +0200
Received: (from lynx@localhost)
	by octopus.phy.bg.ac.yu (8.9.0/8.9.0) id AAA12286;
	Sun, 11 Jun 2000 00:13:34 +0200
Date:   Sun, 11 Jun 2000 00:13:34 +0200
From:   Boris Dragovic <lynx@phy.bg.ac.yu>
Message-Id: <200006102213.AAA12286@octopus.phy.bg.ac.yu>
To:     grothe@earthlink.net, kernel-audit@nl.linux.org
Subject: Re: A place to start
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

	A simple proposal : Total Bastard Linux (TBL)

the idea is very nice but I don't think this is exactly what kernel-audit
should be. kernel - audit should focus on discovering security threats and
do it fast and efficiently. TBL could be a spin off...

lynx


Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Sun Jun 11 00:17:10 2000
Received: by humbolt.nl.linux.org id <S92220AbQFJWQY>;
	Sun, 11 Jun 2000 00:16:24 +0200
Received: from a1a90191.sympatico.bconnected.net ([209.53.19.191]:52485 "EHLO
        continuum.cm.nu") by humbolt.nl.linux.org with ESMTP
	id <S92216AbQFJWPD>; Sun, 11 Jun 2000 00:15:03 +0200
Received: (from shane@localhost)
	by continuum.cm.nu (8.11.0.Beta1/8.11.0.Beta1/Debian 8.11.0-1) id e5AMEls20681
	for shane@cm.nu; Sat, 10 Jun 2000 15:14:47 -0700
Received: from humbolt.nl.linux.org (root@humbolt.geo.uu.nl [131.211.28.48])
	by continuum.cm.nu (8.11.0.Beta1/8.11.0.Beta1/Debian 8.11.0-1) with ESMTP id e5AAWDx14507
	for <shane@cm.nu>; Sat, 10 Jun 2000 03:32:13 -0700
X-Authentication-Warning: continuum.cm.nu: Host root@humbolt.geo.uu.nl [131.211.28.48] claimed to be humbolt.nl.linux.org
Received: by humbolt.nl.linux.org id <S92194AbQFJKbk>;
	Sat, 10 Jun 2000 12:31:40 +0200
Received: from gadolinium.btinternet.com ([194.73.73.111]:62382 "EHLO
        gadolinium") by humbolt.nl.linux.org with ESMTP id <S92193AbQFJKbP>;
	Sat, 10 Jun 2000 12:31:15 +0200
Received: from host213-1-188-235.btinternet.com ([213.1.188.235] helo=smtp.btinternet.com)
	by gadolinium with esmtp (Exim 3.03 #16)
	id 130iXl-0006gx-00; Sat, 10 Jun 2000 11:31:09 +0100
Received: from neo.local (IDENT:root@neo.local [172.16.0.4])
	by smtp.btinternet.com (8.9.3/8.9.3) with ESMTP id LAA02915;
	Sat, 10 Jun 2000 11:36:46 +0100
Received: from neo.local (IDENT:dave@neo.local [172.16.0.4])
	by neo.local (8.9.3/8.9.3) with ESMTP id LAA31801;
	Sat, 10 Jun 2000 11:37:47 +0100
Date:   Sat, 10 Jun 2000 11:37:40 +0100 (BST)
From:   Dave Jones <dave@denial.force9.co.uk>
X-Sender: dave@neo.local
To:     Mathijs Mohlmann <mathijs@knoware.nl>
cc:     kernel-audit@nl.linux.org
Subject: RE: where to start?
In-Reply-To: <XFMail.20000610105831.mathijs@knoware.nl>
Message-ID: <Pine.LNX.4.21.0006101123180.31706-100000@neo.local>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

On Sat, 10 Jun 2000, Mathijs Mohlmann wrote:

> Which brings me to my next question. How far should we go? 
> Imagine a function that just can't take a null pointer as
> argument. Every caller checks to make sure that no null 
> pointer is passed. Should we introduce in extra sanity check
> in that function to make absolutly sure? If we do that we
> prevent a lot of future bugs from happening. On the other 
> hand we can forget about mainstream kernel inclusion.

What you have to be aware of, is that some of the functions
allow NULL inputs and perform in slightly different ways.
As code gets more documented, this will become easier.

As an example, I recently made a patch that added a check
to kmalloc() for 0 byte allocations. When I booted the
kernel, I got messages every second from select()
allocating 0 bytes.  What I didn't know is that it's
perfectly valid (though aparently non-sensical) for
kmalloc to allocate 0 bytes. It actually returns a ptr
to a mem area where you can store 0 bytes :)

I think this was a perfect case of someone who didn't
really know what he was doing having what he thought
was a good idea.  Sometimes this pays off, but not
always, but don't be afraid to share results.
I think the important thing is that even if your
findings turn out to be wrong (as mine were in this
case), that the code is checked.


For the curious, a patch to find out who called a function
with 'invalid' arguments looks like this..

+   if (size==0) {
+       printk("DEBUG: kmalloc() called with size==0 !! caller=%p\n",
+           __builtin_return_address(0));
+   }

This will print out a hex address for the caller.
You can look up the nearest match in System.map to
find the function name.


regards,

-- 
Dave.


Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/


Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Sun Jun 11 00:26:20 2000
Received: by humbolt.nl.linux.org id <S92218AbQFJWZ1>;
	Sun, 11 Jun 2000 00:25:27 +0200
Received: from mail1.bna.bellsouth.net ([205.152.150.13]:218 "EHLO
        mail1.bna.bellsouth.net") by humbolt.nl.linux.org with ESMTP
	id <S92207AbQFJWZA> convert rfc822-to-8bit; Sun, 11 Jun 2000 00:25:00 +0200
Received: from sQa.speedbros.org (adsl-78-129-55.mem.bellsouth.net [216.78.129.55])
	by mail1.bna.bellsouth.net (3.3.5alt/0.75.2) with SMTP id SAA28716
	for <kernel-audit@nl.linux.org>; Sat, 10 Jun 2000 18:24:58 -0400 (EDT)
From:   Bryan Paxton <evil7@bellsouth.net>
Reply-To: evil7@bellsouth.net
To:     kernel-audit@nl.linux.org
Subject: Re: A place to start
Date:   Sat, 10 Jun 2000 17:20:52 -0500
X-Mailer: KMail [version 1.0.28]
Content-Type: text/plain
MIME-Version: 1.0
Message-Id: <00061017211404.00835@sQa.speedbros.org>
Content-Transfer-Encoding: 8BIT
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list



As far as a spin off, that wasn't my goal... But if the community
wishes so more power to you guys : )

kernel-audit is simply to audit the existing code. 
Not manipulate it, or malform it to get along with a userland program
for various security reasons.

But great idea none the less.... TBL that is.

On Sat, 10 Jun 2000, you wrote:
> A simple proposal : Total Bastard Linux (TBL)
> 
> the idea is very nice but I don't think this is exactly what kernel-audit
> should be. kernel - audit should focus on discovering security threats and
> do it fast and efficiently. TBL could be a spin off...
> 
> lynx
> 
> 
> Kernel-audit:  discussion list for security and the linux kernel
> Archive:       http://mail.nl.linux.org/kernel-audit/
-- 
Bryan Paxton

"How should I know if it works? That's what beta testers are for. I
          only coded it."
 -- Linus Torvalds.



Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Sun Jun 11 00:27:18 2000
Received: by humbolt.nl.linux.org id <S92207AbQFJWZ4>;
	Sun, 11 Jun 2000 00:25:56 +0200
Received: from mail0.bna.bellsouth.net ([205.152.150.12]:2732 "EHLO
        mail0.bna.bellsouth.net") by humbolt.nl.linux.org with ESMTP
	id <S92216AbQFJWZ0> convert rfc822-to-8bit; Sun, 11 Jun 2000 00:25:26 +0200
Received: from sQa.speedbros.org (adsl-78-129-55.mem.bellsouth.net [216.78.129.55])
	by mail0.bna.bellsouth.net (3.3.5alt/0.75.2) with SMTP id SAA07514
	for <kernel-audit@nl.linux.org>; Sat, 10 Jun 2000 18:25:24 -0400 (EDT)
From:   Bryan Paxton <evil7@bellsouth.net>
Reply-To: evil7@bellsouth.net
To:     kernel-audit@nl.linux.org
Subject: RE: where to start?
Date:   Sat, 10 Jun 2000 17:21:20 -0500
X-Mailer: KMail [version 1.0.28]
Content-Type: text/plain
MIME-Version: 1.0
Message-Id: <00061017214005.00835@sQa.speedbros.org>
Content-Transfer-Encoding: 8BIT
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list



Exactly, please don't by shy to share your finding/ideas... Just do it
: )  Maybe you could be wrong on what you're doing or the idea you
have, but it could lead to a right idea in the same dept. or possibly
another. On the fly innovation : )


On Sat, 10 Jun 2000, you wrote:
> On Sat, 10 Jun 2000, Mathijs Mohlmann wrote:
> 
> > Which brings me to my next question. How far should we go? 
> > Imagine a function that just can't take a null pointer as
> > argument. Every caller checks to make sure that no null 
> > pointer is passed. Should we introduce in extra sanity check
> > in that function to make absolutly sure? If we do that we
> > prevent a lot of future bugs from happening. On the other 
> > hand we can forget about mainstream kernel inclusion.
> 
> What you have to be aware of, is that some of the functions
> allow NULL inputs and perform in slightly different ways.
> As code gets more documented, this will become easier.
> 
> As an example, I recently made a patch that added a check
> to kmalloc() for 0 byte allocations. When I booted the
> kernel, I got messages every second from select()
> allocating 0 bytes.  What I didn't know is that it's
> perfectly valid (though aparently non-sensical) for
> kmalloc to allocate 0 bytes. It actually returns a ptr
> to a mem area where you can store 0 bytes :)
> 
> I think this was a perfect case of someone who didn't
> really know what he was doing having what he thought
> was a good idea.  Sometimes this pays off, but not
> always, but don't be afraid to share results.
> I think the important thing is that even if your
> findings turn out to be wrong (as mine were in this
> case), that the code is checked.
> 
> 
> For the curious, a patch to find out who called a function
> with 'invalid' arguments looks like this..
> 
> +   if (size==0) {
> +       printk("DEBUG: kmalloc() called with size==0 !! caller=%p\n",
> +           __builtin_return_address(0));
> +   }
> 
> This will print out a hex address for the caller.
> You can look up the nearest match in System.map to
> find the function name.
> 
> 
> regards,
> 
> -- 
> Dave.
> 
> 
> Kernel-audit:  discussion list for security and the linux kernel
> Archive:       http://mail.nl.linux.org/kernel-audit/
> 
> 
> Kernel-audit:  discussion list for security and the linux kernel
> Archive:       http://mail.nl.linux.org/kernel-audit/
-- 
Bryan Paxton

"How should I know if it works? That's what beta testers are for. I
          only coded it."
 -- Linus Torvalds.



Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Sun Jun 11 00:51:42 2000
Received: by humbolt.nl.linux.org id <S92223AbQFJWu5>;
	Sun, 11 Jun 2000 00:50:57 +0200
Received: from gateway.navtech.com ([206.79.145.2]:30218 "EHLO
        gateway.navtech.com") by humbolt.nl.linux.org with ESMTP
	id <S92219AbQFJWu2>; Sun, 11 Jun 2000 00:50:28 +0200
Received: from birch.navtech.com (birch.navtech.com [198.232.159.118]) by gateway.navtech.com (8.9.1/8.8.3) with ESMTP id PAA30596 for <kernel-audit@nl.linux.org>; Sat, 10 Jun 2000 15:50:26 -0700
Received: from postman.chi.navtech.com (postman.chi.navtech.com [10.8.20.25]) by birch.navtech.com (8.9.1/8.8.3) with ESMTP id PAA21712 for <kernel-audit@nl.linux.org>; Sat, 10 Jun 2000 15:50:25 -0700
Received: by postman.chi.navtech.com with Internet Mail Service (5.5.2650.21)
	id <M40H52DB>; Sat, 10 Jun 2000 17:51:03 -0500
Message-ID: <91468650040FD411A51100104B63E23123AFD8@postman.chi.navtech.com>
From:   "Bechtolsheim, Stephan" <sbechtol@chi.navtech.com>
To:     kernel-audit@nl.linux.org
Subject: RE: A place to start
Date:   Sat, 10 Jun 2000 17:51:02 -0500
MIME-Version: 1.0
X-Mailer: Internet Mail Service (5.5.2650.21)
Content-Type: multipart/alternative;
	boundary="----_=_NextPart_001_01BFD32E.5A1ED670"
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

This message is in MIME format. Since your mail reader does not understand
this format, some or all of this message may not be legible.

------_=_NextPart_001_01BFD32E.5A1ED670
Content-Type: text/plain;
	charset="iso-8859-1"

I think it's wrong to deal with more than one
kernel - unless there are the resources.

1. Use the newest kernel
2. If there is something serious found, go back and
   look at the other kernels.

It's a matter of resources, such as time and number
of people ....

My personal opinion.

StvB
> 

------_=_NextPart_001_01BFD32E.5A1ED670
Content-Type: text/html;
	charset="iso-8859-1"

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">
<META NAME="Generator" CONTENT="MS Exchange Server version 5.5.2652.35">
<TITLE>RE: A place to start</TITLE>
</HEAD>
<BODY>

<P><FONT SIZE=2>I think it's wrong to deal with more than one</FONT>
<BR><FONT SIZE=2>kernel - unless there are the resources.</FONT>
</P>

<P><FONT SIZE=2>1. Use the newest kernel</FONT>
<BR><FONT SIZE=2>2. If there is something serious found, go back and</FONT>
<BR><FONT SIZE=2>&nbsp;&nbsp; look at the other kernels.</FONT>
</P>

<P><FONT SIZE=2>It's a matter of resources, such as time and number</FONT>
<BR><FONT SIZE=2>of people ....</FONT>
</P>

<P><FONT SIZE=2>My personal opinion.</FONT>
</P>

<P><FONT SIZE=2>StvB</FONT>
<BR><FONT SIZE=2>&gt; </FONT>
</P>

</BODY>
</HTML>
------_=_NextPart_001_01BFD32E.5A1ED670--

Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Sun Jun 11 00:53:20 2000
Received: by humbolt.nl.linux.org id <S92225AbQFJWwb>;
	Sun, 11 Jun 2000 00:52:31 +0200
Received: from smtp3.libero.it ([193.70.192.53]:40087 "EHLO smtp3.libero.it")
	by humbolt.nl.linux.org with ESMTP id <S92219AbQFJWvq>;
	Sun, 11 Jun 2000 00:51:46 +0200
Received: from armageddon.allanon.org (151.20.25.217) by smtp3.libero.it; 11 Jun 2000 00:51:43 +0200
Received: by armageddon.allanon.org (Postfix, from userid 0)
	id AB8CA5FBB; Mon, 12 Jun 2000 16:26:11 +0200 (CEST)
Date:   Mon, 12 Jun 2000 16:26:11 +0200
From:   Gigi Sullivan <sullivan@sikurezza.org>
To:     Dave Jones <dave@denial.force9.co.uk>
Cc:     kernel-audit@nl.linux.org
Subject: Re: where to start?
Message-ID: <20000612162611.N275@armageddon.libero.it>
References: <XFMail.20000610105831.mathijs@knoware.nl> <Pine.LNX.4.21.0006101123180.31706-100000@neo.local>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
X-Mailer: Mutt 0.95.5i
In-Reply-To: <Pine.LNX.4.21.0006101123180.31706-100000@neo.local>; from Dave Jones on Sat, Jun 10, 2000 at 11:37:40AM +0100
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

Aiee :)

	Hello!

> On Sat, 10 Jun 2000, Mathijs Mohlmann wrote:
> 
> > Which brings me to my next question. How far should we go? 
> > Imagine a function that just can't take a null pointer as
> > argument. Every caller checks to make sure that no null 
> > pointer is passed. Should we introduce in extra sanity check
> > in that function to make absolutly sure? If we do that we
> > prevent a lot of future bugs from happening. On the other 
> > hand we can forget about mainstream kernel inclusion.

	We have to take care about performance however.

	It's true that we should audit kernel sources, but adding
	too much sanities check could slow down kernel performance
	and this isn't good.

	It's true that a simple check (which complexity could be O(1))
	is pointless here, but keep in mind that quite often there's
	a huge call trace on the stack; we call many routines `at a time',
	and this could slow down operations if too many sanities check were
	added ...

	Kernel developers (or wannabe) should use and pass properly arguments
	to the routines they call.

	What we should be aware of is about kernel semanthics (see the
	recent capability issue).

	This is not a rule, obviously, but it's important.

	I guess that we have to keep this in mind, always ...

	All above is IMHO :))


bye bye

			-- gg sullivan

-- 
Lorenzo Cavallaro	`Gigi Sullivan' <sullivan@sikurezza.org>

Until I loved, life had no beauty;
I did not know I lived until I had loved. (Theodor Korner)

Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Sun Jun 11 01:00:52 2000
Received: by humbolt.nl.linux.org id <S92226AbQFJXAJ>;
	Sun, 11 Jun 2000 01:00:09 +0200
Received: from smtp3.libero.it ([193.70.192.53]:6302 "EHLO smtp3.libero.it")
	by humbolt.nl.linux.org with ESMTP id <S92219AbQFJW7l>;
	Sun, 11 Jun 2000 00:59:41 +0200
Received: from armageddon.allanon.org (151.20.25.217) by smtp3.libero.it; 11 Jun 2000 00:59:40 +0200
Received: by armageddon.allanon.org (Postfix, from userid 0)
	id DDE935FBB; Mon, 12 Jun 2000 16:37:28 +0200 (CEST)
Date:   Mon, 12 Jun 2000 16:37:28 +0200
From:   Gigi Sullivan <sullivan@sikurezza.org>
To:     "Bechtolsheim, Stephan" <sbechtol@chi.navtech.com>
Cc:     kernel-audit@nl.linux.org
Subject: Re: A place to start
Message-ID: <20000612163728.A1192@armageddon.libero.it>
References: <91468650040FD411A51100104B63E23123AFD8@postman.chi.navtech.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
X-Mailer: Mutt 0.95.5i
In-Reply-To: <91468650040FD411A51100104B63E23123AFD8@postman.chi.navtech.com>; from Bechtolsheim, Stephan on Sat, Jun 10, 2000 at 05:51:02PM -0500
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

Aiee :)

	Hello!

> 
> I think it's wrong to deal with more than one
> kernel - unless there are the resources.

	This sounds good ...
> 
> 1. Use the newest kernel
> 2. If there is something serious found, go back and
>    look at the other kernels.

	... however we should keep in mind that (for example)
	2.2.X kernel series won't get dropped right when 2.4.X (stable) 
	will be out.

	We, maybe, have to check out both newest kernel and the one which
	is still widly used.

> My personal opinion.
> 
> StvB
> > 

	above is IMHO :)

bye bye

			-- gg sullivan

-- 
Lorenzo Cavallaro	`Gigi Sullivan' <sullivan@sikurezza.org>

Until I loved, life had no beauty;
I did not know I lived until I had loved. (Theodor Korner)

Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Sun Jun 11 01:02:09 2000
Received: by humbolt.nl.linux.org id <S92219AbQFJXAT>;
	Sun, 11 Jun 2000 01:00:19 +0200
Received: from ip27.portland.me.pub-ip.psi.net ([38.11.101.27]:19716 "EHLO
        rivet") by humbolt.nl.linux.org with ESMTP id <S92224AbQFJW74>;
	Sun, 11 Jun 2000 00:59:56 +0200
Received: from rbt by rivet with local (Exim 3.13 #1)
	id 130uBT-0000A8-00
	for evil7@bellsouth.net; Sat, 10 Jun 2000 18:56:55 -0400
Date:   Sat, 10 Jun 2000 18:56:55 -0400
From:   Robert Mognet <rmgnt@surfree.com>
To:     Bryan Paxton <evil7@bellsouth.net>
Subject: Re: Webpage: Something to work with......
Message-ID: <20000610185655.A623@rivet.rivet.dyndns.org>
References: <00061014441800.00775@sQa.speedbros.org>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
X-Mailer: Mutt 1.0.1i
In-Reply-To: <00061014441800.00775@sQa.speedbros.org>; from evil7@bellsouth.net on Sat, Jun 10, 2000 at 02:42:17PM -0500
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

Hello Bryan,

On Sat, Jun 10, 2000 at 02:42:17PM -0500, Bryan Paxton wrote:
> I put together a lil something..... http://www.nixed.net/evil7/ 
> Of course I'm horrid with html and graphics, none the less just a rough
> draft of what I think the webpage should be like.......
> 
> All feedback/comments/suggestions/flame are welcome

A small suggestion:

	http://www.anybrowser.org/campaign/

Robert

> 
> 
> -- 
> Bryan Paxton
> 
> "How should I know if it works? That's what beta testers are for. I
>           only coded it."
>  -- Linus Torvalds.
> 
> 
> 
> Kernel-audit:  discussion list for security and the linux kernel
> Archive:       http://mail.nl.linux.org/kernel-audit/
> 

Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Sun Jun 11 01:12:12 2000
Received: by humbolt.nl.linux.org id <S92227AbQFJXLi>;
	Sun, 11 Jun 2000 01:11:38 +0200
Received: from mail2.bna.bellsouth.net ([205.152.150.14]:32992 "EHLO
        mail2.bna.bellsouth.net") by humbolt.nl.linux.org with ESMTP
	id <S92224AbQFJXLS> convert rfc822-to-8bit; Sun, 11 Jun 2000 01:11:18 +0200
Received: from sQa.speedbros.org (adsl-78-129-55.mem.bellsouth.net [216.78.129.55])
	by mail2.bna.bellsouth.net (3.3.5alt/0.75.2) with SMTP id TAA01016
	for <kernel-audit@nl.linux.org>; Sat, 10 Jun 2000 19:11:15 -0400 (EDT)
From:   Bryan Paxton <evil7@bellsouth.net>
Reply-To: evil7@bellsouth.net
To:     kernel-audit@nl.linux.org
Subject: Yet another web page layout
Date:   Sat, 10 Jun 2000 18:05:36 -0500
X-Mailer: KMail [version 1.0.28]
Content-Type: text/plain
MIME-Version: 1.0
Message-Id: <00061018073107.00835@sQa.speedbros.org>
Content-Transfer-Encoding: 8BIT
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

Please go see it and tell me what you think(reply to the list not me). 
http://www.nixed.net/evil7/

All ideas/bitching/whining/flame/crying/stomping your feet around and
pulling your hair is appreciated.


 -- 
Bryan Paxton

"How should I know if it works? That's what beta testers are for. I
          only coded it."
 -- Linus Torvalds.



Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Sun Jun 11 02:02:53 2000
Received: by humbolt.nl.linux.org id <S92215AbQFKABi>;
	Sun, 11 Jun 2000 02:01:38 +0200
Received: from vesuri.helsinki.fi ([128.214.205.10]:51460 "EHLO
        vesuri.Helsinki.FI") by humbolt.nl.linux.org with ESMTP
	id <S92229AbQFKAA7>; Sun, 11 Jun 2000 02:00:59 +0200
Received: from localhost (ammonton@localhost)
	by vesuri.Helsinki.FI (8.10.1/8.10.1) with ESMTP id e5B00se08975
	for <kernel-audit@nl.linux.org>; Sun, 11 Jun 2000 03:00:54 +0300 (EET DST)
X-Authentication-Warning: vesuri.Helsinki.FI: ammonton owned process doing -bs
Date:   Sun, 11 Jun 2000 03:00:54 +0300 (EET DST)
From:   Anders M Montonen <ammonton@cc.helsinki.fi>
To:     kernel-audit@nl.linux.org
Subject: Starting point
Message-ID: <Pine.OSF.4.20.0006110256140.7686-100000@vesuri.Helsinki.FI>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

Although I'm not a kernel hacker (please keep this in mind when reading)
I'd like to offer my thoughts on this project, which I find very
fascinating.

- It would be prudent to draw on the OpenBSD-project's
experience. Maybe some of the core crew could be a "guest lecturer"?
- Because the Linux development model differs so much from the *BSD
one, most methods can probably not be applied directly to this project.
- The LKAP should also work preventively by improving kernel (interface)
documentation and authoring documents on writing safe code.
- Any bugs found should be stomped. As experience has shown (and as has
been pointed out here) even bugs deemed harmless can be dangerous.
Besides, bugfixed code is good code.
- To get the show on the road, I would suggest choosing a core component
that has remained relatively stable between the "current" kernel series
(2.0 - 2.2 - 2.4)
- I would also suggest focusing on the upcoming 2.4 kernel. Auditing the
2.2 kernel would mean creating a rather large "lag".
- Once a certain version of the kernel has been audited, there remains
the task of auditing all upcoming patches. However, if this project is
successful (particularly regarding the educational angle) I predict that
this task will become easier as more developers start adhering to the
guidelines set out by the LKAP. Hopefully, this would free enough
resources to start following the development series kernel.
- The development series kernel would have to be followed in some way,
the alternative being starting from scratch each time a stable kernel is
released.

Of course, a completely different route to follow would be to start with
the 2.0 kernel, since it is bugfix-only at this stage.

-a


Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Sun Jun 11 02:48:25 2000
Received: by humbolt.nl.linux.org id <S92229AbQFKArw>;
	Sun, 11 Jun 2000 02:47:52 +0200
Received: from mail0.bna.bellsouth.net ([205.152.150.12]:20868 "EHLO
        mail0.bna.bellsouth.net") by humbolt.nl.linux.org with ESMTP
	id <S92228AbQFKAre>; Sun, 11 Jun 2000 02:47:34 +0200
Received: from adsl-78-129-55.mem.bellsouth.net (adsl-78-129-55.mem.bellsouth.net [216.78.129.55])
	by mail0.bna.bellsouth.net (3.3.5alt/0.75.2) with ESMTP id UAA12733
	for <kernel-audit@nl.linux.org>; Sat, 10 Jun 2000 20:47:31 -0400 (EDT)
Date:   Sat, 10 Jun 2000 19:43:47 -0500 (CDT)
From:   Bryan Paxton <evil7@bellsouth.net>
X-Sender: evil7@sqa.speedbros.org
To:     kernel-audit@nl.linux.org
Subject: Re: Starting point
Message-ID: <Pine.LNX.4.21.0006101933480.1685-100000@sqa.speedbros.org>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

On Sat, 10 Jun 2000, you wrote:
> Although I'm not a kernel hacker (please keep this in mind when reading)
> I'd like to offer my thoughts on this project, which I find very
> fascinating.

Who says you have to be a kernel hacker to contribute ? 
Ideas and voicing yourself is the first step in any project of this
magnitude, and I highly encourage it. I don't code myself. 

 
> - It would be prudent to draw on the OpenBSD-project's
> experience. Maybe some of the core crew could be a "guest lecturer"?

Yes surely, advice from the people at OpenBSD developers is nothing but
goods.

> - The LKAP should also work preventively by improving kernel (interface)
> documentation and authoring documents on writing safe code.

Education is a key factor in security. Whether someone wants takes the
time to sit down and write such a document or how-to remains to be seen
: )

> - Any bugs found should be stomped. As experience has shown (and as has
> been pointed out here) even bugs deemed harmless can be dangerous.
Agreed look at Rik's orginal "Where do we start ?" post. 

> Besides, bugfixed code is good code.
: )

> - To get the show on the road, I would suggest choosing a core component
> that has remained relatively stable between the "current" kernel series
> (2.0 - 2.2 - 2.4)

I think 2.2 would be the best place to start... Even when 2.4 is released 
most people/servers aren't going to upgrade right away for various
reasons.


> - I would also suggest focusing on the upcoming 2.4 kernel. Auditing the
> 2.2 kernel would mean creating a rather large "lag".
See above. Though I do think that some parts of the 2.4 series should be
audited first... netfilter, tcp/ip core, and fs.

> - Once a certain version of the kernel has been audited, there remains
> the task of auditing all upcoming patches. However, if this project is
> successful (particularly regarding the educational angle) I predict that
> this task will become easier as more developers start adhering to the
> guidelines set out by the LKAP. Hopefully, this would free enough
> resources to start following the development series kernel.

I wish you the best of luck on this one : ) 
hehe no really, this is a great idea... But EVERYONE must come together on
this, which isn't so much unrealistic but that it's gonna be while before
this happens IMHO.


> Of course, a completely different route to follow would be to start with
> the 2.0 kernel, since it is bugfix-only at this stage.
> 

This shall be decided by the majority of the community. 

This was a brilliant proposal, I hope to see more contributions from you
in the near(?) future.

-- 
Bryan Paxton

"How should I know if it works? That's what beta testers are for. I
          only coded it."
 -- Linus Torvalds.





Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Sun Jun 11 03:22:35 2000
Received: by humbolt.nl.linux.org id <S92230AbQFKBWC>;
	Sun, 11 Jun 2000 03:22:02 +0200
Received: from carry.netneo.com ([195.62.128.21]:22545 "EHLO carry.neonet.lv")
	by humbolt.nl.linux.org with ESMTP id <S92228AbQFKBVn>;
	Sun, 11 Jun 2000 03:21:43 +0200
Received: from ed.ed (as0b.netneo.com [195.62.135.193])
	by carry.neonet.lv (8.9.3/8.9.3) with ESMTP id DAA03951;
	Sun, 11 Jun 2000 03:21:20 +0200
Received: (from root@localhost)
	by ed.ed (8.8.7/8.8.5) id BAA19609;
	Sun, 11 Jun 2000 01:18:44 GMT
From:   root <evpopkov@carry.neonet.lv>
Date:   Sun, 11 Jun 2000 01:18:43 +0000
To:     evil7@bellsouth.net, kernel-audit@nl.linux.org
Subject: Re: Starting point
Message-ID: <3942E8F3.nailF47118D3E@ed.ed>
References: <Pine.LNX.4.21.0006101933480.1685-100000@sqa.speedbros.org>
X-Mailer: nail 9.13 2000-05-30
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

> > Of course,  a completely different  route to  follow would be  to start
> > with
> > the 2.0 kernel, since it is bugfix-only at this stage.
>
> This shall be decided by the majority of the community.

 Umh, let me tell you how it  look from a slightly different point of view.
I'm still happy with 2.0.38, an old and lazy dino, so bear with me, please,
because I'm likely to stay in minority :)
 Development kernels, as  well as recent production  versions enjoy massive
attention  from  active kernel  developers.  This  code is  being  written,
tested, patched, reviewed constantly. Let's say it's `in.'
 Recent  cap issue  with 2.2.14  was detected  and eliminated  fast enough,
_without_ any help  from LKAP per se. `We' are  just forming our community,
but `they' could already fix the problem.
 Unlike that, stable or old kernels get  less and less eyes, despite of the
fact  that there  are  many people  like  me who  are  not planning  kernel
upgrades real soon,  because there's no practical need. It  ain't broke, so
leave it alone.
 What  if  we organize  not  by  kernel  versions,  but by  subsystems,  or
whatever other  (buzz)word shall we use.  We can start working  on the core
functionality, like task scheduling, moving to `abstraction' layers like fs
or network, then descending to hardware and so on.
 Of course,  in this case  roadmap can be  more complicated, but  it's well
worth it IMHO.  I believe it's easier and more  consistent to take signal.c
from every kernel  we have at our  disposal and dissect it to  see how it's
written, to study  its evolution and to identify possible  problems by code
comparison.

 What would you say?


---

 "Teddy - I suppose Mummy and Daddy are real, aren't they?"
 Teddy said, "You ask such silly questions, David. Nobody knows what
'real' really means. Let's go indoors."

 Brian W. Aldiss, Supertoys Last All Summer Long


Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Sun Jun 11 03:31:46 2000
Received: by humbolt.nl.linux.org id <S92231AbQFKBbM>;
	Sun, 11 Jun 2000 03:31:12 +0200
Received: from mail0.bna.bellsouth.net ([205.152.150.12]:6304 "EHLO
        mail0.bna.bellsouth.net") by humbolt.nl.linux.org with ESMTP
	id <S92228AbQFKBaj>; Sun, 11 Jun 2000 03:30:39 +0200
Received: from adsl-78-129-55.mem.bellsouth.net (adsl-78-129-55.mem.bellsouth.net [216.78.129.55])
	by mail0.bna.bellsouth.net (3.3.5alt/0.75.2) with ESMTP id VAA12566
	for <kernel-audit@nl.linux.org>; Sat, 10 Jun 2000 21:30:33 -0400 (EDT)
Date:   Sat, 10 Jun 2000 20:26:48 -0500 (CDT)
From:   Bryan Paxton <evil7@bellsouth.net>
X-Sender: evil7@sqa.speedbros.org
To:     kernel-audit@nl.linux.org
Subject: Re: Starting point
Message-ID: <Pine.LNX.4.21.0006102024550.1827-100000@sqa.speedbros.org>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list


Ya know I don't really think the way we go as far as kernel by kernel or
file by file really matters. I think what matters how organised it is. 
I believe either way will work as long as the backend of it all it stable
and clean.

Though I'm retarded, what do I know : )

On Sat, 10 Jun 2000, you wrote:
> > > Of course,  a completely different  route to  follow would be  to start
> > > with
> > > the 2.0 kernel, since it is bugfix-only at this stage.
> >
> > This shall be decided by the majority of the community.
> 
>  Umh, let me tell you how it  look from a slightly different point of view.
> I'm still happy with 2.0.38, an old and lazy dino, so bear with me, please,
> because I'm likely to stay in minority :)
>  Development kernels, as  well as recent production  versions enjoy massive
> attention  from  active kernel  developers.  This  code is  being  written,
> tested, patched, reviewed constantly. Let's say it's `in.'
>  Recent  cap issue  with 2.2.14  was detected  and eliminated  fast enough,
> _without_ any help  from LKAP per se. `We' are  just forming our community,
> but `they' could already fix the problem.
>  Unlike that, stable or old kernels get  less and less eyes, despite of the
> fact  that there  are  many people  like  me who  are  not planning  kernel
> upgrades real soon,  because there's no practical need. It  ain't broke, so
> leave it alone.
>  What  if  we organize  not  by  kernel  versions,  but by  subsystems,  or
> whatever other  (buzz)word shall we use.  We can start working  on the core
> functionality, like task scheduling, moving to `abstraction' layers like fs
> or network, then descending to hardware and so on.
>  Of course,  in this case  roadmap can be  more complicated, but  it's well
> worth it IMHO.  I believe it's easier and more  consistent to take signal.c
> from every kernel  we have at our  disposal and dissect it to  see how it's
> written, to study  its evolution and to identify possible  problems by code
> comparison.
> 
>  What would you say?
 
-- 
Bryan Paxton

"How should I know if it works? That's what beta testers are for. I
          only coded it."
 -- Linus Torvalds.





Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Sun Jun 11 03:41:27 2000
Received: by humbolt.nl.linux.org id <S92232AbQFKBkh>;
	Sun, 11 Jun 2000 03:40:37 +0200
Received: from mail0.bna.bellsouth.net ([205.152.150.12]:28326 "EHLO
        mail0.bna.bellsouth.net") by humbolt.nl.linux.org with ESMTP
	id <S92228AbQFKBj6>; Sun, 11 Jun 2000 03:39:58 +0200
Received: from adsl-78-129-55.mem.bellsouth.net (adsl-78-129-55.mem.bellsouth.net [216.78.129.55])
	by mail0.bna.bellsouth.net (3.3.5alt/0.75.2) with ESMTP id VAA19229
	for <kernel-audit@nl.linux.org>; Sat, 10 Jun 2000 21:39:55 -0400 (EDT)
Date:   Sat, 10 Jun 2000 20:36:10 -0500 (CDT)
From:   Bryan Paxton <evil7@bellsouth.net>
X-Sender: evil7@sqa.speedbros.org
To:     kernel-audit@nl.linux.org
Subject: 220+ subcribed to kernel-audit
Message-ID: <Pine.LNX.4.21.0006102034230.1846-100000@sqa.speedbros.org>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

I just did a rough count, and I'm sure everyone will be pleased to know
that only after 2 days over 220+ people have subscribed to kernel-audit.




Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Sun Jun 11 05:00:17 2000
Received: by humbolt.nl.linux.org id <S92233AbQFKC7i>;
	Sun, 11 Jun 2000 04:59:38 +0200
Received: from charon.lnk.telstra.net ([139.130.100.86]:33048 "EHLO
        central.charon.net.au") by humbolt.nl.linux.org with ESMTP
	id <S92228AbQFKC7F>; Sun, 11 Jun 2000 04:59:05 +0200
Received: from localhost (kendall@localhost)
	by central.charon.net.au (8.9.3/8.9.3) with ESMTP id MAA15443
	for <kernel-audit@nl.linux.org>; Sun, 11 Jun 2000 12:58:35 +1000
Date:   Sun, 11 Jun 2000 12:58:35 +1000 (EST)
From:   Kendall Lister <kendall@charon.net.au>
Reply-To: kernel-audit@nl.linux.org
To:     kernel-audit@nl.linux.org
Subject: Re: Starting point
In-Reply-To: <Pine.LNX.4.21.0006101933480.1685-100000@sqa.speedbros.org>
Message-ID: <Pine.LNX.4.10.10006111253450.14121-100000@central.charon.net.au>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

On Sat, 10 Jun 2000, Bryan Paxton wrote:

> On Sat, 10 Jun 2000, you wrote:
>
> > - The LKAP should also work preventively by improving kernel (interface)
> > documentation and authoring documents on writing safe code.
> 
> Education is a key factor in security. Whether someone wants takes the
> time to sit down and write such a document or how-to remains to be seen
> : )

I have no kernel hacking experience, although I have done a moderate
amount of coding and design. I am keen to lend my time to a project like
this, but I would need someone with more specific knowledge of the kernel
and security in general to write down what I need to look for, and how to
fix it. If I could read that, I sometimes have a dozen hours here or there
that I would enjoy devoting to improving Linux; as I said, I just need
someone to tell me what needs to be done. I imagine that a lot of people
with development experience are in a similar situation - quite a useful
resource, if only a few people can take the steps necessary to use it.

--
 Kendall Lister, Systems Operator for Charon I.S. - kendall@charon.net.au
  Charon Information Services - Friendly, Cheap Melbourne ISP: 9589 7781


Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Sun Jun 11 05:06:59 2000
Received: by humbolt.nl.linux.org id <S92234AbQFKDGX>;
	Sun, 11 Jun 2000 05:06:23 +0200
Received: from herd.plethora.net ([205.166.146.1]:19915 "EHLO
        herd.plethora.net") by humbolt.nl.linux.org with ESMTP
	id <S92228AbQFKDFn>; Sun, 11 Jun 2000 05:05:43 +0200
Received: from cu.mol.plethora.net (cu.mol.plethora.net [205.166.146.50])
	by herd.plethora.net (8.9.0/8.9.0) with ESMTP id WAA07184;
	Sat, 10 Jun 2000 22:05:38 -0500 (CDT)
Received: from localhost (dante@localhost)
	by cu.mol.plethora.net (8.9.3/8.9.3/Debian 8.9.3-6) with ESMTP id VAA19219;
	Sat, 10 Jun 2000 21:52:29 -0500
Date:   Sat, 10 Jun 2000 21:52:29 -0500 (CDT)
From:   Daniel Taylor <dante@plethora.net>
X-Sender: dante@cu.mol.plethora.net
To:     root <evpopkov@carry.neonet.lv>
cc:     evil7@bellsouth.net, kernel-audit@nl.linux.org
Subject: Re: Starting point
In-Reply-To: <3942E8F3.nailF47118D3E@ed.ed>
Message-ID: <Pine.LNX.4.10.10006102133110.19192-100000@cu.mol.plethora.net>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

Organizing somewhat by specialty is probably good, but only if we take
a critical lesson from the OpenBSD project and others like it:

  If something is a bug in one place, it is probably replicated elsewhere.

So say you find an overflow condition in the Vortex driver. There is a
good chance that code has inheritance from NE2k and that other drivers
inherit from it.  Check all the drivers in drivers/net for obvious 
occurences and post to the list so that others looking at other parts
of the kernel can possibly spot less obvious recurrences.

The other thing to remember is to be very careful, a lot of bits of code
that might look like a problem at first glance are simply the objects of
some very wierd optimizations, with problem cases being detected and
eliminated elsewhere. That is part of what makes this so challenging.

Daniel Taylor                Embedded and custom Linux integration.
dante@plethora.net           (612)747-1609

On Sun, 11 Jun 2000, root wrote:

> > > Of course,  a completely different  route to  follow would be  to start
> > > with
> > > the 2.0 kernel, since it is bugfix-only at this stage.
> >
> > This shall be decided by the majority of the community.
> 
>  Umh, let me tell you how it  look from a slightly different point of view.
> I'm still happy with 2.0.38, an old and lazy dino, so bear with me, please,
> because I'm likely to stay in minority :)
>  Development kernels, as  well as recent production  versions enjoy massive
> attention  from  active kernel  developers.  This  code is  being  written,
> tested, patched, reviewed constantly. Let's say it's `in.'
>  Recent  cap issue  with 2.2.14  was detected  and eliminated  fast enough,
> _without_ any help  from LKAP per se. `We' are  just forming our community,
> but `they' could already fix the problem.
>  Unlike that, stable or old kernels get  less and less eyes, despite of the
> fact  that there  are  many people  like  me who  are  not planning  kernel
> upgrades real soon,  because there's no practical need. It  ain't broke, so
> leave it alone.
>  What  if  we organize  not  by  kernel  versions,  but by  subsystems,  or
> whatever other  (buzz)word shall we use.  We can start working  on the core
> functionality, like task scheduling, moving to `abstraction' layers like fs
> or network, then descending to hardware and so on.
>  Of course,  in this case  roadmap can be  more complicated, but  it's well
> worth it IMHO.  I believe it's easier and more  consistent to take signal.c
> from every kernel  we have at our  disposal and dissect it to  see how it's
> written, to study  its evolution and to identify possible  problems by code
> comparison.
> 
>  What would you say?
> 
> 


Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Sun Jun 11 05:29:58 2000
Received: by humbolt.nl.linux.org id <S92236AbQFKD3X>;
	Sun, 11 Jun 2000 05:29:23 +0200
Received: from mail1.bna.bellsouth.net ([205.152.150.13]:35750 "EHLO
        mail1.bna.bellsouth.net") by humbolt.nl.linux.org with ESMTP
	id <S92228AbQFKD2z>; Sun, 11 Jun 2000 05:28:55 +0200
Received: from adsl-78-129-55.mem.bellsouth.net (adsl-78-129-55.mem.bellsouth.net [216.78.129.55])
	by mail1.bna.bellsouth.net (3.3.5alt/0.75.2) with ESMTP id XAA04114
	for <kernel-audit@nl.linux.org>; Sat, 10 Jun 2000 23:28:53 -0400 (EDT)
Date:   Sat, 10 Jun 2000 22:25:08 -0500 (CDT)
From:   Bryan Paxton <evil7@bellsouth.net>
X-Sender: evil7@sqa.speedbros.org
To:     kernel-audit@nl.linux.org
Subject: Re: Starting point
Message-ID: <Pine.LNX.4.21.0006102221240.2038-100000@sqa.speedbros.org>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

On Sat, 10 Jun 2000, Kendall Lister wrote:

If you're new to kernel hacking/developing I suggest these two mediums as
to becoming familar with it all:

1) echo subscribe kernelnewbies | mail majordomo@.nl.linux.org
2) Connect to irc.openprojects with your favorite irc client and /join
#kernelnewbies
3) All of the above : )


> I have no kernel hacking experience, although I have done a moderate
> amount of coding and design. I am keen to lend my time to a project like
> this, but I would need someone with more specific knowledge of the kernel
> and security in general to write down what I need to look for, and how to
> fix it. If I could read that, I sometimes have a dozen hours here or there
> that I would enjoy devoting to improving Linux; as I said, I just need
> someone to tell me what needs to be done. I imagine that a lot of people
> with development experience are in a similar situation - quite a useful
> resource, if only a few people can take the steps necessary to use it.
> 
> --
>  Kendall Lister, Systems Operator for Charon I.S. - kendall@charon.net.au
>   Charon Information Services - Friendly, Cheap Melbourne ISP: 9589 7781
> 
> 
> Kernel-audit:  discussion list for security and the linux kernel
> Archive:       http://mail.nl.linux.org/kernel-audit/
-- 
Bryan Paxton

"How should I know if it works? That's what beta testers are for. I
          only coded it."
 -- Linus Torvalds.


Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Sun Jun 11 06:02:10 2000
Received: by humbolt.nl.linux.org id <S92219AbQFKEBU>;
	Sun, 11 Jun 2000 06:01:20 +0200
Received: from field.videotron.net ([205.151.222.108]:36033 "EHLO
        field.videotron.net") by humbolt.nl.linux.org with ESMTP
	id <S92215AbQFKEAd>; Sun, 11 Jun 2000 06:00:33 +0200
Received: from opersys.com ([24.201.74.207])
 by field.videotron.net (Sun Internet Mail Server sims.3.5.1999.12.14.10.29.p8)
 with ESMTP id <0FVZ00DSL0Z54Z@field.videotron.net> for kernel-audit@nl.linux.org; Sat, 10 Jun 2000 23:42:42 -0400 (EDT)
Date:   Sat, 10 Jun 2000 23:45:55 -0400
From:   Karim Yaghmour <karym@opersys.com>
Subject: Linux Trace Toolkit for kernel auditing
To:     kernel-audit@nl.linux.org
Message-id: <39430B73.AAC3D350@opersys.com>
MIME-version: 1.0
X-Mailer: Mozilla 4.72 [en] (X11; U; Linux 2.2.14-TRACE-RTAI i686)
Content-type: text/plain; charset=us-ascii
Content-transfer-encoding: 7bit
X-Accept-Language: en, French/France, fr-FR, French/Canada, fr-CA
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list


OK, before anyone replies to this and says that I'm way off
and yadi ... yadi ... yada ... about the fact that kernel audit
isn't about inserting new stuff in the kernel ... read until
the end of the message.

For some time now I've been working on the Linux Trace Toolkit.
If you aren't aware of it's capabilities, I invite you to take
a look at it's home page : http://www.opersys.com/LTT

That said, LTT enables it's user to observe every detail of
an active kernel ___WITHOUT___ modifying or influencing it's
behavior in any way.

In the course of this development, it has been suggested at
many times that LTT would have the potential of being used
as a security auditing tool since it can view all the important
kernel events and it records their decription.

To facilitate this, I have recently added a facility to LTT
that enables any kernel module to register a callback that
will be called every time a given event occurs (file-system,
network, socket communication, etc.).

Having the event description, the callback can then react to
a certain event in a certain way. That can range from killing
the actual running process to logging the event in a certain
way.

This, though, is insufficient by itself to build a security
auditing system using LTT. Therefore, I've recently added an
event-driven state machine engine. The latter takes a state-
machine description whose state transitions are caused by the
occurence of certain events and calls on functions depending
on the current state of the state machine.

Therefore, systems could be built where given a certain
sequence of events occurs, a certain reaction occurs.

For example, let's someone finds a hole in an internet service
running on you server. This hole is a buffer overflow bug.
He uses this overflow to push on the stack code that will read
/etc/passwd and/or /etc/shadow and send it off to some of his
IPs. You could have a security auditing state machine that
checks for any process that tries to read /etc/passwd or
/etc/shadow and tries to send it on the net (since you have
access to the raw data you can actually verify this from within
your callbacks.) Since any process may be prone to this, it
doesn't matter what process caused the problem. The important
part is that you caught the culprit and potentially sent it
a kill signal.

Now this is a simple example and I'm no security expert. Actually
I know very little about the subject. But you do get the drift ...
so to speak.

There is already someone working on this. If you are interested
on working on such a system, please let me know, I'll forward
your name. You can also reply on this very list (hopefully, I
don't get killed over this) since the person I'm speaking of
is already subscribed. I also know other people who aren't on
this list who would be interested ... If I can help, I'll gladly
do so, but, as I said, I'm no security expert. Therefore, I'm
willing to help security experts build such a system, but I
can't build it myself ... honest.

Thank you for reading until the end and simply disregard this
message if you think it doesn't belong on this list or it doesn't
interest you or both.

Thanks and have fun :)

Karim

P.S.: Building such a system using kernel modules only (i.e. without
inserting anything in the kernel) is possible _as long as_ you
are using an LTT-patched kernel. Note that you do not have to
use any of the user tools that come with LTT or even use the
trace module that comes with it to achieve this goal. Just patch
the thing and you'll be ok.

===================================================
                 Karim Yaghmour
               karym@opersys.com
          Operating System Consultant
 (Linux kernel, real-time and distributed systems)
===================================================

Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Sun Jun 11 06:13:27 2000
Received: by humbolt.nl.linux.org id <S92211AbQFKEMm>;
	Sun, 11 Jun 2000 06:12:42 +0200
Received: from mail0.bna.bellsouth.net ([205.152.150.12]:43154 "EHLO
        mail0.bna.bellsouth.net") by humbolt.nl.linux.org with ESMTP
	id <S92227AbQFKELy>; Sun, 11 Jun 2000 06:11:54 +0200
Received: from adsl-78-129-55.mem.bellsouth.net (adsl-78-129-55.mem.bellsouth.net [216.78.129.55])
	by mail0.bna.bellsouth.net (3.3.5alt/0.75.2) with ESMTP id AAA12171
	for <kernel-audit@nl.linux.org>; Sun, 11 Jun 2000 00:11:48 -0400 (EDT)
Date:   Sat, 10 Jun 2000 23:08:03 -0500 (CDT)
From:   Bryan Paxton <evil7@bellsouth.net>
X-Sender: evil7@sqa.speedbros.org
To:     kernel-audit@nl.linux.org
Subject: Re: Linux Trace Toolkit for kernel auditing
Message-ID: <Pine.LNX.4.21.0006102303250.5440-100000@sqa.speedbros.org>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list


On Sat, 10 Jun 2000, you wrote:
> OK, before anyone replies to this and says that I'm way off
> and yadi ... yadi ... yada ... about the fact that kernel audit
> isn't about inserting new stuff in the kernel ... read until
> the end of the message.

I don't think this is far off the subjects of this list at all.
In fact I think it's perfect.
In two ways:

1. inexperienced users to kernel hacking/auditing could use it for obvious
reasons(auditing, double checking, whatever). 

2. Experienced users could use it simply to double check their work.

As long as you and I understand that LTT will never make it into the
kernel, and that you're not trying to get it plugged in either, but simply 
advocate it so developers who are auditing can plug it into the src code
they're hacking up could use it. Then no way man. You are totally on the
right track IMHO.

Keep up the awesome work.... And this truely is an excellent idea.

-- 
Bryan Paxton

"How should I know if it works? That's what beta testers are for. I
          only coded it."
 -- Linus Torvalds.




Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Sun Jun 11 07:23:05 2000
Received: by humbolt.nl.linux.org id <S92214AbQFKFWb>;
	Sun, 11 Jun 2000 07:22:31 +0200
Received: from terra.geo.uu.nl ([131.211.29.16]:29889 "EHLO terra.geo.uu.nl")
	by humbolt.nl.linux.org with ESMTP id <S92207AbQFKFWA>;
	Sun, 11 Jun 2000 07:22:00 +0200
Received: from smtp.snet.net (smtp.snet.net [204.60.6.55])
	by terra.geo.uu.nl (8.9.3/8.9.3/TvZ) with ESMTP id HAA04885
	for <kernel-audit@nl.linux.org>; Sun, 11 Jun 2000 07:21:58 +0200 (MET DST)
From:   mshobe@snet.net
Received: from sledge.localdomain ([64.252.32.45])
	by smtp.snet.net (8.9.3/8.9.3/SNET-bmx-1.3/D-1.7/O-1.6) with ESMTP id BAA27511
	for <kernel-audit@nl.linux.org>; Sun, 11 Jun 2000 01:21:41 -0400 (EDT)
Received: from mshobe by sledge.localdomain with local (Exim 3.12 #1 (Debian))
	id 1310Br-00005u-00
	for <kernel-audit@nl.linux.org>; Sun, 11 Jun 2000 01:21:43 -0400
Date:   Sun, 11 Jun 2000 01:21:43 -0400
To:     kernel-audit@nl.linux.org
Subject: Re: Starting point
Message-ID: <20000611012143.A277@cyberzone.net>
References: <Pine.LNX.4.21.0006101933480.1685-100000@sqa.speedbros.org> <Pine.LNX.4.10.10006111253450.14121-100000@central.charon.net.au>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
User-Agent: Mutt/1.0.1i
In-Reply-To: <Pine.LNX.4.10.10006111253450.14121-100000@central.charon.net.au>; from kendall@charon.net.au on Sun, Jun 11, 2000 at 12:58:35PM +1000
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

[NEWBIE]

Hi,

I'm not a programmer, just interested in the quality and security of
the software I use; so please forgive if this is painfully obvious to
everyone. :-)

Secure UNIX Programming Home Page http://www.whitefang.com/sup/

[/NEWBIE]
-- 
Matthew L. Shobe
mshobe@snet.net

Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Sun Jun 11 07:27:13 2000
Received: by humbolt.nl.linux.org id <S92207AbQFKF0j>;
	Sun, 11 Jun 2000 07:26:39 +0200
Received: from mail1.bna.bellsouth.net ([205.152.150.13]:30445 "EHLO
        mail1.bna.bellsouth.net") by humbolt.nl.linux.org with ESMTP
	id <S92210AbQFKF0P>; Sun, 11 Jun 2000 07:26:15 +0200
Received: from adsl-78-129-55.mem.bellsouth.net (adsl-78-129-55.mem.bellsouth.net [216.78.129.55])
	by mail1.bna.bellsouth.net (3.3.5alt/0.75.2) with ESMTP id BAA18688
	for <kernel-audit@nl.linux.org>; Sun, 11 Jun 2000 01:26:14 -0400 (EDT)
Date:   Sun, 11 Jun 2000 00:22:28 -0500 (CDT)
From:   Bryan Paxton <evil7@bellsouth.net>
X-Sender: evil7@sqa.speedbros.org
To:     kernel-audit@nl.linux.org
Subject: Re: Linux Trace Toolkit for kernel auditing
Message-ID: <Pine.LNX.4.21.0006110019550.664-100000@sqa.speedbros.org>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list


Hey no no no...
I would love to see something like this plugged into the kernel...
But wanting and happening are two different things.
I would also like to see such things as openwall and lids when they mature
enough to make it into the kernel. But from what I've seen, this just
isn't so... Yet anyway.


-- 
Bryan Paxton

"How should I know if it works? That's what beta testers are for. I
          only coded it."
 -- Linus Torvalds.




Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Sun Jun 11 07:56:44 2000
Received: by humbolt.nl.linux.org id <S92220AbQFKF4K>;
	Sun, 11 Jun 2000 07:56:10 +0200
Received: from terra.geo.uu.nl ([131.211.29.16]:52161 "EHLO terra.geo.uu.nl")
	by humbolt.nl.linux.org with ESMTP id <S92210AbQFKFzn>;
	Sun, 11 Jun 2000 07:55:43 +0200
Received: from terra.ctcs.net (terra.naytech.net [209.19.115.81])
	by terra.geo.uu.nl (8.9.3/8.9.3/TvZ) with ESMTP id HAA05353
	for <kernel-audit@nl.linux.org>; Sun, 11 Jun 2000 07:55:41 +0200 (MET DST)
From:   cybertech@cybertech.org
To:     kernel-audit@nl.linux.org
Subject: Re: Linux Trace Toolkit for kernel auditing (and thoughts)
X-Mailer: Lotus Notes Release 5.0a  May 4, 1999
Date:   Sun, 11 Jun 2000 05:50:04 GMT
Message-ID: <OF77EC7CFD.2FA093C0-ON882568FB.001CF61E@ctcs.net>
X-Priority: 3 (Normal)
X-MIMETrack: Serialize by Router on Terra/CTCS(Release 5.0a |May 4, 1999) at 06/10/2000
 10:50:13 PM,
	Serialize complete at 06/10/2000 10:50:13 PM
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

I don't see it as off topic either, frankly

Granted, the appropriateness of something like that in the mainstream 
kernel is arguable.  However, as I 
understand it, the aim of this list is to find kernel problems, and this 
would be a welcome tool for doing so.

In other threads (i've been lurking for 2 days do to time constraints, 
might as well pop it all in here), there 
have been some suggestions regarding starting this audit with the 2.0 
kernel.  While I do realize
there is a significant installed 2.0 base, I believe that 2.2 or 2.4 would 
be a more appropriate starting 
place.  2.4 would be my preference here, however, it's not yet stable 
enough for me to run it on most 
of my machines here, so that makes run-time testing difficult.  It does 
not, however, preclude a good 
old-fashioned code review -- and I firmly believe much can be discovered 
with some nice reading.

A tool I've run across, but haven't yet used, is a run-time bounds 
checking 
patch for GCC.  I don't know about the viability of a kernel built with 
this patch, but it might be 
interesting -- http://web.inter.nl.net/hcc/Haj.Ten.Brugge


David S. Stahl
NayTech Corporation
cybertech@cybertech.org




Bryan Paxton <evil7@bellsouth.net>
Sent by: owner-kernel-audit@nl.linux.org
06/10/2000 09:08 PM

 
        To:     kernel-audit@nl.linux.org
        cc:     (bcc: CyberTech/CTCS)
        Subject:        Re: Linux Trace Toolkit for kernel auditing



On Sat, 10 Jun 2000, you wrote:
> OK, before anyone replies to this and says that I'm way off
> and yadi ... yadi ... yada ... about the fact that kernel audit
> isn't about inserting new stuff in the kernel ... read until
> the end of the message.

I don't think this is far off the subjects of this list at all.
In fact I think it's perfect.
In two ways:

1. inexperienced users to kernel hacking/auditing could use it for obvious
reasons(auditing, double checking, whatever).

2. Experienced users could use it simply to double check their work.

As long as you and I understand that LTT will never make it into the
kernel, and that you're not trying to get it plugged in either, but simply
advocate it so developers who are auditing can plug it into the src code
they're hacking up could use it. Then no way man. You are totally on the
right track IMHO.

Keep up the awesome work.... And this truely is an excellent idea.

--
Bryan Paxton

"How should I know if it works? That's what beta testers are for. I
          only coded it."
 -- Linus Torvalds.




Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/



Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Sun Jun 11 09:22:06 2000
Received: by humbolt.nl.linux.org id <S92218AbQFKHVc>;
	Sun, 11 Jun 2000 09:21:32 +0200
Received: from mrball.net ([209.85.130.137]:24314 "EHLO arm.mrball.net")
	by humbolt.nl.linux.org with ESMTP id <S92210AbQFKHUx>;
	Sun, 11 Jun 2000 09:20:53 +0200
Received: from mrball.net (todd.mrball.net [192.168.18.3])
	by arm.mrball.net (8.9.3/8.9.3) with ESMTP id AAA05267;
	Sun, 11 Jun 2000 00:20:07 -0700
Message-ID: <39433D9A.A2620902@mrball.net>
Date:   Sun, 11 Jun 2000 00:19:54 -0700
From:   "Todd A. Lyons" <todd@mrball.net>
X-Mailer: Mozilla 4.7 [en] (X11; U; Linux 2.2.14-zip i586)
X-Accept-Language: en
MIME-Version: 1.0
To:     evil7@bellsouth.net, kernel audit <kernel-audit@nl.linux.org>
Subject: Re: Yet another web page layout
References: <00061018073107.00835@sQa.speedbros.org>
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

Bryan Paxton wrote:

> All ideas/bitching/whining/flame/crying/stomping your feet around and
> pulling your hair is appreciated.

Idea:

- <a href="mailto:majordomo@nl.linux.org">
+ <a href="mailto:majordomo@n1.linux.org?body=subscribe%20kernel-audit">
-- 
Blue skies...		Cannonball  	http://www.mrball.net
*       One GUI to rule them all, One GUI to find them        * 
*One GUI to bring them all, and with the blue screen bind them*
*       In the land of Redmond, where the shadows lie.        *

Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Sun Jun 11 09:26:45 2000
Received: by humbolt.nl.linux.org id <S92223AbQFKH0L>;
	Sun, 11 Jun 2000 09:26:11 +0200
Received: from mail1.bna.bellsouth.net ([205.152.150.13]:24997 "EHLO
        mail1.bna.bellsouth.net") by humbolt.nl.linux.org with ESMTP
	id <S92210AbQFKHZb>; Sun, 11 Jun 2000 09:25:31 +0200
Received: from adsl-78-129-55.mem.bellsouth.net (adsl-78-129-55.mem.bellsouth.net [216.78.129.55])
	by mail1.bna.bellsouth.net (3.3.5alt/0.75.2) with ESMTP id DAA21506
	for <kernel-audit@nl.linux.org>; Sun, 11 Jun 2000 03:25:29 -0400 (EDT)
Date:   Sun, 11 Jun 2000 02:21:43 -0500 (CDT)
From:   Bryan Paxton <evil7@bellsouth.net>
X-Sender: evil7@sqa.speedbros.org
To:     kernel-audit@nl.linux.org
Subject: Re: Yet another web page layout
Message-ID: <Pine.LNX.4.21.0006110220360.719-100000@sqa.speedbros.org>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

On Sun, 11 Jun 2000, Todd A. Lyons wrote:
> Bryan Paxton wrote:
> 
> > All ideas/bitching/whining/flame/crying/stomping your feet around and
> > pulling your hair is appreciated.
> 
> Idea:
> 
> - <a href="mailto:majordomo@nl.linux.org">
> + <a href="mailto:majordomo@n1.linux.org?body=subscribe%20kernel-audit">
> -- 
> Blue skies...		Cannonball  	http://www.mrball.net
> *       One GUI to rule them all, One GUI to find them        * 
> *One GUI to bring them all, and with the blue screen bind them*
> *       In the land of Redmond, where the shadows lie.        *

: )
Done.

-- 
Bryan Paxton

"How should I know if it works? That's what beta testers are for. I
          only coded it."
 -- Linus Torvalds.





Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Sun Jun 11 09:36:25 2000
Received: by humbolt.nl.linux.org id <S92225AbQFKHfw>;
	Sun, 11 Jun 2000 09:35:52 +0200
Received: from octopus.phy.bg.ac.yu ([147.91.80.4]:23606 "EHLO
        octopus.phy.bg.ac.yu") by humbolt.nl.linux.org with ESMTP
	id <S92210AbQFKHfU>; Sun, 11 Jun 2000 09:35:20 +0200
Received: (from lynx@localhost)
	by octopus.phy.bg.ac.yu (8.9.0/8.9.0) id JAA15886;
	Sun, 11 Jun 2000 09:35:23 +0200
Date:   Sun, 11 Jun 2000 09:35:23 +0200
From:   Boris Dragovic <lynx@phy.bg.ac.yu>
Message-Id: <200006110735.JAA15886@octopus.phy.bg.ac.yu>
To:     ammonton@cc.helsinki.fi, kernel-audit@nl.linux.org
Subject: Re: Starting point
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

I think we shouldn't audit 2.0 kernels because they are too far behind and
it would ask for too many people and it would be too slow. I think we
should concentrate on upcoming 2.4 and latest 2.2.16...

 lynx


Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Sun Jun 11 09:40:04 2000
Received: by humbolt.nl.linux.org id <S92227AbQFKHjV>;
	Sun, 11 Jun 2000 09:39:21 +0200
Received: from ip172.gte26.rb1.bel.nwlink.com ([207.202.207.172]:26116 "EHLO
        speedbros.org") by humbolt.nl.linux.org with ESMTP
	id <S92210AbQFKHik>; Sun, 11 Jun 2000 09:38:40 +0200
Received: from evil7 by speedbros.org with local (Exim 3.12 #1 (Debian))
	id 1312KB-0000S7-00
	for <kernel-audit@nl.linux.org>; Sun, 11 Jun 2000 00:38:27 -0700
To:     kernel-audit@nl.linux.org
Subject: Spam test
Message-Id: <E1312KB-0000S7-00@speedbros.org>
From:   THE INFAMOUS <evil7@speedbros.org>
Date:   Sun, 11 Jun 2000 00:38:27 -0700
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

Spam Test

Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Sun Jun 11 09:41:25 2000
Received: by humbolt.nl.linux.org id <S92229AbQFKHk2>;
	Sun, 11 Jun 2000 09:40:28 +0200
Received: from post-10.mail.nl.demon.net ([194.159.73.20]:52611 "EHLO
        post.mail.nl.demon.net") by humbolt.nl.linux.org with ESMTP
	id <S92210AbQFKHjg>; Sun, 11 Jun 2000 09:39:36 +0200
Received: from [212.238.27.16] (helo=heineken.thuis.knoware.nl)
	by post.mail.nl.demon.net with esmtp (Exim 3.14 #2)
	id 1312LH-0000xQ-00; Sun, 11 Jun 2000 07:39:35 +0000
Content-Length: 285
Message-ID: <XFMail.20000611094011.ak@mmohlmann.demon.nl>
X-Mailer: XFMail 1.4.4 on Linux
X-Priority: 3 (Normal)
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 8bit
MIME-Version: 1.0
In-Reply-To: <20000611012143.A277@cyberzone.net>
Date:   Sun, 11 Jun 2000 09:40:11 +0200 (CEST)
From:   Mathijs <ak@mmohlmann.demon.nl>
To:     mshobe@snet.net
Subject: Re: Starting point
Cc:     kernel-audit@nl.linux.org
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list


On 11-Jun-2000 mshobe@snet.net wrote:
> http://www.whitefang.com/sup/

This is for secure programming in user space. We are looking for secure
programming in kernel space.

It's still a good start though, a buffer overrun is a buffer overrun. User or
kernel space alike.

        me


Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Sun Jun 11 09:53:07 2000
Received: by humbolt.nl.linux.org id <S92228AbQFKHwb>;
	Sun, 11 Jun 2000 09:52:31 +0200
Received: from ns2.dynup.net ([207.194.55.252]:44296 "EHLO wizard.dynup.net")
	by humbolt.nl.linux.org with ESMTP id <S92210AbQFKHv7>;
	Sun, 11 Jun 2000 09:51:59 +0200
Received: (from slaker@localhost)
	by wizard.dynup.net (8.9.3/8.8.7) id AAA24308
	for kernel-audit@nl.linux.org; Sun, 11 Jun 2000 00:51:19 -0700
Date:   Sun, 11 Jun 2000 00:51:19 -0700
From:   Slaker <slaker@wizard.dynup.net>
Message-Id: <200006110751.AAA24308@wizard.dynup.net>
To:     kernel-audit@nl.linux.org
Subject: Another
   spam test
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

Another Spam test

Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Sun Jun 11 12:38:41 2000
Received: by humbolt.nl.linux.org id <S92210AbQFKKh4>;
	Sun, 11 Jun 2000 12:37:56 +0200
Received: from lemuria.borgfelde.ricardo.de ([195.244.103.65]:30222 "HELO
        mail.lemuria.org") by humbolt.nl.linux.org with SMTP
	id <S92166AbQFKKhk>; Sun, 11 Jun 2000 12:37:40 +0200
Received: from lemuria.org by mail.lemuria.org
	via rsmtp with bsmtp
	id <m13154r-0015wSC@mail.lemuria.org>
	for <kernel-audit@nl.linux.org>; Sun, 11 Jun 2000 12:34:49 +0200 (MEST)
	(Smail-3.2 1996-Jul-4 #1 built 1999-Nov-8)
Received: by lemuria.org
	via sendmail with stdio
	id <m1312aZ-000HinC@lemuria.org>
	for kernel-audit@nl.linux.org; Sun, 11 Jun 2000 09:55:23 +0200 (MEST)
	(Smail-3.2 1996-Jul-4 #1 built 1999-Nov-8)
Date:   Sun, 11 Jun 2000 09:55:23 +0200
From:   Tom Vogt <tom@lemuria.org>
To:     kernel-audit@nl.linux.org
Subject: Re: A place to start
Message-ID: <20000611095523.E19971@lemuria.org>
References: <91468650040FD411A51100104B63E23123AFD8@postman.chi.navtech.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
X-Mailer: Mutt 1.0pre3i
In-Reply-To: <91468650040FD411A51100104B63E23123AFD8@postman.chi.navtech.com>
X-Privacy: If you can, please encrypt your mails - finger for key
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

"Bechtolsheim, Stephan" <sbechtol@chi.navtech.com> wrote:
> 1. Use the newest kernel

this means keeping up with changes. of which there's quite a lot between
Linux kernels releases.

the other alternative is freezing it. choose one specific kernel and audit
that.


-- 
Welcome to the Information Superspyway

Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Sun Jun 11 12:39:48 2000
Received: by humbolt.nl.linux.org id <S92166AbQFKKiK>;
	Sun, 11 Jun 2000 12:38:10 +0200
Received: from lemuria.borgfelde.ricardo.de ([195.244.103.65]:29966 "HELO
        mail.lemuria.org") by humbolt.nl.linux.org with SMTP
	id <S92192AbQFKKhj>; Sun, 11 Jun 2000 12:37:39 +0200
Received: from lemuria.org by mail.lemuria.org
	via rsmtp with bsmtp
	id <m13154r-0015wQC@mail.lemuria.org>
	for <kernel-audit@nl.linux.org>; Sun, 11 Jun 2000 12:34:49 +0200 (MEST)
	(Smail-3.2 1996-Jul-4 #1 built 1999-Nov-8)
Received: by lemuria.org
	via sendmail with stdio
	id <m1312QZ-000HinC@lemuria.org>
	for kernel-audit@nl.linux.org; Sun, 11 Jun 2000 09:45:03 +0200 (MEST)
	(Smail-3.2 1996-Jul-4 #1 built 1999-Nov-8)
Date:   Sun, 11 Jun 2000 09:45:03 +0200
From:   Tom Vogt <tom@lemuria.org>
To:     kernel-audit@nl.linux.org
Subject: Re: where to start?
Message-ID: <20000611094503.D19971@lemuria.org>
References: <Pine.LNX.4.21.0006091943150.31358-100000@duckman.distro.conectiva>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
X-Mailer: Mutt 1.0pre3i
In-Reply-To: <Pine.LNX.4.21.0006091943150.31358-100000@duckman.distro.conectiva>
X-Privacy: If you can, please encrypt your mails - finger for key
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

Rik van Riel <riel@conectiva.com.br> wrote:
> Does anybody have some ideas on where we should start?

there's a good collection of automated tools out there that checks for
suspicious code passages. starting there might be a good idea since it
points you to the areas that need attention.
of course, especially security bugs won't all be found with this method, so
you still have to look for yourself.


-- 
Welcome to the Information Superspyway

Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Sun Jun 11 12:40:59 2000
Received: by humbolt.nl.linux.org id <S92192AbQFKKif>;
	Sun, 11 Jun 2000 12:38:35 +0200
Received: from lemuria.borgfelde.ricardo.de ([195.244.103.65]:29710 "HELO
        mail.lemuria.org") by humbolt.nl.linux.org with SMTP
	id <S92190AbQFKKhj>; Sun, 11 Jun 2000 12:37:39 +0200
Received: from lemuria.org by mail.lemuria.org
	via rsmtp with bsmtp
	id <m13154r-0015wOC@mail.lemuria.org>
	for <kernel-audit@nl.linux.org>; Sun, 11 Jun 2000 12:34:49 +0200 (MEST)
	(Smail-3.2 1996-Jul-4 #1 built 1999-Nov-8)
Received: by lemuria.org
	via sendmail with stdio
	id <m1312OU-000HinC@lemuria.org>
	for kernel-audit@nl.linux.org; Sun, 11 Jun 2000 09:42:54 +0200 (MEST)
	(Smail-3.2 1996-Jul-4 #1 built 1999-Nov-8)
Date:   Sun, 11 Jun 2000 09:42:54 +0200
From:   Tom Vogt <tom@lemuria.org>
To:     kernel-audit@nl.linux.org
Subject: Re: OpenBSD
Message-ID: <20000611094254.C19971@lemuria.org>
References: <20000609153326.G1970@optitech.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
X-Mailer: Mutt 1.0pre3i
In-Reply-To: <20000609153326.G1970@optitech.com>
X-Privacy: If you can, please encrypt your mails - finger for key
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

Ray L <rayl@optitech.com> wrote:
> just heard about this list, and it sounds like a great idea.  i think OpenBSD
> has done this exact thing a few years back, and has been actively auditing code
> changes ever since with good results.  it may be worth investigating their
> approach.  they do have a wider scope since they also audit the entire
> userspace codebase.

there's another project (Linux Security Audit Project - lsap.org) to do
this last thing, and two distributions are standing by to use whatever
comes out of both projects. (kha0s, and the one I'm with, Nexus -
http://Nexus-Project.net)

maybe we CAN bring Linux up to par with OpenBSD. I'm all for trying.

-- 
Welcome to the Information Superspyway

Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Sun Jun 11 12:46:29 2000
Received: by humbolt.nl.linux.org id <S92211AbQFKKpz>;
	Sun, 11 Jun 2000 12:45:55 +0200
Received: from mirrors.planetinternet.be ([194.119.238.163]:54031 "EHLO
        mirrors.planetinternet.be") by humbolt.nl.linux.org with ESMTP
	id <S92190AbQFKKp1>; Sun, 11 Jun 2000 12:45:27 +0200
Received: from dialup.eunet.be (postfix@u212-239-148-64.dialup.planetinternet.be [212.239.148.64])
	by mirrors.planetinternet.be (8.10.1/8.10.0) with ESMTP id e5BAjF423347;
	Sun, 11 Jun 2000 12:45:15 +0200
Received: by dialup.eunet.be (Postfix, from userid 501)
	id 4B1B026202; Sun, 11 Jun 2000 12:45:14 +0200 (CEST)
Date:   Sun, 11 Jun 2000 12:45:14 +0200
From:   Kurt Roeckx <Q@ping.be>
To:     cybertech@cybertech.org
Cc:     kernel-audit@nl.linux.org
Subject: Re: Linux Trace Toolkit for kernel auditing (and thoughts)
Message-ID: <20000611124514.A1050@ping.be>
References: <OF77EC7CFD.2FA093C0-ON882568FB.001CF61E@ctcs.net>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
X-Mailer: Mutt 1.0pre2i
In-Reply-To: <OF77EC7CFD.2FA093C0-ON882568FB.001CF61E@ctcs.net>
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

On Sun, Jun 11, 2000 at 05:50:04AM +0000, cybertech@cybertech.org wrote:
> A tool I've run across, but haven't yet used, is a run-time bounds 
> checking 
> patch for GCC.  I don't know about the viability of a kernel built with 
> this patch, but it might be 
> interesting -- http://web.inter.nl.net/hcc/Haj.Ten.Brugge

I've tried compiling it with that patch before, but I don't know enough
about the kernel to make it work, or that can be made to work at all.

It should probably made to work with the slab allocater, and things like
that. It overrides alot of libc functions, which now should become kernel
functions ...

It's a very great tool to find certain types of bugs. I use this on all
software I write. It's really slow tho.

If someone makes it work, I'm very happy to run it.


Anyway, I think that a good audit starts by documenting all kernel
functions properly. What it should do, what is the (allowed) input,
output, what can change, what is the return value in what case.

I don't really care where we start, as long as we start :)


Kurt

Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Sun Jun 11 13:48:30 2000
Received: by humbolt.nl.linux.org id <S92190AbQFKLr5>;
	Sun, 11 Jun 2000 13:47:57 +0200
Received: from lemuria.borgfelde.ricardo.de ([195.244.103.65]:48142 "HELO
        mail.lemuria.org") by humbolt.nl.linux.org with SMTP
	id <S92214AbQFKLrd>; Sun, 11 Jun 2000 13:47:33 +0200
Received: from lemuria.org by mail.lemuria.org
	via rsmtp with bsmtp
	id <m13161j-0015vlC@mail.lemuria.org>
	for <kernel-audit@nl.linux.org>; Sun, 11 Jun 2000 13:35:39 +0200 (MEST)
	(Smail-3.2 1996-Jul-4 #1 built 1999-Nov-8)
Received: by lemuria.org
	via sendmail with stdio
	id <m1315ts-000HinC@lemuria.org>
	for kernel-audit@nl.linux.org; Sun, 11 Jun 2000 13:27:32 +0200 (MEST)
	(Smail-3.2 1996-Jul-4 #1 built 1999-Nov-8)
Date:   Sun, 11 Jun 2000 13:27:32 +0200
From:   Tom Vogt <tom@lemuria.org>
To:     kernel-audit@nl.linux.org
Subject: Re: Starting point
Message-ID: <20000611132732.F19971@lemuria.org>
References: <Pine.LNX.4.21.0006101933480.1685-100000@sqa.speedbros.org> <3942E8F3.nailF47118D3E@ed.ed>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
X-Mailer: Mutt 1.0pre3i
In-Reply-To: <3942E8F3.nailF47118D3E@ed.ed>
X-Privacy: If you can, please encrypt your mails - finger for key
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

root <evpopkov@carry.neonet.lv> wrote:
>  Of course,  in this case  roadmap can be  more complicated, but  it's well
> worth it IMHO.  I believe it's easier and more  consistent to take signal.c
> from every kernel  we have at our  disposal and dissect it to  see how it's
> written, to study  its evolution and to identify possible  problems by code
> comparison.

that's what you usually do in a code audit - take an old version and go
from there, trying to understand the reason behind every change.

the only problem with that approach is that for a program as complex as the
Linux kernel, it'll take a looong time.


-- 
Welcome to the Information Superspyway

Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Sun Jun 11 15:19:09 2000
Received: by humbolt.nl.linux.org id <S92166AbQFKNS1>;
	Sun, 11 Jun 2000 15:18:27 +0200
Received: from smtp.kolej.mff.cuni.cz ([195.113.25.225]:46854 "EHLO
        smtp.kolej.mff.cuni.cz") by humbolt.nl.linux.org with ESMTP
	id <S92192AbQFKNR7>; Sun, 11 Jun 2000 15:17:59 +0200
Received: from p75.kolej.mff.cuni.cz (p75.kolej.mff.cuni.cz [195.113.27.52])
	by smtp.kolej.mff.cuni.cz (8.9.2/8.9.0) with ESMTP id PAA20401
	for <kernel-audit@nl.linux.org>; Sun, 11 Jun 2000 15:17:55 +0200 (CEST)
Received: by p75.kolej.mff.cuni.cz (Postfix, from userid 500)
	id 96BED21D5; Sun, 11 Jun 2000 15:17:51 +0200 (CEST)
Date:   Sun, 11 Jun 2000 15:17:50 +0200
From:   Martin Macok <martin.macok@underground.cz>
To:     kernel-audit@nl.linux.org
Subject: Re: Starting point
Message-ID: <20000611151750.E1003@p75.kolej.mff.cuni.cz>
Reply-To: macok@kocour.ms.mff.cuni.cz
Mail-Followup-To: kernel-audit@nl.linux.org
References: <Pine.OSF.4.20.0006110256140.7686-100000@vesuri.Helsinki.FI>
Mime-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-md5;
	protocol="application/pgp-signature"; boundary="kVXhAStRUZ/+rrGn"
Content-Disposition: inline
User-Agent: Mutt/1.2i
In-Reply-To: <Pine.OSF.4.20.0006110256140.7686-100000@vesuri.Helsinki.FI>; from ammonton@cc.helsinki.fi on Sun, Jun 11, 2000 at 03:00:54AM +0300
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list


--kVXhAStRUZ/+rrGn
Content-Type: text/plain; charset=iso-8859-2
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Sun, Jun 11, 2000 at 03:00:54AM +0300, Anders M Montonen wrote:
> - Because the Linux development model differs so much from the *BSD
> one, most methods can probably not be applied directly to this project.

I could not imagine the OpenBSD way in Linux development process.

OpenBSD release 1-2 kernels a year and they DOESN'T release anything that
WASN'T audited ... (security, stability, correctness, paranoia)

Linux release a kernel every week/month/day and they release almost
everything that seemes to work ... (speed, hardware support, stability)

I can't imagine way to audit all of 'their' changes.

Maybe choose ONE current release and audit it perfectly and then=20
 - say to kernel-hackers "we have audited 2.x.y, we found this, this and
   that ... our 2.x.y-audited version/patch is here and please try to
   'merge' it into current/new releases"
 - then go along every change to current release and audit it OR
 - choose one release a year and create audited version (remove broken
   drivers, dangerous/untrusted things etc...)

> - The LKAP should also work preventively by improving kernel (interface)
> documentation and authoring documents on writing safe code.

IMHO this is a right(tm) place to start! Create REAL kernel documentation,
document interfaces, routines, principles, functions and structures - this
would be even good for newbies and prevention of misuse ... Auditing
would be a 'side effect' of this process.

Have a nice day

--=20
< Martin Ma=E8ok        martin.macok@underground.cz           <iso-8859-2>=
=20
  \\  http://kocour.ms.mff.cuni.cz/~macok/  http://underground.cz/  //
    \\\             -=3D  t.r.u.s.t  n.0  o.n.e  =3D-                ///

--kVXhAStRUZ/+rrGn
Content-Type: application/pgp-signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.1 (GNU/Linux)
Comment: For info see http://www.gnupg.org

iD8DBQE5Q5F99uSLtLrzBfMRAgz8AKCLdwB2QIeLXFyP2hdprP77mPXm1gCfWLOg
Fw1GreR3N4iv5aJboTwA0XE=
=wXH7
-----END PGP SIGNATURE-----

--kVXhAStRUZ/+rrGn--

Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Sun Jun 11 15:36:12 2000
Received: by humbolt.nl.linux.org id <S92211AbQFKNf0>;
	Sun, 11 Jun 2000 15:35:26 +0200
Received: from brutus.conectiva.com.br ([200.250.58.146]:55543 "EHLO
        duckman.distro.conectiva") by humbolt.nl.linux.org with ESMTP
	id <S92198AbQFKNfF>; Sun, 11 Jun 2000 15:35:05 +0200
Received: from localhost (riel@localhost)
	by duckman.distro.conectiva (8.9.3/8.8.7) with ESMTP id KAA16330;
	Sun, 11 Jun 2000 10:34:28 -0300
X-Authentication-Warning: duckman.distro.conectiva: riel owned process doing -bs
Date:   Sun, 11 Jun 2000 10:34:28 -0300 (BRST)
From:   Rik van Riel <riel@conectiva.com.br>
X-Sender: riel@duckman.distro.conectiva
To:     THE INFAMOUS <evil7@speedbros.org>
cc:     kernel-audit@nl.linux.org
Subject: Re: Spam test
In-Reply-To: <E1312KB-0000S7-00@speedbros.org>
Message-ID: <Pine.LNX.4.21.0006111032330.16243-100000@duckman.distro.conectiva>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

On Sun, 11 Jun 2000, THE INFAMOUS wrote:

> Spam Test

NL.linux.org has the spam filters pretty tight. On eg. the
linux-utf8 mailing list I've seen 2 spams in the period of
more than half a year...

I don't think you should worry about this. Crossposts from
non-members to eg. bugtraq and our list are IMHO more valuable
than trying to cut down on spam by cutting legitimate content
as well.

regards,

Rik
--
The Internet is not a network of computers. It is a network
of people. That is its real strength.

Wanna talk about the kernel?  irc.openprojects.net / #kernelnewbies
http://www.conectiva.com/		http://www.surriel.com/


Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Sun Jun 11 16:33:22 2000
Received: by humbolt.nl.linux.org id <S92225AbQFKOcj>;
	Sun, 11 Jun 2000 16:32:39 +0200
Received: from brutus.conectiva.com.br ([200.250.58.146]:28658 "EHLO
        duckman.distro.conectiva") by humbolt.nl.linux.org with ESMTP
	id <S92218AbQFKOcC>; Sun, 11 Jun 2000 16:32:02 +0200
Received: from localhost (riel@localhost)
	by duckman.distro.conectiva (8.9.3/8.8.7) with ESMTP id LAA16572;
	Sun, 11 Jun 2000 11:30:02 -0300
X-Authentication-Warning: duckman.distro.conectiva: riel owned process doing -bs
Date:   Sun, 11 Jun 2000 11:30:02 -0300 (BRST)
From:   Rik van Riel <riel@conectiva.com.br>
X-Sender: riel@duckman.distro.conectiva
To:     Bryan Paxton <evil7@bellsouth.net>
cc:     kernel-audit@nl.linux.org
Subject: kernelnewbies (was: Re: Starting point)
In-Reply-To: <Pine.LNX.4.21.0006102221240.2038-100000@sqa.speedbros.org>
Message-ID: <Pine.LNX.4.21.0006111127220.16243-100000@duckman.distro.conectiva>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

On Sat, 10 Jun 2000, Bryan Paxton wrote:

> If you're new to kernel hacking/developing I suggest these two
> mediums as to becoming familar with it all:
> 
> 1) echo subscribe kernelnewbies | mail majordomo@.nl.linux.org
> 2) Connect to irc.openprojects with your favorite irc client and
>    /join #kernelnewbies

It should be said that kernelnewbies is primarily an IRC
community, with some useful links on the website.

	http://kernelnewbies.org/

Don't expect too many exciting things to happen on the
mailing list, most stuff is being done on IRC :)

regards,

Rik
--
The Internet is not a network of computers. It is a network
of people. That is its real strength.

Wanna talk about the kernel?  irc.openprojects.net / #kernelnewbies
http://www.conectiva.com/		http://www.surriel.com/


Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Sun Jun 11 16:58:44 2000
Received: by humbolt.nl.linux.org id <S92227AbQFKO6A>;
	Sun, 11 Jun 2000 16:58:00 +0200
Received: from herd.plethora.net ([205.166.146.1]:40908 "EHLO
        herd.plethora.net") by humbolt.nl.linux.org with ESMTP
	id <S92218AbQFKO52>; Sun, 11 Jun 2000 16:57:28 +0200
Received: from cu.mol.plethora.net (cu.mol.plethora.net [205.166.146.50])
	by herd.plethora.net (8.9.0/8.9.0) with ESMTP id JAA10647;
	Sun, 11 Jun 2000 09:57:24 -0500 (CDT)
Received: from localhost (dante@localhost)
	by cu.mol.plethora.net (8.9.3/8.9.3/Debian 8.9.3-6) with ESMTP id JAA01924;
	Sun, 11 Jun 2000 09:44:09 -0500
Date:   Sun, 11 Jun 2000 09:44:09 -0500 (CDT)
From:   Daniel Taylor <dante@plethora.net>
X-Sender: dante@cu.mol.plethora.net
To:     Tom Vogt <tom@lemuria.org>
cc:     kernel-audit@nl.linux.org
Subject: Re: A place to start
In-Reply-To: <20000611095523.E19971@lemuria.org>
Message-ID: <Pine.LNX.4.10.10006110930260.1887-100000@cu.mol.plethora.net>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

On the contrary, if we can get enough eyes it gets better.

200 people, 4500 .c and .h files, that's about 23 files per person.

Yuk.
That's a lot of code to look at, but since more than half of this
is in the .h files that means an average of 10 .c files per person.

Still quite a bit of work, but doable as long as things are blocked
up by subsystem. Only about a quarter of the total [ch] files are drivers,
so if we focus on a particular architecture first, it is possible that we
can get useful work done with fewer people or fewer files per person.


Daniel Taylor                Embedded and custom Linux integration.
dante@plethora.net           (612)747-1609

On Sun, 11 Jun 2000, Tom Vogt wrote:

> "Bechtolsheim, Stephan" <sbechtol@chi.navtech.com> wrote:
> > 1. Use the newest kernel
> 
> this means keeping up with changes. of which there's quite a lot between
> Linux kernels releases.
> 
> the other alternative is freezing it. choose one specific kernel and audit
> that.
> 
> 
> -- 
> Welcome to the Information Superspyway
> 
> Kernel-audit:  discussion list for security and the linux kernel
> Archive:       http://mail.nl.linux.org/kernel-audit/
> 


Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Sun Jun 11 19:35:56 2000
Received: by humbolt.nl.linux.org id <S92233AbQFKRfS>;
	Sun, 11 Jun 2000 19:35:18 +0200
Received: from cafe.affinity-systems.ab.ca ([139.142.10.12]:48391 "EHLO
        cafe.affinity-systems.ab.ca") by humbolt.nl.linux.org with ESMTP
	id <S92230AbQFKRez>; Sun, 11 Jun 2000 19:34:55 +0200
Received: (from jbourne@localhost)
	by cafe.affinity-systems.ab.ca (8.9.3/8.9.3/asi-redhat) id LAA14049;
	Sun, 11 Jun 2000 11:34:21 -0600
Date:   Sun, 11 Jun 2000 11:34:21 -0600 (MDT)
From:   James Bourne <jbourne@affinity-systems.ab.ca>
To:     Tom Vogt <tom@lemuria.org>
cc:     kernel-audit@nl.linux.org
Subject: Re: A place to start
In-Reply-To: <20000611095523.E19971@lemuria.org>
Message-ID: <Pine.LNX.4.10.10006111129480.13811-100000@cafe.affinity-systems.ab.ca>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

On Sun, 11 Jun 2000, Tom Vogt wrote:

> "Bechtolsheim, Stephan" <sbechtol@chi.navtech.com> wrote:
> > 1. Use the newest kernel
> 
> this means keeping up with changes. of which there's quite a lot between
> Linux kernels releases.
> 
> the other alternative is freezing it. choose one specific kernel and audit
> that.

But freezing it means a problem can slip into a newer kernel which is
possibly going to be more widely used then the one we audit.

Keeping up with changes isn't as hard as it sounds I would think.  For
example, if the block device drivers were audited once, then it would only
mean looking at the relevent changes of those drivers for new problems which
are introduced.  Also, monitoring what is going through linux-kernel will
keep an edge on what is coming up...  

Just my 2 bits, not trying to say it's an easy task by no means.

Regards,
Jim

-- 
James Bourne                  | Email:  jbourne@affinity-systems.ab.ca
Affinity Systems Inc.         | WWW: http://www.affinity-systems.ab.ca
Everything Linux              | Linux:  The choice of a GNU generation
----------------------------------------------------------------------
Unix System Administration, System programming, Network Administration


Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Sun Jun 11 19:41:15 2000
Received: by humbolt.nl.linux.org id <S92230AbQFKRkb>;
	Sun, 11 Jun 2000 19:40:31 +0200
Received: from cafe.affinity-systems.ab.ca ([139.142.10.12]:49159 "EHLO
        cafe.affinity-systems.ab.ca") by humbolt.nl.linux.org with ESMTP
	id <S92229AbQFKRkL>; Sun, 11 Jun 2000 19:40:11 +0200
Received: (from jbourne@localhost)
	by cafe.affinity-systems.ab.ca (8.9.3/8.9.3/asi-redhat) id LAA14060;
	Sun, 11 Jun 2000 11:39:52 -0600
Date:   Sun, 11 Jun 2000 11:39:52 -0600 (MDT)
From:   James Bourne <jbourne@affinity-systems.ab.ca>
To:     macok@kocour.ms.mff.cuni.cz
cc:     kernel-audit@nl.linux.org
Subject: Re: Starting point
In-Reply-To: <20000611151750.E1003@p75.kolej.mff.cuni.cz>
Message-ID: <Pine.LNX.4.10.10006111136410.13811-100000@cafe.affinity-systems.ab.ca>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

On Sun, 11 Jun 2000, Martin Macok wrote:

> I could not imagine the OpenBSD way in Linux development process.
> 
> OpenBSD release 1-2 kernels a year and they DOESN'T release anything that
> WASN'T audited ... (security, stability, correctness, paranoia)
> 
> Linux release a kernel every week/month/day and they release almost
> everything that seemes to work ... (speed, hardware support, stability)
> 
> I can't imagine way to audit all of 'their' changes.

What if we based audits on only stable kernels, not development kernels. 
There's normaly a few weeks bettween stable kernel releases which would mean
more time to audit fewer changes.

> Maybe choose ONE current release and audit it perfectly and then 
>  - say to kernel-hackers "we have audited 2.x.y, we found this, this and
>    that ... our 2.x.y-audited version/patch is here and please try to
>    'merge' it into current/new releases"
>  - then go along every change to current release and audit it OR
>  - choose one release a year and create audited version (remove broken
>    drivers, dangerous/untrusted things etc...)
> 
> > - The LKAP should also work preventively by improving kernel (interface)
> > documentation and authoring documents on writing safe code.
> 
> IMHO this is a right(tm) place to start! Create REAL kernel documentation,
> document interfaces, routines, principles, functions and structures - this
> would be even good for newbies and prevention of misuse ... Auditing
> would be a 'side effect' of this process.

Agreed here.  Programmers are not technical writers, therefore documentation
is sometimes not near what it should be :)

Jim

> 
> Have a nice day
> 
> 

-- 
James Bourne                  | Email:  jbourne@affinity-systems.ab.ca
Affinity Systems Inc.         | WWW: http://www.affinity-systems.ab.ca
Everything Linux              | Linux:  The choice of a GNU generation
----------------------------------------------------------------------
Unix System Administration, System programming, Network Administration


Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Sun Jun 11 20:48:38 2000
Received: by humbolt.nl.linux.org id <S92234AbQFKSr4>;
	Sun, 11 Jun 2000 20:47:56 +0200
Received: from lemuria.borgfelde.ricardo.de ([195.244.103.65]:58383 "HELO
        mail.lemuria.org") by humbolt.nl.linux.org with SMTP
	id <S92231AbQFKSre>; Sun, 11 Jun 2000 20:47:34 +0200
Received: from lemuria.org by mail.lemuria.org
	via rsmtp with bsmtp
	id <m131Ch0-0015wGC@mail.lemuria.org>
	for <kernel-audit@nl.linux.org>; Sun, 11 Jun 2000 20:42:42 +0200 (MEST)
	(Smail-3.2 1996-Jul-4 #1 built 1999-Nov-8)
Received: by lemuria.org
	via sendmail with stdio
	id <m131CYz-000HinC@lemuria.org>
	for kernel-audit@nl.linux.org; Sun, 11 Jun 2000 20:34:25 +0200 (MEST)
	(Smail-3.2 1996-Jul-4 #1 built 1999-Nov-8)
Date:   Sun, 11 Jun 2000 20:34:25 +0200
From:   Tom Vogt <tom@lemuria.org>
To:     kernel-audit@nl.linux.org
Subject: Re: A place to start
Message-ID: <20000611203425.A21432@lemuria.org>
References: <20000611095523.E19971@lemuria.org> <Pine.LNX.4.10.10006110930260.1887-100000@cu.mol.plethora.net>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
X-Mailer: Mutt 1.0pre3i
In-Reply-To: <Pine.LNX.4.10.10006110930260.1887-100000@cu.mol.plethora.net>
X-Privacy: If you can, please encrypt your mails - finger for key
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

Daniel Taylor <dante@plethora.net> wrote:
> 200 people, 4500 .c and .h files, that's about 23 files per person.

200 is the number of subscribers. expect that a quarter or less are both
capable and willing to contribute.

I include myself in the 3/4, most likely. I have a large project of my own,
so between that and my job and the rest of my life there isn't much time
left.

-- 
Welcome to the Information Superspyway

Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Sun Jun 11 20:54:08 2000
Received: by humbolt.nl.linux.org id <S92235AbQFKSxY>;
	Sun, 11 Jun 2000 20:53:24 +0200
Received: from bravo.whitburn.xcalibre.co.uk ([194.201.48.11]:12556 "EHLO
        bravo.whitburn.xcalibre.co.uk") by humbolt.nl.linux.org with ESMTP
	id <S92232AbQFKSw5>; Sun, 11 Jun 2000 20:52:57 +0200
Received: from bronson (host213-1-88-105.btinternet.com [213.1.88.105])
	by bravo.whitburn.xcalibre.co.uk (8.10.1/8.10.1) with SMTP id e5BIqeX05844
	for <kernel-audit@nl.linux.org>; Sun, 11 Jun 2000 19:52:44 +0100
Message-ID: <02eb01bfd3d6$a2701620$0100a8c0@kermit.dixonsctc.org.uk>
Reply-To: "Greg Sheard" <greg@ecsc.co.uk>
From:   "Greg Sheard" <greg@ecsc.co.uk>
To:     <kernel-audit@nl.linux.org>
References: <20000611095523.E19971@lemuria.org> <Pine.LNX.4.10.10006110930260.1887-100000@cu.mol.plethora.net> <20000611203425.A21432@lemuria.org>
Subject: Re: A place to start
Date:   Sun, 11 Jun 2000 19:54:53 +0100
Organization: e-commerce security consultants
MIME-Version: 1.0
Content-Type: multipart/mixed;
	boundary="----=_NextPart_000_02E6_01BFD3DE.E8D1B080"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 5.00.2919.6700
X-MimeOLE: Produced By Microsoft MimeOLE V5.00.2919.6700
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

This is a multi-part message in MIME format.

------=_NextPart_000_02E6_01BFD3DE.E8D1B080
Content-Type: text/plain;
	charset="iso-8859-1"
Content-Transfer-Encoding: 7bit

Count me in the 1/4... I'm more than happy to audit a bit of code.

Regards,
Greg.
----- Original Message -----
From: "Tom Vogt" <tom@lemuria.org>
To: <kernel-audit@nl.linux.org>
Sent: Sunday, June 11, 2000 7:34 PM
Subject: Re: A place to start


> Daniel Taylor <dante@plethora.net> wrote:
> > 200 people, 4500 .c and .h files, that's about 23 files per person.
>
> 200 is the number of subscribers. expect that a quarter or less are both
> capable and willing to contribute.
>
> I include myself in the 3/4, most likely. I have a large project of my
own,
> so between that and my job and the rest of my life there isn't much time
> left.
>
> --
> Welcome to the Information Superspyway
>
> Kernel-audit:  discussion list for security and the linux kernel
> Archive:       http://mail.nl.linux.org/kernel-audit/
>

------=_NextPart_000_02E6_01BFD3DE.E8D1B080
Content-Type: text/x-vcard;
	name="Greg Sheard.vcf"
Content-Transfer-Encoding: quoted-printable
Content-Disposition: attachment;
	filename="Greg Sheard.vcf"

BEGIN:VCARD
VERSION:2.1
N:Sheard;Greg
FN:Greg Sheard
ORG:ECSC Ltd.
TITLE:Senior Associate
TEL;WORK;VOICE:07788 571368
TEL;WORK;FAX:01535 652572
ADR;WORK;ENCODING=3DQUOTED-PRINTABLE:;;Upper Swain Royd =
Farm=3D0D=3D0AWilsden Road;Bradford;West Yorkshire;BD15 9AD;E=3D
ngland
LABEL;WORK;ENCODING=3DQUOTED-PRINTABLE:Upper Swain Royd =
Farm=3D0D=3D0AWilsden Road=3D0D=3D0ABradford, West Yorkshire BD15 9=3D
AD=3D0D=3D0AEngland
X-WAB-GENDER:2
URL:
URL:http://www.ecsc.co.uk/
EMAIL;PREF;INTERNET:rocky_roller@hotmail.com
REV:20000611T185453Z
END:VCARD

------=_NextPart_000_02E6_01BFD3DE.E8D1B080--


Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Sun Jun 11 22:03:42 2000
Received: by humbolt.nl.linux.org id <S92211AbQFKUDJ>;
	Sun, 11 Jun 2000 22:03:09 +0200
Received: from nifty.blue-labs.org ([208.179.0.193]:49705 "EHLO
        nifty.Blue-Labs.org") by humbolt.nl.linux.org with ESMTP
	id <S92190AbQFKUCZ>; Sun, 11 Jun 2000 22:02:25 +0200
Received: from kalifornia.com (david@localhost [127.0.0.1])
	by nifty.Blue-Labs.org (8.11.0.Beta3/8.11.0.Beta3) with ESMTP id e5BIEoa03442
	for <kernel-audit@nl.linux.org>; Sun, 11 Jun 2000 11:14:50 -0700
Message-ID: <3943D71A.FA3916B4@kalifornia.com>
Date:   Sun, 11 Jun 2000 11:14:50 -0700
From:   David Ford <david@kalifornia.com>
Reply-To: david+validemail@kalifornia.com
Organization: Talon Technology, Intl.
X-Mailer: Mozilla 4.73 [en] (X11; U; Linux 2.4.0-test1-ac12 i686)
X-Accept-Language: en
MIME-Version: 1.0
CC:     kernel-audit@nl.linux.org
Subject: Re: A place to start
References: <91468650040FD411A51100104B63E23123AFD8@postman.chi.navtech.com> <20000611095523.E19971@lemuria.org>
Content-Type: multipart/mixed;
 boundary="------------8235092390169F31C7B98EC5"
To:     unlisted-recipients:; (no To-header on input)
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

This is a multi-part message in MIME format.
--------------8235092390169F31C7B98EC5
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit

If we do it section by section, it's not very hard to keep up, even with
daily releases of kernels.  All we need to do is keep a list of when
"drivers/net/arp.c" was last audited and the md5sum of the file.  As long as
that md5sum doesn't change, the value of our audit remains the same as we
placed on it.

-d
p.s.  can the tail on the list messages include sub/unsub address please?


Tom Vogt wrote:

> "Bechtolsheim, Stephan" <sbechtol@chi.navtech.com> wrote:
> > 1. Use the newest kernel
>
> this means keeping up with changes. of which there's quite a lot between
> Linux kernels releases.
>
> the other alternative is freezing it. choose one specific kernel and audit
> that.

--
"The difference between 'involvement' and 'commitment' is like an
eggs-and-ham breakfast: the chicken was 'involved' - the pig was
'committed'."



--------------8235092390169F31C7B98EC5
Content-Type: text/x-vcard; charset=us-ascii;
 name="david.vcf"
Content-Transfer-Encoding: 7bit
Content-Description: Card for David Ford
Content-Disposition: attachment;
 filename="david.vcf"

begin:vcard 
n:Ford;David
x-mozilla-html:TRUE
org:<img src="http://www.kalifornia.com/images/poweredbylinux.gif">
adr:;;;;;;
version:2.1
email;internet:david@kalifornia.com
title:Blue Labs Developer
x-mozilla-cpt:;-26528
fn:David Ford
end:vcard

--------------8235092390169F31C7B98EC5--


Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Sun Jun 11 22:08:01 2000
Received: by humbolt.nl.linux.org id <S92230AbQFKUHS>;
	Sun, 11 Jun 2000 22:07:18 +0200
Received: from nifty.blue-labs.org ([208.179.0.193]:50729 "EHLO
        nifty.Blue-Labs.org") by humbolt.nl.linux.org with ESMTP
	id <S92190AbQFKUGx>; Sun, 11 Jun 2000 22:06:53 +0200
Received: from kalifornia.com (david@localhost [127.0.0.1])
	by nifty.Blue-Labs.org (8.11.0.Beta3/8.11.0.Beta3) with ESMTP id e5BIIfa03452;
	Sun, 11 Jun 2000 11:18:42 -0700
Message-ID: <3943D801.88AA5A43@kalifornia.com>
Date:   Sun, 11 Jun 2000 11:18:41 -0700
From:   David Ford <david@kalifornia.com>
Reply-To: david+validemail@kalifornia.com
Organization: Talon Technology, Intl.
X-Mailer: Mozilla 4.73 [en] (X11; U; Linux 2.4.0-test1-ac12 i686)
X-Accept-Language: en
MIME-Version: 1.0
To:     Rik van Riel <riel@conectiva.com.br>
CC:     kernel-audit@nl.linux.org
Subject: Re: Spam test
References: <Pine.LNX.4.21.0006111032330.16243-100000@duckman.distro.conectiva>
Content-Type: multipart/mixed;
 boundary="------------B6E7FC4ACB7EF25F17B49809"
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

This is a multi-part message in MIME format.
--------------B6E7FC4ACB7EF25F17B49809
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit

I don't know if this list supports it, but an idea I had for my list
software the other day was to add an X-unsubscribed-poster: header if
the post came from someone not on the list.  This can help people toss
possible spam into a quarantine bucket.

-d

Rik van Riel wrote:

> On Sun, 11 Jun 2000, THE INFAMOUS wrote:
>
> > Spam Test
>
> NL.linux.org has the spam filters pretty tight. On eg. the
> linux-utf8 mailing list I've seen 2 spams in the period of
> more than half a year...
>
> I don't think you should worry about this. Crossposts from
> non-members to eg. bugtraq and our list are IMHO more valuable
> than trying to cut down on spam by cutting legitimate content
> as well.

--
"The difference between 'involvement' and 'commitment' is like an
eggs-and-ham breakfast: the chicken was 'involved' - the pig was
'committed'."



--------------B6E7FC4ACB7EF25F17B49809
Content-Type: text/x-vcard; charset=us-ascii;
 name="david.vcf"
Content-Transfer-Encoding: 7bit
Content-Description: Card for David Ford
Content-Disposition: attachment;
 filename="david.vcf"

begin:vcard 
n:Ford;David
x-mozilla-html:TRUE
org:<img src="http://www.kalifornia.com/images/poweredbylinux.gif">
adr:;;;;;;
version:2.1
email;internet:david@kalifornia.com
title:Blue Labs Developer
x-mozilla-cpt:;-26528
fn:David Ford
end:vcard

--------------B6E7FC4ACB7EF25F17B49809--


Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Sun Jun 11 22:13:32 2000
Received: by humbolt.nl.linux.org id <S92231AbQFKUMs>;
	Sun, 11 Jun 2000 22:12:48 +0200
Received: from pandora.binc.net ([208.139.220.11]:881 "EHLO pandora.binc.net")
	by humbolt.nl.linux.org with ESMTP id <S92190AbQFKUMY>;
	Sun, 11 Jun 2000 22:12:24 +0200
Received: from localhost (grice@localhost)
	by pandora.binc.net (8.9.1/8.9.1) with ESMTP id PAA00747
	for <kernel-audit@nl.linux.org>; Sun, 11 Jun 2000 15:12:22 -0500
X-Authentication-Warning: pandora.binc.net: grice owned process doing -bs
Date:   Sun, 11 Jun 2000 15:12:22 -0500 (CDT)
From:   Michael Grice <grice@berbee.com>
X-Sender: grice@pandora.binc.net
To:     kernel-audit@nl.linux.org
Subject: Re: A place to start
In-Reply-To: <20000611203425.A21432@lemuria.org>
Message-ID: <Pine.LNX.4.05.10006111423290.14332-100000@pandora.binc.net>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

At this point, I probably fit into the 3/4 too, but I do have a few
thoughts on the topic:

1) Group the .c and .h files so that:
   a) Files are logically grouped according to function wherever possible
   b) Each group is roughly the same size (i.e., x thousand lines of code,
      where the size is ideally small enough that those of us in the 3/4
      are more likely to be able to contribute)

2) Assign the first set of groups based on priority to the folks in the 1/4

3) Maintain a list of unassigned groups and assign them to the folks who've
   finished their first assignment and anybody else who would like to help

It may also be beneficial to have multiple people look at each section
of code, especially if people are looking at the code from different
perspectives.

I suspect gathering documentation on how to audit kernel code would help
many of us (including me). I have done auditing before in other fields
(I audited pesticide and toxicology studies before they were submitted to
the EPA and FDA), but I've never audited code before. Some of it seems
fairly straightforward (don't use strcpy(), do use boundary checking,
a la the Secure Unix Programming FAQ), but I am not especially clear on
where to start in auditing a particular section of code.

I am willing, however, to compile or help compile a list of guidelines,
especially given some pointers, with the goal of helping people get
started (including myself).  
--Michael

On Sun, 11 Jun 2000, Tom Vogt wrote:

> Daniel Taylor <dante@plethora.net> wrote:
> > 200 people, 4500 .c and .h files, that's about 23 files per person.
> 
> 200 is the number of subscribers. expect that a quarter or less are both
> capable and willing to contribute.
> 
> I include myself in the 3/4, most likely. I have a large project of my own,
> so between that and my job and the rest of my life there isn't much time
> left.
> 
> -- 
> Welcome to the Information Superspyway
> 
> Kernel-audit:  discussion list for security and the linux kernel
> Archive:       http://mail.nl.linux.org/kernel-audit/
> 


Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Sun Jun 11 22:33:42 2000
Received: by humbolt.nl.linux.org id <S92230AbQFKUc7>;
	Sun, 11 Jun 2000 22:32:59 +0200
Received: from mrball.net ([209.85.130.137]:65019 "EHLO arm.mrball.net")
	by humbolt.nl.linux.org with ESMTP id <S92190AbQFKUc1>;
	Sun, 11 Jun 2000 22:32:27 +0200
Received: from mrball.net (todd.mrball.net [192.168.18.3])
	by arm.mrball.net (8.9.3/8.9.3) with ESMTP id NAA05705;
	Sun, 11 Jun 2000 13:32:16 -0700
Message-ID: <3943F742.FE9D8B50@mrball.net>
Date:   Sun, 11 Jun 2000 13:32:02 -0700
From:   "Todd A. Lyons" <todd@mrball.net>
X-Mailer: Mozilla 4.7 [en] (X11; U; Linux 2.2.14-zip i586)
X-Accept-Language: en
MIME-Version: 1.0
To:     david@kalifornia.com, kernel audit <kernel-audit@nl.linux.org>
Subject: Re: Spam test
References: <Pine.LNX.4.21.0006111032330.16243-100000@duckman.distro.conectiva> <3943D801.88AA5A43@kalifornia.com>
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

David Ford wrote:

> I don't know if this list supports it, but an idea I had for my list
> software the other day was to add an X-unsubscribed-poster: header if
> the post came from someone not on the list.  This can help people toss
> possible spam into a quarantine bucket.

That is an excellent idea.  I have forwarded your idea to the Majordomo
mailing list.  There might already be a patch for it.
-- 
Blue skies...		Cannonball  	http://www.mrball.net
*       One GUI to rule them all, One GUI to find them        * 
*One GUI to bring them all, and with the blue screen bind them*
*       In the land of Redmond, where the shadows lie.        *

Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Sun Jun 11 22:51:44 2000
Received: by humbolt.nl.linux.org id <S92232AbQFKUuv>;
	Sun, 11 Jun 2000 22:50:51 +0200
Received: from host13.mucom.co.il ([192.115.216.45]:28942 "EHLO mucom.co.il")
	by humbolt.nl.linux.org with ESMTP id <S92230AbQFKUuV>;
	Sun, 11 Jun 2000 22:50:21 +0200
Received: (from marc@localhost)
	by mucom.co.il (8.9.3/8.9.3) id WAA14580
	for kernel-audit@nl.linux.org; Sun, 11 Jun 2000 22:48:40 -0200
Date:   Sun, 11 Jun 2000 22:48:40 -0200
From:   Marc Esipovich <marc@mucom.co.il>
To:     kernel audit <kernel-audit@nl.linux.org>
Subject: suggestion.
Message-ID: <20000611224840.A14563@darkstar.netvision>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
User-Agent: Mutt/1.2i
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

 Hi everybody, 

	I think the best thing would be to divide the kernel into auditable parts,
most importat portions - directly related to security, should be audited first.
especially parts where well-known bugs were found.

	Here is a small list, please add.

	1.	The binary loaders, a,out, elf...

	2.	In 2.[24].x kernels, the cap stuff. 

	3.	proc filesystem.

	4.	NET (ipv4 for now)

	5.	Filesystem code, mostly DoS and data corruption. this will require
people who know their way around filesystems,  not for the general auditing crowd.
	6.	Stress testing the kernel in every imaginable way is bound to
find *something*, be creative.


	IMHO, the kernel tree which requires the most effort for now is 2.2.
yes, 2.0 is still alive kicking,  but soon enough 2.2 will become the
stable "old" kernel, just like 2.0.  

	We should not be auditing development kernels.


		Marc.

Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Sun Jun 11 23:13:34 2000
Received: by humbolt.nl.linux.org id <S92211AbQFKVMv>;
	Sun, 11 Jun 2000 23:12:51 +0200
Received: from nifty.blue-labs.org ([208.179.0.193]:60969 "EHLO
        nifty.Blue-Labs.org") by humbolt.nl.linux.org with ESMTP
	id <S92230AbQFKVM2>; Sun, 11 Jun 2000 23:12:28 +0200
Received: from kalifornia.com (david@localhost [127.0.0.1])
	by nifty.Blue-Labs.org (8.11.0.Beta3/8.11.0.Beta3) with ESMTP id e5BJOla03524
	for <kernel-audit@nl.linux.org>; Sun, 11 Jun 2000 12:24:47 -0700
Message-ID: <3943E77F.CC0A461C@kalifornia.com>
Date:   Sun, 11 Jun 2000 12:24:47 -0700
From:   David Ford <david@kalifornia.com>
Reply-To: david+validemail@kalifornia.com
Organization: Talon Technology, Intl.
X-Mailer: Mozilla 4.73 [en] (X11; U; Linux 2.4.0-test1-ac12 i686)
X-Accept-Language: en
MIME-Version: 1.0
To:     kernel-audit@nl.linux.org
Subject: Re: suggestion.
References: <20000611224840.A14563@darkstar.netvision>
Content-Type: multipart/mixed;
 boundary="------------6B13EFAD1504D69F44E30ECA"
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

This is a multi-part message in MIME format.
--------------6B13EFAD1504D69F44E30ECA
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit

I differ in opinion here, 2.2 is full of bugs which have been fixed in 2.3/2.4.  I
suggest we start with the most current code base.  There is little merit in
duplicating work that has already been done.  2.4 is at the door, almost ready to
walk.

-d

Marc Esipovich wrote:

>  Hi everybody,
>
>         I think the best thing would be to divide the kernel into auditable parts,
> most importat portions - directly related to security, should be audited first.
> especially parts where well-known bugs were found.
>
>         Here is a small list, please add.
>
>         1.      The binary loaders, a,out, elf...
>
>         2.      In 2.[24].x kernels, the cap stuff.
>
>         3.      proc filesystem.
>
>         4.      NET (ipv4 for now)
>
>         5.      Filesystem code, mostly DoS and data corruption. this will require
> people who know their way around filesystems,  not for the general auditing crowd.
>         6.      Stress testing the kernel in every imaginable way is bound to
> find *something*, be creative.
>
>         IMHO, the kernel tree which requires the most effort for now is 2.2.
> yes, 2.0 is still alive kicking,  but soon enough 2.2 will become the
> stable "old" kernel, just like 2.0.
>
>         We should not be auditing development kernels.
>
>                 Marc.

--
"The difference between 'involvement' and 'commitment' is like an
eggs-and-ham breakfast: the chicken was 'involved' - the pig was
'committed'."



--------------6B13EFAD1504D69F44E30ECA
Content-Type: text/x-vcard; charset=us-ascii;
 name="david.vcf"
Content-Transfer-Encoding: 7bit
Content-Description: Card for David Ford
Content-Disposition: attachment;
 filename="david.vcf"

begin:vcard 
n:Ford;David
x-mozilla-html:TRUE
org:<img src="http://www.kalifornia.com/images/poweredbylinux.gif">
adr:;;;;;;
version:2.1
email;internet:david@kalifornia.com
title:Blue Labs Developer
x-mozilla-cpt:;-26528
fn:David Ford
end:vcard

--------------6B13EFAD1504D69F44E30ECA--


Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Mon Jun 12 00:00:14 2000
Received: by humbolt.nl.linux.org id <S92211AbQFKV7X>;
	Sun, 11 Jun 2000 23:59:23 +0200
Received: from 24.67.12.142.ab.wave.home.com ([24.67.12.142]:24839 "EHLO
        ans.odi.ca") by humbolt.nl.linux.org with ESMTP id <S92230AbQFKV6t>;
	Sun, 11 Jun 2000 23:58:49 +0200
Received: by ans.odi.ca (Postfix, from userid 500)
	id 818194DDD; Sun, 11 Jun 2000 15:58:40 -0600 (MDT)
Received: from localhost (localhost [127.0.0.1])
	by ans.odi.ca (Postfix) with ESMTP id 6BD627C92
	for <kernel-audit@nl.linux.org>; Sun, 11 Jun 2000 15:58:40 -0600 (MDT)
Date:   Sun, 11 Jun 2000 15:58:40 -0600 (MDT)
From:   Darron Froese <darron@froese.org>
X-Sender: darron@ans.odi.ca
To:     kernel-audit@nl.linux.org
Subject: Only auditing current 2.4 code?
Message-ID: <Pine.LNX.4.10.10006111549390.5584-100000@ans.odi.ca>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

Someone had this suggestion (I forgot who and deleted the email) and I
think that that is probably not the correct way to go.

2.4 is still in heavy development and will probably be that way for the
next few months. When it comes out, there will probably be some lag time
between the initial 2.4.0 release and a ready-for-primetime
production-quality release. Then there will be some time after that to
migrate production servers over - if they're even migrated.

2.2 is in use on production servers right now and will be in use for quite
some time. The codebase is pretty stable - there probably aren't going to
be any huge changes (like there will be in 2.4) in the near future.

I think an audit of the 2.2 code would serve quite well as a starting
point. We could:

1. Track that known issues in 2.4 that didn't get back ported to 2.2.
(for whatever reason)
2. Look for other unknown issues and audit away.

There will be plenty of time to audit 2.4 once it's stabilized somewhat -
c'mon, the code freeze was announced in October sometime and it's still
not really frozen. ;-)

Anyways, that's just my 2 cents. I'd love to be able to help but can't
program in C yet.
--
Darron
darron@froese.org


Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Mon Jun 12 00:02:53 2000
Received: by humbolt.nl.linux.org id <S92238AbQFKWBn>;
	Mon, 12 Jun 2000 00:01:43 +0200
Received: from carry.netneo.com ([195.62.128.21]:21767 "EHLO carry.neonet.lv")
	by humbolt.nl.linux.org with ESMTP id <S92240AbQFKWBK>;
	Mon, 12 Jun 2000 00:01:10 +0200
Received: from ed.ed (as0s1.netneo.com [195.62.135.236])
	by carry.neonet.lv (8.9.3/8.9.3) with ESMTP id AAA12557
	for <kernel-audit@nl.linux.org>; Mon, 12 Jun 2000 00:00:45 +0200
Received: (from root@localhost)
	by ed.ed (8.8.7/8.8.5) id VAA00491
	for kernel-audit@nl.linux.org; Sun, 11 Jun 2000 21:31:04 GMT
From:   root <evpopkov@carry.neonet.lv>
Date:   Sun, 11 Jun 2000 21:31:04 +0000
To:     kernel-audit@nl.linux.org
Subject: Re: Starting point
Message-ID: <39440518.nailCS11BM4Y@ed.ed>
References: <Pine.LNX.4.21.0006101933480.1685-100000@sqa.speedbros.org>
 <3942E8F3.nailF47118D3E@ed.ed> <20000611132732.F19971@lemuria.org>
X-Mailer: nail 9.13 2000-05-30
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

> that's what you usually do in a code audit - take an old version and go
> from there, trying to understand the reason behind every change.
>
> the only problem with  that approach is that for a  program as complex as
> the
> Linux kernel, it'll take a looong time.

 I  understand,  or at  least-  pretend  to, all  the  caveats  of the  `by
speciality' approach, compared to `by version' approach.
 However,  the  former  seems  more  preferrable to  me  because  it  gives
better coverage  and concentration. `Speciality' approach  is hidden within
`versioned' audit. Say, we decide to go with 2.4.x, OK. Then we must figure
what to begin with,  will it be core scheduling, or  fs, or networking. Why
can't we  take a particular  subsystem and  examine its evolution  in time,
since older kernels?
 2.0.x is more stable? Contains  less suspicious code fragments? Then we'll
just spend  less time on it  and get faster  to the recent versions.  If we
start with 2.4.x, older versions will fall out of scope forever.


---

 "Teddy - I suppose Mummy and Daddy are real, aren't they?"
 Teddy said, "You ask such silly questions, David. Nobody knows what
'real' really means. Let's go indoors."

 Brian W. Aldiss, Supertoys Last All Summer Long


Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Mon Jun 12 00:28:47 2000
Received: by humbolt.nl.linux.org id <S92232AbQFKW2D>;
	Mon, 12 Jun 2000 00:28:03 +0200
Received: from 24.66.222.70.ab.wave.home.com ([24.66.222.70]:39177 "EHLO
        mail.com") by humbolt.nl.linux.org with ESMTP id <S92230AbQFKW1d>;
	Mon, 12 Jun 2000 00:27:33 +0200
Received: (from rayl@localhost)
	by mail.com (8.9.3/8.9.3) id QAA16950
	for kernel-audit@nl.linux.org; Sun, 11 Jun 2000 16:27:30 -0600
Date:   Sun, 11 Jun 2000 16:27:30 -0600
From:   Ray L <rayl@optitech.com>
To:     kernel-audit@nl.linux.org
Subject: Re: A place to start
Message-ID: <20000611162730.B9330@optitech.com>
References: <91468650040FD411A51100104B63E23123AFD8@postman.chi.navtech.com> <20000611095523.E19971@lemuria.org> <3943D71A.FA3916B4@kalifornia.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
X-Mailer: Mutt 1.0us
In-Reply-To: <3943D71A.FA3916B4@kalifornia.com>; from david@kalifornia.com on Sun, Jun 11, 2000 at 11:14:50AM -0700
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

On Sun, Jun 11, 2000 at 11:14:50AM -0700, David Ford wrote:
> If we do it section by section, it's not very hard to keep up, even with
> daily releases of kernels.  All we need to do is keep a list of when
> "drivers/net/arp.c" was last audited and the md5sum of the file.  As long as
> that md5sum doesn't change, the value of our audit remains the same as we
> placed on it.

not true in general, unfortunately.  a change in another file might prevent
arp.c from even compiling, let alone implementing correct semantics.  md5sums
are certainly valid for a large class of errors, but not all.


-- 
-----------------------------------------------------------------------------
  Ray Lehtiniemi (rayl@mail.com) (rayl@optitech.com)


Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Mon Jun 12 00:35:35 2000
Received: by humbolt.nl.linux.org id <S92234AbQFKWeu>;
	Mon, 12 Jun 2000 00:34:50 +0200
Received: from octopus.phy.bg.ac.yu ([147.91.80.4]:61252 "EHLO
        octopus.phy.bg.ac.yu") by humbolt.nl.linux.org with ESMTP
	id <S92230AbQFKWeZ>; Mon, 12 Jun 2000 00:34:25 +0200
Received: (from lynx@localhost)
	by octopus.phy.bg.ac.yu (8.9.0/8.9.0) id AAA22881
	for kernel-audit@nl.linux.org; Mon, 12 Jun 2000 00:34:43 +0200
Date:   Mon, 12 Jun 2000 00:34:43 +0200
From:   Boris Dragovic <lynx@phy.bg.ac.yu>
Message-Id: <200006112234.AAA22881@octopus.phy.bg.ac.yu>
To:     kernel-audit@nl.linux.org
Subject: RE: suggestion
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list


IMHO, we should start with the latest kernel in order not to do what is
already done...

lynx

Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Mon Jun 12 00:37:24 2000
Received: by humbolt.nl.linux.org id <S92230AbQFKWg2>;
	Mon, 12 Jun 2000 00:36:28 +0200
Received: from cafe.affinity-systems.ab.ca ([139.142.10.12]:46344 "EHLO
        cafe.affinity-systems.ab.ca") by humbolt.nl.linux.org with ESMTP
	id <S92235AbQFKWfr>; Mon, 12 Jun 2000 00:35:47 +0200
Received: (from jbourne@localhost)
	by cafe.affinity-systems.ab.ca (8.9.3/8.9.3/asi-redhat) id QAA26953;
	Sun, 11 Jun 2000 16:35:27 -0600
Date:   Sun, 11 Jun 2000 16:35:26 -0600 (MDT)
From:   James Bourne <jbourne@affinity-systems.ab.ca>
To:     david+validemail@kalifornia.com
cc:     kernel-audit@nl.linux.org
Subject: Re: suggestion.
In-Reply-To: <3943E77F.CC0A461C@kalifornia.com>
Message-ID: <Pine.LNX.4.10.10006111631020.26873-100000@cafe.affinity-systems.ab.ca>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

On Sun, 11 Jun 2000, David Ford wrote:

> I differ in opinion here, 2.2 is full of bugs which have been fixed in
> 2.3/2.4.  I suggest we start with the most current code base.  There is
> little merit in duplicating work that has already been done.  2.4 is at
> the door, almost ready to walk.

I agree with the former.  How many servers which need stability and are too
much of a pain to upgrade are still running a 2.0 kernel?  2.2 will be
around for a long time (it's really just starting to get good and stable
now) and when 2.4 does come out, it will be the same ball of hair, not being
fully accepted until it stablizes.  Anything caught in 2.2 can be of use in
2.4 to some extent at least.

Regards,
Jim

> 
> -d
> 
> Marc Esipovich wrote:
> 
> >  Hi everybody,
> >
> >         I think the best thing would be to divide the kernel into auditable parts,
> > most importat portions - directly related to security, should be audited first.
> > especially parts where well-known bugs were found.
> >
> >         Here is a small list, please add.
> >
> >         1.      The binary loaders, a,out, elf...
> >
> >         2.      In 2.[24].x kernels, the cap stuff.
> >
> >         3.      proc filesystem.
> >
> >         4.      NET (ipv4 for now)
> >
> >         5.      Filesystem code, mostly DoS and data corruption. this will require
> > people who know their way around filesystems,  not for the general auditing crowd.
> >         6.      Stress testing the kernel in every imaginable way is bound to
> > find *something*, be creative.
> >
> >         IMHO, the kernel tree which requires the most effort for now is
> > 2.2. yes, 2.0 is still alive kicking, but soon enough 2.2 will become
> > the stable "old" kernel, just like 2.0.
> >
> >         We should not be auditing development kernels.
> >
> >                 Marc.
> 
> --
> "The difference between 'involvement' and 'commitment' is like an
> eggs-and-ham breakfast: the chicken was 'involved' - the pig was
> 'committed'."
> 
> 
> 

-- 
James Bourne                  | Email:  jbourne@affinity-systems.ab.ca
Affinity Systems Inc.         | WWW: http://www.affinity-systems.ab.ca
Everything Linux              | Linux:  The choice of a GNU generation
----------------------------------------------------------------------
Unix System Administration, System programming, Network Administration


Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Mon Jun 12 00:55:15 2000
Received: by humbolt.nl.linux.org id <S92233AbQFKWyb>;
	Mon, 12 Jun 2000 00:54:31 +0200
Received: from maynard.mail.mindspring.net ([207.69.200.243]:1323 "EHLO
        maynard.mail.mindspring.net") by humbolt.nl.linux.org with ESMTP
	id <S92236AbQFKWyB>; Mon, 12 Jun 2000 00:54:01 +0200
Received: from Win98.eaglefeather.earth.sol (user-33qtb26.dsl.mindspring.com [199.174.172.70])
	by maynard.mail.mindspring.net (8.9.3/8.8.5) with SMTP id SAA30177
	for <kernel-audit@nl.linux.org>; Sun, 11 Jun 2000 18:53:59 -0400 (EDT)
Message-Id: <200006112253.SAA30177@maynard.mail.mindspring.net>
Content-Type: text/plain
Content-Disposition: inline
Mime-Version: 1.0
From:   Stephan Zaniolo <eaglefeather@mindspring.com>
To:     kernel-audit@nl.linux.org
Reply-To: Stephan Zaniolo <eaglefeather@mindspring.com>
Subject: Re: Only auditing current 2.4 code?
X-Mailer: CSCMail v1.6.1
Date:   11 Jun 2000 17:54:22 CDT
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

	I'm quite new to programming and never done a code audit before,
but I had a thought.  Darron suggests below (as others have as well) that
this project focus on the 2.2.x or earlier kernels as they are more
stable.  Could it be more advantageous to work on the 2.4.x kernels
BECAUSE they are in a state of flux?  Would the kernel hackers be more
willing to incorporate changes in them now while they're still tinkering
in the bowels of the code?  Although an audit of the stable kernels would
make our job easier, would the kernel hackers (who are going to be
focusing on the 2.4.x kernels) going to be as willing to patch a stable
kernel that fewer people are working on, with code that might break
something else at a higher level?

IMHO,
Stephan

On Sun, 11 Jun 2000 15:58:40 -0600 (MDT), Darron Froese said:

> Someone had this suggestion (I forgot who and deleted the email) and I
>  think that that is probably not the correct way to go.
>  
>  2.4 is still in heavy development and will probably be that way for
>  the
>  next few months. When it comes out, there will probably be some lag
>  time
>  between the initial 2.4.0 release and a ready-for-primetime
>  production-quality release. Then there will be some time after that to
>  migrate production servers over - if they're even migrated.
>  
>  2.2 is in use on production servers right now and will be in use for
>  quite
>  some time. The codebase is pretty stable - there probably aren't going
>  to
>  be any huge changes (like there will be in 2.4) in the near future.
>  
>  I think an audit of the 2.2 code would serve quite well as a starting
>  point. We could:
>  
>  1. Track that known issues in 2.4 that didn't get back ported to 2.2.
>  (for whatever reason)
>  2. Look for other unknown issues and audit away.
>  
>  There will be plenty of time to audit 2.4 once it's stabilized
>  somewhat -
>  c'mon, the code freeze was announced in October sometime and it's
>  still
>  not really frozen. ;-)
>  
>  Anyways, that's just my 2 cents. I'd love to be able to help but can't
>  program in C yet.
>  --
>  Darron
>  darron@froese.org
>  
>  
>  Kernel-audit:  discussion list for security and the linux kernel
>  Archive:	  http://mail.nl.linux.org/kernel-audit/
>  


Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Mon Jun 12 01:00:55 2000
Received: by humbolt.nl.linux.org id <S92235AbQFKXAN>;
	Mon, 12 Jun 2000 01:00:13 +0200
Received: from Huntington-Beach.blue-labs.org ([208.179.0.198]:6230 "EHLO
        Huntington-Beach.Blue-Labs.org") by humbolt.nl.linux.org with ESMTP
	id <S92236AbQFKW7h>; Mon, 12 Jun 2000 00:59:37 +0200
Received: from kalifornia.com (david@Huntington-Beach.Blue-Labs.org [208.179.0.198])
	by Huntington-Beach.Blue-Labs.org (8.9.3/8.9.0) with ESMTP id PAA24458
	for <kernel-audit@nl.linux.org>; Sun, 11 Jun 2000 15:59:27 -0700
Message-ID: <394419CF.CCA1E2D8@kalifornia.com>
Date:   Sun, 11 Jun 2000 15:59:27 -0700
From:   David Ford <david@kalifornia.com>
Reply-To: david+validemail@kalifornia.com
Organization: Talon Technology, Intl.
X-Mailer: Mozilla 4.73 [en] (X11; U; Linux 2.4.0-test1 i686)
X-Accept-Language: en
MIME-Version: 1.0
CC:     kernel-audit@nl.linux.org
Subject: Re: suggestion.
References: <Pine.LNX.4.10.10006111631020.26873-100000@cafe.affinity-systems.ab.ca>
Content-Type: multipart/mixed;
 boundary="------------3932D92A9CC3D66B576847C6"
To:     unlisted-recipients:; (no To-header on input)
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

This is a multi-part message in MIME format.
--------------3932D92A9CC3D66B576847C6
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit

James Bourne wrote:

> On Sun, 11 Jun 2000, David Ford wrote:
>
> > I differ in opinion here, 2.2 is full of bugs which have been fixed in
> > 2.3/2.4.  I suggest we start with the most current code base.  There is
> > little merit in duplicating work that has already been done.  2.4 is at
> > the door, almost ready to walk.
>
> I agree with the former.  How many servers which need stability and are too
> much of a pain to upgrade are still running a 2.0 kernel?  2.2 will be
> around for a long time (it's really just starting to get good and stable
> now) and when 2.4 does come out, it will be the same ball of hair, not being
> fully accepted until it stablizes.  Anything caught in 2.2 can be of use in
> 2.4 to some extent at least.

The point is, many of the bugs, races, and security flaws in older kernels have been
fixed in the current tree.  We can expend a lot of effort fixing old stuff that's already
been fixed in the current tree, or we can make a good impression and come out with good
stuff in the first place.  A lot of problems in the 2.0 and 2.2 trees will remain there
unless a third party plans on doing the work simply because the evolution through the
2.odd tree is a significantly large amount of work.

There is often talk about old kernels on lkml and requests for backports and explanations
why the broken widget in 2.even won't get fixed because of the amount of effort it will
take to do it.  Some fixes simply aren't possible because they are intimately tied to API
changes throughout the rest of the kernel.

It's a nice idea to fix critical things in the old trees, but it's comparable to fixing
inadequacies in the 65 Mustang.  Contrary to your idea of finding bugs in 2.2, most bugs
are actually found in 2.odd and if critical, a backport fix is made for 2.even.

Chances are strong, for most of the bugs found in 2.2, when you bring up discussion of
it, you are likely to find it's already fixed in 2.3.  There are two points to a new
version of software, bug fixes and features.  Luckily for us, LK places a heavy emphasis
on bug fixes, much more heavily than new features.  Linus is really insistent on Do It
The Right Way (tm).

New code is always going to have bug fixes already applied to it that will reduce the
amount of work required.  Old code is always going to require bug fixes that frequently
have already been accomplished, increasing our workload because once a bug is found you
have to verify it hasn't already been fixed.

So again, I venture that our primary focus should be the current tree.  Review the
current tree and apply backwards versus review old code and apply forward.

-d


--
"The difference between 'involvement' and 'commitment' is like an
eggs-and-ham breakfast: the chicken was 'involved' - the pig was
'committed'."



--------------3932D92A9CC3D66B576847C6
Content-Type: text/x-vcard; charset=us-ascii;
 name="david.vcf"
Content-Transfer-Encoding: 7bit
Content-Description: Card for David Ford
Content-Disposition: attachment;
 filename="david.vcf"

begin:vcard 
n:Ford;David
x-mozilla-html:TRUE
org:<img src="http://www.kalifornia.com/images/paradise.jpg">
adr:;;;;;;
version:2.1
email;internet:david@kalifornia.com
title:Blue Labs Developer
x-mozilla-cpt:;28256
fn:David Ford
end:vcard

--------------3932D92A9CC3D66B576847C6--


Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Mon Jun 12 01:26:36 2000
Received: by humbolt.nl.linux.org id <S92239AbQFKXZx>;
	Mon, 12 Jun 2000 01:25:53 +0200
Received: from carry.netneo.com ([195.62.128.21]:34056 "EHLO carry.neonet.lv")
	by humbolt.nl.linux.org with ESMTP id <S92238AbQFKXZa>;
	Mon, 12 Jun 2000 01:25:30 +0200
Received: from ed.ed (as0s1.netneo.com [195.62.135.236])
	by carry.neonet.lv (8.9.3/8.9.3) with ESMTP id BAA13144
	for <kernel-audit@nl.linux.org>; Mon, 12 Jun 2000 01:25:05 +0200
Received: (from root@localhost)
	by ed.ed (8.8.7/8.8.5) id XAA01138
	for kernel-audit@nl.linux.org; Sun, 11 Jun 2000 23:22:45 GMT
From:   root <evpopkov@carry.neonet.lv>
Date:   Sun, 11 Jun 2000 23:22:44 +0000
To:     kernel-audit@nl.linux.org
Subject: RE: suggestion
Message-ID: <39441F44.nailUT1Z8J86@ed.ed>
References: <200006112234.AAA22881@octopus.phy.bg.ac.yu>
X-Mailer: nail 9.13 2000-05-30
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

> IMHO, we should start with the latest kernel in order not to do what is
> already done...

 OK, but what  is already done? And what  are we going to do?  We know that
kernel code  is designed,  written, released,  reviewed, tested  and fixed.
It's passing all these stages already.
 Where is the  place for LKAP? Somewhere around `reviewed'  and `tested', I
believe.  Note  that currently  the  code  is  already being  examined  and
checked. If we see  our role in doing something that no  one is doing, then
we probably need to  `innovate' :) We can start reading the  code in a loud
to the plants to see whether they grow faster.
 We will be  doing what is already  done, all the time,  otherwise why this
project? 2.4.x will stabilize and mature,  sooner or later, like 2.0.x did,
so why bother?


---

 "Teddy - I suppose Mummy and Daddy are real, aren't they?"
 Teddy said, "You ask such silly questions, David. Nobody knows what
'real' really means. Let's go indoors."

 Brian W. Aldiss, Supertoys Last All Summer Long


Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Mon Jun 12 01:55:37 2000
Received: by humbolt.nl.linux.org id <S92240AbQFKXyw>;
	Mon, 12 Jun 2000 01:54:52 +0200
Received: from rasputin.xilix.com ([195.139.104.66]:45829 "EHLO
        rasputin.xilix.com") by humbolt.nl.linux.org with ESMTP
	id <S92238AbQFKXyW>; Mon, 12 Jun 2000 01:54:22 +0200
Received: from trustix.com (singsing.trustix.com [195.139.104.158])
	by rasputin.xilix.com (8.9.3/8.9.3) with ESMTP id BAA29236
	for <kernel-audit@nl.linux.org>; Mon, 12 Jun 2000 01:51:55 +0200
Message-ID: <394417E0.39BCAF34@trustix.com>
Date:   Mon, 12 Jun 2000 00:51:12 +0200
From:   Lars Gaarden <larsg@trustix.com>
Organization: Trustix AS
X-Mailer: Mozilla 4.73 [en] (X11; U; Linux 2.3.999-t1a7 i686)
X-Accept-Language: en
MIME-Version: 1.0
To:     kernel-audit@nl.linux.org
Subject: Some suggestions.
References: <Pine.LNX.4.10.10006111631020.26873-100000@cafe.affinity-systems.ab.ca>
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list


I expect that we'll need some kind of revision tracking, to make sure
that
all relevant problems found in 2.x are back/forward-ported to 2.y<x and
2.y>x.

Someone mentioned splitting the kernel into subsystems and auditing them
in turn. While this would catch stuff like potential buffer overflows
and
incomplete/lacking parameter validations, it won't catch design bugs and
thinkos in the interaction of the subsystems.

-- 
LarsG. These are my opinions, which may or may not be shared by my
employer.

Code that cracks a protection device is criminal under the DMCA even if
the
use of the copyrighted material that the code enables would be fair use.
- Lawrence Lessig, Berkman Professor of Law, Harward Law School.

Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Mon Jun 12 01:57:16 2000
Received: by humbolt.nl.linux.org id <S92242AbQFKX4R>;
	Mon, 12 Jun 2000 01:56:17 +0200
Received: from host13.mucom.co.il ([192.115.216.45]:49934 "EHLO mucom.co.il")
	by humbolt.nl.linux.org with ESMTP id <S92241AbQFKXzi>;
	Mon, 12 Jun 2000 01:55:38 +0200
Received: (from marc@localhost)
	by mucom.co.il (8.9.3/8.9.3) id BAA14813;
	Mon, 12 Jun 2000 01:53:55 -0200
Date:   Mon, 12 Jun 2000 01:53:54 -0200
From:   Marc Esipovich <marc@mucom.co.il>
To:     root <evpopkov@carry.neonet.lv>
Cc:     kernel-audit@nl.linux.org
Subject: Re: suggestion
Message-ID: <20000612015354.B14789@darkstar.netvision>
References: <200006112234.AAA22881@octopus.phy.bg.ac.yu> <39441F44.nailUT1Z8J86@ed.ed>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
User-Agent: Mutt/1.2i
In-Reply-To: <39441F44.nailUT1Z8J86@ed.ed>; from evpopkov@carry.neonet.lv on Sun, Jun 11, 2000 at 11:22:44PM +0000
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

On Sun, Jun 11, 2000 at 11:22:44PM +0000, root wrote:
> > IMHO, we should start with the latest kernel in order not to do what is
> > already done...
> 
>  OK, but what  is already done?

Well,  if there were *real* kernel changelogs,  I mean real,  not just 'what 
regulars from lkml remember or know has been fixed or are aware of the problem'

People, instead of debating and debating to no end, let's start doing
something,  I suggest we start with stuff like, the binary loaders (elf, a.out)
the proc fs and capabilities,  things that have direct impact on security.

After all, "bugs" are nice to find,  but what we really need to concentrate on
are security-related bugs/problems, this is what started this list.

string-operations type audits will not do,  we're looking for stuff defected
in the most fundamental level,  glitches, logical errors, bad assumptions.

What we really need is people going through the code, understanding every line,
asking themselvs stuff like:

	Is this `if` statement correct?

	Should there be an if..else here?

	What does this `if` do?

These are just examples, there are so many things to look at. people
who will read kernel code in order to fully understand it will provide the
best results. grep-type audits will not work or almost not work.


		Marc.

Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Mon Jun 12 02:07:07 2000
Received: by humbolt.nl.linux.org id <S92241AbQFLAGY>;
	Mon, 12 Jun 2000 02:06:24 +0200
Received: from host13.mucom.co.il ([192.115.216.45]:54798 "EHLO mucom.co.il")
	by humbolt.nl.linux.org with ESMTP id <S92238AbQFLAFo>;
	Mon, 12 Jun 2000 02:05:44 +0200
Received: (from marc@localhost)
	by mucom.co.il (8.9.3/8.9.3) id CAA14845;
	Mon, 12 Jun 2000 02:04:05 -0200
Date:   Mon, 12 Jun 2000 02:04:05 -0200
From:   Marc Esipovich <marc@mucom.co.il>
To:     Lars Gaarden <larsg@trustix.com>
Cc:     kernel-audit@nl.linux.org
Subject: Re: Some suggestions.
Message-ID: <20000612020405.A14817@darkstar.netvision>
References: <Pine.LNX.4.10.10006111631020.26873-100000@cafe.affinity-systems.ab.ca> <394417E0.39BCAF34@trustix.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
User-Agent: Mutt/1.2i
In-Reply-To: <394417E0.39BCAF34@trustix.com>; from larsg@trustix.com on Mon, Jun 12, 2000 at 12:51:12AM +0200
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

On Mon, Jun 12, 2000 at 12:51:12AM +0200, Lars Gaarden wrote:
> 
> I expect that we'll need some kind of revision tracking, to make sure
> that
> all relevant problems found in 2.x are back/forward-ported to 2.y<x and
> 2.y>x.

Probably.

> 
> Someone mentioned splitting the kernel into subsystems and auditing them
> in turn. While this would catch stuff like potential buffer overflows
> incomplete/lacking parameter validations

I honestly think we should at least at first, concentrate on security related
issue only.  most of the kernel bugs have very little if at all relation to
security.

Well, if a bug has caused the kernel to crash,. you can call it DoS (if a 
user can reproduce it). 

How many user-controllable buffer overruns do you know have been found
or not yet found in the kernel?

> it won't catch design bugs and
> thinkos in the interaction of the subsystems.
> 

I really think these are for the developers to find, don't you agree?


	Marc.

Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Mon Jun 12 02:24:25 2000
Received: by humbolt.nl.linux.org id <S92246AbQFLAXo>;
	Mon, 12 Jun 2000 02:23:44 +0200
Received: from mail3.mia.bellsouth.net ([205.152.144.15]:48108 "EHLO
        mail3.mia.bellsouth.net") by humbolt.nl.linux.org with ESMTP
	id <S92243AbQFLAXT>; Mon, 12 Jun 2000 02:23:19 +0200
Received: from geocities.com (adsl-78-192-135.mia.bellsouth.net [216.78.192.135])
	by mail3.mia.bellsouth.net (3.3.5alt/0.75.2) with ESMTP id UAA13570
	for <kernel-audit@nl.linux.org>; Sun, 11 Jun 2000 20:23:16 -0400 (EDT)
Message-ID: <39443063.AA2BFA3B@geocities.com>
Date:   Sun, 11 Jun 2000 20:35:47 -0400
From:   Chris and Tony <chriton@geocities.com>
X-Mailer: Mozilla 4.73 [en] (Win98; I)
X-Accept-Language: en
MIME-Version: 1.0
To:     kernel-audit@nl.linux.org
Subject: Re: Some suggestions.
References: <Pine.LNX.4.10.10006111631020.26873-100000@cafe.affinity-systems.ab.ca> <394417E0.39BCAF34@trustix.com> <20000612020405.A14817@darkstar.netvision>
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

>
> >
> > Someone mentioned splitting the kernel into subsystems and auditing them
> > in turn. While this would catch stuff like potential buffer overflows
> > incomplete/lacking parameter validations
>
> I honestly think we should at least at first, concentrate on security related
> issue only.  most of the kernel bugs have very little if at all relation to
> security.
>
> Well, if a bug has caused the kernel to crash,. you can call it DoS (if a
> user can reproduce it).
>
> How many user-controllable buffer overruns do you know have been found
> or not yet found in the kernel?
>
> > it won't catch design bugs and
> > thinkos in the interaction of the subsystems.
> >
>
> I really think these are for the developers to find, don't you agree?

Not at all. Assuming this sort of audit really is necessary to consider the
security ramifications, once we have found a problem, we should fix it or at
_LEAST_ make the maintainer aware of it if it's not going to affect security.

I certainly would buy the assumption that this sort of in-depth audit _IS_
necessary.


Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Mon Jun 12 02:44:08 2000
Received: by humbolt.nl.linux.org id <S92243AbQFLAnY>;
	Mon, 12 Jun 2000 02:43:24 +0200
Received: from mail3.mia.bellsouth.net ([205.152.144.15]:60664 "EHLO
        mail3.mia.bellsouth.net") by humbolt.nl.linux.org with ESMTP
	id <S92238AbQFLAmy>; Mon, 12 Jun 2000 02:42:54 +0200
Received: from geocities.com (adsl-78-192-135.mia.bellsouth.net [216.78.192.135])
	by mail3.mia.bellsouth.net (3.3.5alt/0.75.2) with ESMTP id UAA27706
	for <kernel-audit@nl.linux.org>; Sun, 11 Jun 2000 20:42:52 -0400 (EDT)
Message-ID: <394434FB.983C8165@geocities.com>
Date:   Sun, 11 Jun 2000 20:55:23 -0400
From:   Chris and Tony <chriton@geocities.com>
X-Mailer: Mozilla 4.73 [en] (Win98; I)
X-Accept-Language: en
MIME-Version: 1.0
To:     kernel-audit@nl.linux.org
Subject: Why all this effort?
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

What is the purpose of expending such an enormous amount of effort
reviewing the source for the linux kernel? What are we hoping to
accomplish? These are the sorts of questions that _MUST_ be answered
before this project can get underway with any focus. LKAP must work from

a vision and pursue that vision within it's own bounds. LKAP must
develop a clear and possible process for achieving it's goals. I propose

that we agree on simple process to begin with and begin by focusing on
on answering a few of the most basic questions.

Let me ask a few general questions whose answers will steer the project.

1) which of the following is the ultimate goal?
  a) audit the mainstream source code leaving it as secure as possible
within the bounds of optimizing for the general case.
  b) produce an alternate code base which is as secure as it possibly
can be even it isn't as fast or resource conserving as it could be.
  c) choice a plus produce a set of patches for choice b.

2) should LKAP audit only the linux kernel or should concern itself with

GNU utilities or even more?

3) should LKAP be concerned with adding security enhancing functionality

to the code or systems it audits?

4) to what extent should LKAP be pursuing enhanced documentation.

5) should LKAP pool it's efforts with any similar projects or work in
parallel?

Once these questions are settled, LKAP can move on to HOW these goals
can be accomplished. At this stage we will need to identify the
challenges laid out before us. Assuming we will be working to integrate
with the mainstream source (which I strongly advocate), we need to
ascertain what limitations will generally be placed on our patches. We
also need to develop an acceptable process for presenting the patches to

the mainstream maintainers. We also need a good and easily
understandable way of marking code as audited or not. If we choose to
produce a set of patches that are outside the scope of the mainstream
code base, we need to resolve the issue of maintenance.

At this stage, we should be able to draw up a set of guidelines for
auditors. We can answer such questions as what to audit, in what order,
how and who. I have seen a lot of discussion on the list regarding
questions at the end of this proposed process, and I believe they may be

jumping the gun a little. The answers to many of these questions that
are yet to be answered will likely influence whether we audit 2.0, 2.2,
or 2.4, and whether we do so separately or in parallel.

I am sure there are more questions to be added to my list, but I propose

that we start by creating a short list of paramount questions and follow

from there by working on their answers. Once that is done, there will be

more questions posed by the answers to the first set and the cycle will
continue. This cycle can continue until we have a good, well defined
basis for managing the project at which point we can begin the dirty
work.

--------------------------------------------------------

Let me start by throwing in my opinions on a few of the questions I have

asked of everyone else.

1) a and possibly c. If there is the inclination among auditors to
create a patch for the most secure possible source possible, then I am
not going to object. I personally am inclined to concentrate on the
mainstream side of things.

2) Kernel is most important and should come first, other stuff possibly
later.

3) Hrm... not sure. Certainly LKAP should have a healthy set of links to

other such projects and may choose to host a few of it's own. I don't
see this a being the general direction that should be taken tho. That
kind of goes along with my feelings on question 1.

4) To the highest degree! Documentation helps prevent all sorts of
security problems. Many security problems arise when one bit of code
calls another bit that isn't understood well by the coder who writes the

calling function. We should also document things we find to be secure
and why so that coders who revisit the code don't accidentally optimize
out security without first thinking about. In addition to the security
ramifications of good documentation, it also adds a lot of value to the
community making it easier for everyone to maintain and extend. Since we

will be taking the time to understand everything in detail, we might as
well document it well. This will also benefit us when we have to reaudit

code due to changes or simply because someone has some spare time. Also,

the 3/4 of the people on this list who aren't hard-core hackers might
very well be capable of documenting the code better or more efficiently
than the code auditors. We might as well put them all to work!

5) I don't know too much about the other projects and that may depend
very much on the goals they have for themselves. If, however, their
goals and methods are compatible with ours, I see no reason to duplicate

work (at least the first time around).




Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Mon Jun 12 03:01:07 2000
Received: by humbolt.nl.linux.org id <S92244AbQFLA7y>;
	Mon, 12 Jun 2000 02:59:54 +0200
Received: from pandora.binc.net ([208.139.220.11]:28692 "EHLO pandora.binc.net")
	by humbolt.nl.linux.org with ESMTP id <S92238AbQFLA7U>;
	Mon, 12 Jun 2000 02:59:20 +0200
Received: from localhost (grice@localhost)
	by pandora.binc.net (8.9.1/8.9.1) with ESMTP id TAA05028;
	Sun, 11 Jun 2000 19:59:17 -0500
X-Authentication-Warning: pandora.binc.net: grice owned process doing -bs
Date:   Sun, 11 Jun 2000 19:59:17 -0500 (CDT)
From:   Michael Grice <grice@berbee.com>
X-Sender: grice@pandora.binc.net
To:     Chris and Tony <chriton@geocities.com>
cc:     kernel-audit@nl.linux.org
Subject: Re: Why all this effort?
In-Reply-To: <394434FB.983C8165@geocities.com>
Message-ID: <Pine.LNX.4.05.10006111951150.14332-100000@pandora.binc.net>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

I'll agree in large part with Chris and/or Tony. The goals should be:

1) Audit the "mainstream" kernel code. Any patches should be with the
goal of fixing security problems in the mainstream kernel.

2) Audit the kernel only.

3) *Not* adding additional security functionality. [Maybe later...]

4) Document everything as much as possible.

5) Ah, I don't know...
--Michael

On Sun, 11 Jun 2000, Chris and Tony wrote:

> What is the purpose of expending such an enormous amount of effort
> reviewing the source for the linux kernel? What are we hoping to
> accomplish? These are the sorts of questions that _MUST_ be answered
> before this project can get underway with any focus. LKAP must work from
> 
> a vision and pursue that vision within it's own bounds. LKAP must
> develop a clear and possible process for achieving it's goals. I propose
> 
> that we agree on simple process to begin with and begin by focusing on
> on answering a few of the most basic questions.
> 
> Let me ask a few general questions whose answers will steer the project.
> 
> 1) which of the following is the ultimate goal?
>   a) audit the mainstream source code leaving it as secure as possible
> within the bounds of optimizing for the general case.
>   b) produce an alternate code base which is as secure as it possibly
> can be even it isn't as fast or resource conserving as it could be.
>   c) choice a plus produce a set of patches for choice b.
> 
> 2) should LKAP audit only the linux kernel or should concern itself with
> 
> GNU utilities or even more?
> 
> 3) should LKAP be concerned with adding security enhancing functionality
> 
> to the code or systems it audits?
> 
> 4) to what extent should LKAP be pursuing enhanced documentation.
> 
> 5) should LKAP pool it's efforts with any similar projects or work in
> parallel?
> 
[...]


Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Mon Jun 12 03:11:49 2000
Received: by humbolt.nl.linux.org id <S92238AbQFLBLB>;
	Mon, 12 Jun 2000 03:11:01 +0200
Received: from mail0.bna.bellsouth.net ([205.152.150.12]:20181 "EHLO
        mail0.bna.bellsouth.net") by humbolt.nl.linux.org with ESMTP
	id <S92245AbQFLBKc>; Mon, 12 Jun 2000 03:10:32 +0200
Received: from adsl-78-129-55.mem.bellsouth.net (adsl-78-129-55.mem.bellsouth.net [216.78.129.55])
	by mail0.bna.bellsouth.net (3.3.5alt/0.75.2) with ESMTP id VAA26443
	for <kernel-audit@nl.linux.org>; Sun, 11 Jun 2000 21:10:30 -0400 (EDT)
Date:   Sun, 11 Jun 2000 20:06:41 -0500 (CDT)
From:   Bryan Paxton <evil7@bellsouth.net>
X-Sender: evil7@sqa.speedbros.org
To:     kernel-audit@nl.linux.org
Subject: A proposed model for the audit
Message-ID: <Pine.LNX.4.21.0006112006100.839-100000@sqa.speedbros.org>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

I've looked at all the posts, and I've put together a small layout plan.

But first you must remember that Linux development in general is far from 
neighbors(*BSD) route on developing. Hence we can not particulary go in the 
style of our friends next door. Linux development moves so fast, or rather it
only goes forwards and not particulary backwards most of the time. This is what
you have to keep in mind when we setup a plan for auditing. Thus my proposal:

Of course this is all really up to _YOU_ the developers, but I think this is 
the best way to go.

Starting kernel:
A freeze on kernel 2.3.99-pre10-3 a.k.a. 2.4.0-test1

This kernel contains so many new features and pretty much has all the old ones.
So that includes new problems and old ones as well. It's only logical to audit 
this one for two reasons: 
1) As stated before, linux moves forwards and not backwards. 
2) This is the kernel that is gonna grab the publics attention, hence the mass
amount of people going to be using this kernel is almost unmesureable. This 
is going to be the kernel that is going to turn a lot of people over to linux
IMHO.

So now there's a kernel audit...
But what approach do way take as to where we start in this kernel...
Well at a first glance it would seem that starting with the core would be more
logical. This is far from the truth IMHO. Take a board puzzle for example... 
Does it make sense to start from the inside out ? Sure you can get it done that
way, but it's going to take longer and surely going to be messy in the proc. 

So where do we start ? Well where would you say the outside of the kernel is ?
I'd say /usr/src/linux-2.4.0-test1/net 

This also makes perfect sense if you keep up with l-k, netfilter(iptables) has
had some nasty code in it(DoS problems). Or as mentioned by someone else on the
list that even the tcp/ip core looks a little crude.

Now that there's a specific kernel to audit and place to start in the kernel, 
How does all this get classfied ? 

Well, I really liked Rik's(riel) approach to this, and in my mind is the best
way to go on classification. 


1."crashme" bugs, system calls and other places where the kernel crashes when confronted with faulty data.

2. security bugs, exploiting bugs in the code, a user is able to gain priveledges the user should not have.

3. stability bugs, where the user can "exploit" some special situation to make the kernel behave badly or crash (eg. write to a file you're truncating,
confusing buffer.c and various other places).

4. non-security bugs, other bugs that are encountered during an audit of code.

So now there's a kernel to audit, there's a place to start in this kernel, and
there's a method of classification.

What do ya do when you think you've found a hole ?
Duh! post the mailing list.

What do ya do when you've known you've found a hole ?
Make a patch(diff it up), send it to the maintainer of said code in the kernel,
and of course post it to the mailing list. Also cc a copy to evil7@bellsouth.net
for the bug archives and current activities list(the page will be up soon, though
still in beta : p).

So finally...........
There's a kernel to audit, a place to start in that kernel, a method of 
classification, and the way to go when something is found.

If you've read between the lines on this you'll understand that this model 
is very simple, as it should be. A security auditing proc needs to be anything
but complex. Complexity is only useful if you're trying to market an audit, which
we're not ; )

All comments/ideas/revisions of this model are encouraged.




-- 
Bryan Paxton

"How should I know if it works? That's what beta testers are for. I
          only coded it."
 -- Linus Torvalds.




Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Mon Jun 12 03:46:38 2000
Received: by humbolt.nl.linux.org id <S92247AbQFLBpS>;
	Mon, 12 Jun 2000 03:45:18 +0200
Received: from Huntington-Beach.Blue-Labs.org ([208.179.0.198]:26711 "EHLO
        Huntington-Beach.Blue-Labs.org") by humbolt.nl.linux.org with ESMTP
	id <S92245AbQFLBon>; Mon, 12 Jun 2000 03:44:43 +0200
Received: from kalifornia.com (david@Huntington-Beach.Blue-Labs.org [208.179.0.198])
	by Huntington-Beach.Blue-Labs.org (8.9.3/8.9.0) with ESMTP id SAA25668
	for <kernel-audit@nl.linux.org>; Sun, 11 Jun 2000 18:44:34 -0700
Message-ID: <39444081.555B7D1B@kalifornia.com>
Date:   Sun, 11 Jun 2000 18:44:34 -0700
From:   David Ford <david@kalifornia.com>
Reply-To: david+validemail@kalifornia.com
Organization: Talon Technology, Intl.
X-Mailer: Mozilla 4.73 [en] (X11; U; Linux 2.4.0-test1 i686)
X-Accept-Language: en
MIME-Version: 1.0
CC:     kernel-audit@nl.linux.org
Subject: Re: Why all this effort?
References: <394434FB.983C8165@geocities.com>
Content-Type: multipart/mixed;
 boundary="------------324F56A4B385EFD643453500"
To:     unlisted-recipients:; (no To-header on input)
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

This is a multi-part message in MIME format.
--------------324F56A4B385EFD643453500
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit

Chris and Tony wrote:

> 1) which of the following is the ultimate goal?
>   a) audit the mainstream source code leaving it as secure as possible
> within the bounds of optimizing for the general case.
>   b) produce an alternate code base which is as secure as it possibly
> can be even it isn't as fast or resource conserving as it could be.
>   c) choice a plus produce a set of patches for choice b.

I'd rather not splinter yet another LK tree aimed at being secure, we
already have trees going in that direction, another one isn't helping the
masses because the masses follow the kernel Linus releases.

I recommend (a).


> 2) should LKAP audit only the linux kernel or should concern itself with
> GNU utilities or even more?

LK implies linux kernel.  There are other projects for doing things like
GNU.


> 3) should LKAP be concerned with adding security enhancing functionality
> to the code or systems it audits?

I feel an enhancements process should be secondary to an audit process.
Patches for enhancing the security can be kept separate.  This follows the
line of thought regarding encryption and EARS countries.


> 4) to what extent should LKAP be pursuing enhanced documentation.

A lot.  Documentation is the best resource.


> 5) should LKAP pool it's efforts with any similar projects or work in
> parallel?

LKAP should be open and confer, particularly with lkml.

-d

--
"The difference between 'involvement' and 'commitment' is like an
eggs-and-ham breakfast: the chicken was 'involved' - the pig was
'committed'."



--------------324F56A4B385EFD643453500
Content-Type: text/x-vcard; charset=us-ascii;
 name="david.vcf"
Content-Transfer-Encoding: 7bit
Content-Description: Card for David Ford
Content-Disposition: attachment;
 filename="david.vcf"

begin:vcard 
n:Ford;David
x-mozilla-html:TRUE
org:<img src="http://www.kalifornia.com/images/paradise.jpg">
adr:;;;;;;
version:2.1
email;internet:david@kalifornia.com
title:Blue Labs Developer
x-mozilla-cpt:;28256
fn:David Ford
end:vcard

--------------324F56A4B385EFD643453500--


Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Mon Jun 12 03:49:49 2000
Received: by humbolt.nl.linux.org id <S92249AbQFLBtJ>;
	Mon, 12 Jun 2000 03:49:09 +0200
Received: from Huntington-Beach.Blue-Labs.org ([208.179.0.198]:29015 "EHLO
        Huntington-Beach.Blue-Labs.org") by humbolt.nl.linux.org with ESMTP
	id <S92248AbQFLBsn>; Mon, 12 Jun 2000 03:48:43 +0200
Received: from kalifornia.com (david@Huntington-Beach.Blue-Labs.org [208.179.0.198])
	by Huntington-Beach.Blue-Labs.org (8.9.3/8.9.0) with ESMTP id SAA25689
	for <kernel-audit@nl.linux.org>; Sun, 11 Jun 2000 18:48:39 -0700
Message-ID: <39444176.CE4EFF9E@kalifornia.com>
Date:   Sun, 11 Jun 2000 18:48:39 -0700
From:   David Ford <david@kalifornia.com>
Reply-To: david+validemail@kalifornia.com
Organization: Talon Technology, Intl.
X-Mailer: Mozilla 4.73 [en] (X11; U; Linux 2.4.0-test1 i686)
X-Accept-Language: en
MIME-Version: 1.0
CC:     kernel-audit@nl.linux.org
Subject: Re: A proposed model for the audit
References: <Pine.LNX.4.21.0006112006100.839-100000@sqa.speedbros.org>
Content-Type: multipart/mixed;
 boundary="------------91EAF77EB3DAE7CDFF0919AA"
To:     unlisted-recipients:; (no To-header on input)
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

This is a multi-part message in MIME format.
--------------91EAF77EB3DAE7CDFF0919AA
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit

Bryan Paxton wrote:

> A freeze on kernel 2.3.99-pre10-3 a.k.a. 2.4.0-test1

Do keep in mind these are two different kernels.  Code changed between them.


> But what approach do way take as to where we start in this kernel...
> Well at a first glance it would seem that starting with the core would be more
> logical. This is far from the truth IMHO. Take a board puzzle for example...
> Does it make sense to start from the inside out ? Sure you can get it done that
> way, but it's going to take longer and surely going to be messy in the proc.
>
> So where do we start ? Well where would you say the outside of the kernel is ?
> I'd say /usr/src/linux-2.4.0-test1/net

I suggest we first develop core categories, I.e. Net, Filesystem, etc, and supporting categories within the cores.


> If you've read between the lines on this you'll understand that this model
> is very simple, as it should be. A security auditing proc needs to be anything
> but complex. Complexity is only useful if you're trying to market an audit, which
> we're not ; )

Simple and straightforward is the best :)

-d

--
"The difference between 'involvement' and 'commitment' is like an
eggs-and-ham breakfast: the chicken was 'involved' - the pig was
'committed'."



--------------91EAF77EB3DAE7CDFF0919AA
Content-Type: text/x-vcard; charset=us-ascii;
 name="david.vcf"
Content-Transfer-Encoding: 7bit
Content-Description: Card for David Ford
Content-Disposition: attachment;
 filename="david.vcf"

begin:vcard 
n:Ford;David
x-mozilla-html:TRUE
org:<img src="http://www.kalifornia.com/images/paradise.jpg">
adr:;;;;;;
version:2.1
email;internet:david@kalifornia.com
title:Blue Labs Developer
x-mozilla-cpt:;28256
fn:David Ford
end:vcard

--------------91EAF77EB3DAE7CDFF0919AA--


Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Mon Jun 12 04:02:13 2000
Received: by humbolt.nl.linux.org id <S92245AbQFLCBW>;
	Mon, 12 Jun 2000 04:01:22 +0200
Received: from carry.netneo.com ([195.62.128.21]:10251 "EHLO carry.neonet.lv")
	by humbolt.nl.linux.org with ESMTP id <S92248AbQFLCBI>;
	Mon, 12 Jun 2000 04:01:08 +0200
Received: from ed.ed (as0s1.netneo.com [195.62.135.236])
	by carry.neonet.lv (8.9.3/8.9.3) with ESMTP id EAA14710
	for <kernel-audit@nl.linux.org>; Mon, 12 Jun 2000 04:00:43 +0200
Received: (from root@localhost)
	by ed.ed (8.8.7/8.8.5) id BAA02295
	for kernel-audit@nl.linux.org; Mon, 12 Jun 2000 01:51:59 GMT
From:   root <evpopkov@carry.neonet.lv>
Date:   Mon, 12 Jun 2000 01:51:59 +0000
To:     kernel-audit@nl.linux.org
Subject: Re: Why all this effort?
Message-ID: <3944423F.nail1RK11FFKD@ed.ed>
References: <394434FB.983C8165@geocities.com>
X-Mailer: nail 9.13 2000-05-30
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

> What is the purpose of expending such an enormous amount of effort
> reviewing the source for the linux kernel?

 Looks like there's  no purpose except for looking at  the source. IMHO, to
do that  no community  is required.  Here's the tarball,  unpack and  go. I
agree that we must  define the goals now, before too  much time and efforts
have been spent. Otherwire the whole project will become `pure art.'
 Another crucial point is collaboration with authoritative kernel teams and
their leaders. LKAP  is secondary to kernel development process  as we have
it now. We can produce brilliant patches,  but they won't go anywhere if we
fail to communicate with recognized kernel team.
 What I, personally, would like LKAP to be, is a training ground for active
developers who want  to improve their techniques to  either join particular
kernel development  division, or to use  the knowledge acquired at  LKAP to
produce better software.
 In no case we must try to catch  the hottest code and become a cart trying
to run neck and neck with the horse.  If we assume 3/4 of us have no skills
or  time to  do the  job, we  can't hope  to get  in sync  with development
process.
 Let's take a well-known and mature  code, study it, _learn_ what good code
looks like and only then get on  to something that can cause doubts and try
to see what can be fixed.
 We'd better spend  a year to study the subject  and become proficient with
it,  than  jump into  the  game  and  start  bothering people  with  stupid
questions and patches that will blow the kernel.
 So, let's get back to 101. It won't  hurt those who know, and it will help
those who don't.  This takes everyone, no one needs  kernel docs written by
someone who can't tell long from short.

 All IMHO, nothing personal, std discl., yada yada....



---

 "Teddy - I suppose Mummy and Daddy are real, aren't they?"
 Teddy said, "You ask such silly questions, David. Nobody knows what
'real' really means. Let's go indoors."

 Brian W. Aldiss, Supertoys Last All Summer Long


Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Mon Jun 12 05:29:52 2000
Received: by humbolt.nl.linux.org id <S92251AbQFLD3I>;
	Mon, 12 Jun 2000 05:29:08 +0200
Received: from nat-su-33.valinux.com ([198.186.202.33]:64556 "EHLO
        trampoline.thunk.org") by humbolt.nl.linux.org with ESMTP
	id <S92248AbQFLD2c>; Mon, 12 Jun 2000 05:28:32 +0200
Received: (from tytso@localhost)
	by trampoline.thunk.org (8.9.3/8.9.3) id XAA10968;
	Sun, 11 Jun 2000 23:29:37 -0400
Date:   Sun, 11 Jun 2000 23:29:37 -0400
From:   "Theodore Ts'o" <tytso@mit.edu>
Message-Id: <200006120329.XAA10968@trampoline.thunk.org>
X-Authentication-Warning: trampoline.thunk.org: tytso set sender to tytso@mit.edu using -f
To:     evil7@bellsouth.net
CC:     linux-kernel@vger.rutgers.edu, kernel-audit@nl.linux.org
In-reply-to: <Pine.LNX.4.21.0006091422520.667-100000@sqa.speedbros.org>
	(message from Bryan Paxton on Fri, 9 Jun 2000 15:06:13 -0500 (CDT))
Subject: Re: Mission statement for LKAP(Linux kernel auditing project)
Phone:  (781) 391-3464
References:  <Pine.LNX.4.21.0006091422520.667-100000@sqa.speedbros.org>
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

   Date: 	Fri, 9 Jun 2000 15:06:13 -0500 (CDT)
   From: Bryan Paxton <evil7@bellsouth.net>

   The purpose of this project is self-explanatory. It's an attempt to
   audit the Linux kernel for any security vulnerabilities and/or holes
   and/or possible vulnerabilities and/or possible holes, and of course
   without adding more bugs or drawbacks to the existing.

Great!  I'm glad someone is going organize a security audit of the
kernel.  In the userspace we can take advantage of the security audits
done by others, including OpenBSD, but in the kernel area we have to do
it ourselves.

   I feel that this project should have been done a long time ago, not
   to imply that the Linux kernel is insecure, but a case in which this
   project would've helped would be the setuid() hole found on June 7
   which affected all 2.2.x kernels. This bug was patched in a matter of
   hours (isn't open source great!). 

Actually, for the record, Wojciech Purczynski (wp@elzabsoft.pl)
contacted me and a few others on May 26th concerning the exploit.
Things were kept quiet for a week or two while a number of developers
discussed the best way of fixing the hole behind the scenes, and to give
various Linux vendors a chance to have patched kernels ready in time for
the public announcement of the hole on June 7th.

						- Ted

Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Mon Jun 12 05:50:31 2000
Received: by humbolt.nl.linux.org id <S92248AbQFLDtj>;
	Mon, 12 Jun 2000 05:49:39 +0200
Received: from abednego.com ([209.197.231.130]:22546 "EHLO www.abednego.com")
	by humbolt.nl.linux.org with ESMTP id <S92254AbQFLDtH>;
	Mon, 12 Jun 2000 05:49:07 +0200
Received: (from cclay@localhost)
	by www.abednego.com (8.9.3/8.8.7) id WAA10656
	for kernel-audit@nl.linux.org; Sun, 11 Jun 2000 22:49:31 -0500
Date:   Sun, 11 Jun 2000 22:49:30 -0500
From:   cyberclay <cclay@fastlane.net>
To:     kernel-audit@nl.linux.org
Subject: Re: suggestion
Message-ID: <20000611224930.A10014@www.abednego.com>
Reply-To: cclay@fastlane.net
References: <20000612015354.B14789@darkstar.netvision>
Mime-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1
In-Reply-To: <20000612015354.B14789@darkstar.netvision>; from marc@mucom.co.il on Sun, Jun 11, 2000 at 22:53:54 -0500
X-Mailer: Balsa 0.8.0
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list


On Sun, 11 Jun 2000 22:53:54 Marc Esipovich wrote:
> People, instead of debating and debating to no end, let's start doing
> something,  I suggest we start with stuff like, the binary loaders (elf,
a.out)
> the proc fs and capabilities,  things that have direct impact on security.

Hey,
  I couldn't agree more.  However, I also believe that this is an issue
that will need to be resolved as we begin to get things underway.  Quite
possibly the only good solution will be a sort of integration between us
and the kernel developers themselves.  They could send us a kernel before
it is "officially" released, we could then get the oppertunity to go through
it and do what we can, and put some sort of stamp on it, "LKAP Approved."
  If we are to ensure that our changes will be implemented in all future
releases, it will be necessary to begin our work with the most recent kernel.
  After this initial release of a "secure" kernel, development would return
to normal, and we'd try and keep up with the kernels as they're released
(hopefully
with a bit better changelogs than those currently available).
  This is just my line of thinking as of now.  For the time being, I agree with
your suggestion that we content ourselves to begin work on what we have
available
to us.

Regards,
  cyberclay
---
cclay at fastlane dot net
I think, therefore I am dangerous
http://www.abednego.com

Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Mon Jun 12 06:07:03 2000
Received: by humbolt.nl.linux.org id <S92254AbQFLEGS>;
	Mon, 12 Jun 2000 06:06:18 +0200
Received: from cafe.affinity-systems.ab.ca ([139.142.10.12]:42505 "EHLO
        cafe.affinity-systems.ab.ca") by humbolt.nl.linux.org with ESMTP
	id <S92253AbQFLEFp>; Mon, 12 Jun 2000 06:05:45 +0200
Received: (from jbourne@localhost)
	by cafe.affinity-systems.ab.ca (8.9.3/8.9.3/asi-redhat) id WAA10895;
	Sun, 11 Jun 2000 22:04:48 -0600
Date:   Sun, 11 Jun 2000 22:04:48 -0600 (MDT)
From:   James Bourne <jbourne@affinity-systems.ab.ca>
To:     david+validemail@kalifornia.com
cc:     kernel-audit@nl.linux.org
Subject: Re: Why all this effort?
In-Reply-To: <39444081.555B7D1B@kalifornia.com>
Message-ID: <Pine.LNX.4.10.10006112200440.10761-100000@cafe.affinity-systems.ab.ca>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

On Sun, 11 Jun 2000, David Ford wrote:

> Chris and Tony wrote:
> 
> > 1) which of the following is the ultimate goal?
> >   a) audit the mainstream source code leaving it as secure as possible
> > within the bounds of optimizing for the general case.
> >   b) produce an alternate code base which is as secure as it possibly
> > can be even it isn't as fast or resource conserving as it could be.
> >   c) choice a plus produce a set of patches for choice b.
> 
> I'd rather not splinter yet another LK tree aimed at being secure, we
> already have trees going in that direction, another one isn't helping the
> masses because the masses follow the kernel Linus releases.
> 
> I recommend (a).

Same here, once a problem is found there won't be any real problem merging
it into the current tree since that's what everyone wants.

> > 2) should LKAP audit only the linux kernel or should concern itself with
> > GNU utilities or even more?
> 
> LK implies linux kernel.  There are other projects for doing things like
> GNU.

Besides there's already a security audit project for the utilities.

Jim

> -d
> 
> --
> "The difference between 'involvement' and 'commitment' is like an
> eggs-and-ham breakfast: the chicken was 'involved' - the pig was
> 'committed'."
> 
> 
> 

-- 
James Bourne                  | Email:  jbourne@affinity-systems.ab.ca
Affinity Systems Inc.         | WWW: http://www.affinity-systems.ab.ca
Everything Linux              | Linux:  The choice of a GNU generation
----------------------------------------------------------------------
Unix System Administration, System programming, Network Administration


Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Mon Jun 12 06:18:18 2000
Received: by humbolt.nl.linux.org id <S92256AbQFLERf>;
	Mon, 12 Jun 2000 06:17:35 +0200
Received: from cafe.affinity-systems.ab.ca ([139.142.10.12]:44297 "EHLO
        cafe.affinity-systems.ab.ca") by humbolt.nl.linux.org with ESMTP
	id <S92253AbQFLEQ5>; Mon, 12 Jun 2000 06:16:57 +0200
Received: (from jbourne@localhost)
	by cafe.affinity-systems.ab.ca (8.9.3/8.9.3/asi-redhat) id WAA10961;
	Sun, 11 Jun 2000 22:16:00 -0600
Date:   Sun, 11 Jun 2000 22:15:59 -0600 (MDT)
From:   James Bourne <jbourne@affinity-systems.ab.ca>
To:     Bryan Paxton <evil7@bellsouth.net>
cc:     kernel-audit@nl.linux.org
Subject: Re: A proposed model for the audit
In-Reply-To: <Pine.LNX.4.21.0006112006100.839-100000@sqa.speedbros.org>
Message-ID: <Pine.LNX.4.10.10006112209140.10761-100000@cafe.affinity-systems.ab.ca>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

On Sun, 11 Jun 2000, Bryan Paxton wrote:

> Starting kernel:
> A freeze on kernel 2.3.99-pre10-3 a.k.a. 2.4.0-test1
> 
> This kernel contains so many new features and pretty much has all the old ones.
> So that includes new problems and old ones as well. It's only logical to audit 
> this one for two reasons: 
> 1) As stated before, linux moves forwards and not backwards. 
> 2) This is the kernel that is gonna grab the publics attention, hence the mass
> amount of people going to be using this kernel is almost unmesureable. This 
> is going to be the kernel that is going to turn a lot of people over to linux
> IMHO.

:) I know I was pushing for 2.2, but this does make alot of sense too..  

> So where do we start ? Well where would you say the outside of the kernel is ?
> I'd say /usr/src/linux-2.4.0-test1/net 

Also fs/, and the system calls.  net/ would be a good place to start though.

> There's a kernel to audit, a place to start in that kernel, a method of 
> classification, and the way to go when something is found.
> 
> If you've read between the lines on this you'll understand that this model 
> is very simple, as it should be. A security auditing proc needs to be anything
> but complex. Complexity is only useful if you're trying to market an audit, which
> we're not ; )
> 
> All comments/ideas/revisions of this model are encouraged.

Sounds good, so when do we start? :)

Jim

-- 
James Bourne                  | Email:  jbourne@affinity-systems.ab.ca
Affinity Systems Inc.         | WWW: http://www.affinity-systems.ab.ca
Everything Linux              | Linux:  The choice of a GNU generation
----------------------------------------------------------------------
Unix System Administration, System programming, Network Administration


Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Mon Jun 12 06:32:13 2000
Received: by humbolt.nl.linux.org id <S92253AbQFLEbb>;
	Mon, 12 Jun 2000 06:31:31 +0200
Received: from mail0.bna.bellsouth.net ([205.152.150.12]:26515 "EHLO
        mail0.bna.bellsouth.net") by humbolt.nl.linux.org with ESMTP
	id <S92255AbQFLEbC>; Mon, 12 Jun 2000 06:31:02 +0200
Received: from adsl-78-129-55.mem.bellsouth.net (adsl-78-129-55.mem.bellsouth.net [216.78.129.55])
	by mail0.bna.bellsouth.net (3.3.5alt/0.75.2) with ESMTP id AAA19334
	for <kernel-audit@nl.linux.org>; Mon, 12 Jun 2000 00:30:55 -0400 (EDT)
Date:   Sun, 11 Jun 2000 23:27:05 -0500 (CDT)
From:   Bryan Paxton <evil7@bellsouth.net>
X-Sender: evil7@sqa.speedbros.org
To:     kernel-audit@nl.linux.org
Subject: Re: A proposed model for the audit
Message-ID: <Pine.LNX.4.21.0006112326210.606-100000@sqa.speedbros.org>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

I'm gonna kill two birds in one stone with this post

David's reply:

> 
> > A freeze on kernel 2.3.99-pre10-3 a.k.a. 2.4.0-test1
> 
> Do keep in mind these are two different kernels.  Code changed between them.

I wasn't aware that a lot of the code was managled, so ok. Lemme rephrase myself
because I'm a moron. 

A freeze on kernel 2.4.0-test1

> > So where do we start ? Well where would you say the outside of the kernel is ?
> > I'd say /usr/src/linux-2.4.0-test1/net
> 
> I suggest we first develop core categories, I.e. Net, Filesystem, etc, and supporting categories within the cores.
> 

*nod* this is what I had in mind, my original post what a rough draft.
We'll have to work this out....

Maybe even dividing up people into what they would like hack on... 
Or leaving it as it is to let people hack where ever the hell they want to(which
I think is a very bad and messy idea).

End of David's reply

Begin James's reply:

> 
> :) I know I was pushing for 2.2, but this does make alot of sense too..  
> 

: ) Yes it does, to me anyway. But I'm also glad you feel this way(remember i know
where you live.)

> 
> Also fs/, and the system calls.  net/ would be a good place to start though.
>  

Of course.... net/ just seemed the proper way to start.

> 
> Sounds good, so when do we start? :)
> 
> Jim


Well, lets first go with David's comment on setting up the subsystems.
Then agree on a manor of how these subsystems will go: e.g.: Will we have groups ?
And what order shall we go in ?

End James's reply

#EOF

-- 
Bryan Paxton

"How should I know if it works? That's what beta testers are for. I
          only coded it."
 -- Linus Torvalds.




Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Mon Jun 12 06:33:43 2000
Received: by humbolt.nl.linux.org id <S92257AbQFLEcs>;
	Mon, 12 Jun 2000 06:32:48 +0200
Received: from mail1.radix.net ([207.192.128.31]:63373 "EHLO mail1.radix.net")
	by humbolt.nl.linux.org with ESMTP id <S92255AbQFLEbl>;
	Mon, 12 Jun 2000 06:31:41 +0200
Received: from saltmine.radix.net (saltmine.radix.net [207.192.128.40])
	by mail1.radix.net (8.9.3/8.9.3) with ESMTP id AAA17156
	for <kernel-audit@nl.linux.org>; Mon, 12 Jun 2000 00:31:39 -0400 (EDT)
Received: (from dlc@localhost)
	by saltmine.radix.net (8.8.7/8.8.7) id AAA06926;
	Mon, 12 Jun 2000 00:31:36 -0400 (EDT)
From:   "David L. Craig" <dlc@Radix.Net>
Message-Id: <200006120431.AAA06926@saltmine.radix.net>
Subject: Re: suggestion.
In-Reply-To: <20000611224840.A14563@darkstar.netvision> from Marc Esipovich at "Jun 11, 2000 10:48:40 pm"
To:     kernel-audit@nl.linux.org
Date:   Mon, 12 Jun 2000 00:31:36 -0400 (EDT)
Organization: (currently in between situations)
X-Mailer: ELM [version 2.4ME+ PL48 (25)]
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

Marc Esipovich wrote:

> Here is a small list, please add.
> 
>   1.  The binary loaders, a,out, elf...
>   2.  In 2.[24].x kernels, the cap stuff. 
>   3.  proc filesystem.
>   4.  NET (ipv4 for now)
>   5.  Filesystem code, mostly DoS and data
>       corruption. this will require people
>       who know their way around filesystems,
>       not for the general auditing crowd.
>   6.  Stress testing the kernel in every
>       imaginable way is bound to find
>       *something*, be creative.

If we are not also auditing the tools that
process this code into objects and
executables, we're fooling ourselves about
kernel security.

Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Mon Jun 12 07:51:35 2000
Received: by humbolt.nl.linux.org id <S92261AbQFLFuS>;
	Mon, 12 Jun 2000 07:50:18 +0200
Received: from mail0.bna.bellsouth.net ([205.152.150.12]:32712 "EHLO
        mail0.bna.bellsouth.net") by humbolt.nl.linux.org with ESMTP
	id <S92260AbQFLFtd>; Mon, 12 Jun 2000 07:49:33 +0200
Received: from adsl-78-129-55.mem.bellsouth.net (adsl-78-129-55.mem.bellsouth.net [216.78.129.55])
	by mail0.bna.bellsouth.net (3.3.5alt/0.75.2) with ESMTP id BAA10396
	for <kernel-audit@nl.linux.org>; Mon, 12 Jun 2000 01:49:31 -0400 (EDT)
Date:   Mon, 12 Jun 2000 00:45:41 -0500 (CDT)
From:   Bryan Paxton <evil7@bellsouth.net>
X-Sender: evil7@sqa.speedbros.org
To:     kernel-audit@nl.linux.org
Subject: 300 subscribed!
Message-ID: <Pine.LNX.4.21.0006120044400.698-100000@sqa.speedbros.org>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

yes that's right...

After only a few days(roughly 3) we have 300 users subscribed!

Lets keep this up, and get it rolling internally. 


-- 
Bryan Paxton

"How should I know if it works? That's what beta testers are for. I
          only coded it."
 -- Linus Torvalds.




Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Mon Jun 12 08:35:37 2000
Received: by humbolt.nl.linux.org id <S92260AbQFLGe2>;
	Mon, 12 Jun 2000 08:34:28 +0200
Received: from mail1.bna.bellsouth.net ([205.152.150.13]:62356 "EHLO
        mail1.bna.bellsouth.net") by humbolt.nl.linux.org with ESMTP
	id <S92171AbQFLGeD>; Mon, 12 Jun 2000 08:34:03 +0200
Received: from adsl-78-129-55.mem.bellsouth.net (adsl-78-129-55.mem.bellsouth.net [216.78.129.55])
	by mail1.bna.bellsouth.net (3.3.5alt/0.75.2) with ESMTP id CAA00255
	for <kernel-audit@nl.linux.org>; Mon, 12 Jun 2000 02:34:02 -0400 (EDT)
Date:   Mon, 12 Jun 2000 01:30:12 -0500 (CDT)
From:   Bryan Paxton <evil7@bellsouth.net>
X-Sender: evil7@sqa.speedbros.org
To:     kernel-audit@nl.linux.org
Subject: lkap.org!
Message-ID: <Pine.LNX.4.21.0006120124570.771-100000@sqa.speedbros.org>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

Thanks to Peter @ bsod.net we have lkap.org...
The site is hosted on source forge..

This site is very very choppy right now, but I and some other people are
working on this. If you would like to contribute simple 'wget -r
www.lkap.org' hack it up, post it somewhere or mail _ME_ not the list some
of the files you've changed/added/whatever.

I would like to thank ??? for the logo... I had yet another bad crash with
ac13(am now running ac15) and lost some files...
So whoever sent me the the beautiful logo, please step forward so I may
give you proper credits on the site and on this list.

Thanks a bunch

Let's a keep up the good work!

-- 
Bryan Paxton

"How should I know if it works? That's what beta testers are for. I
          only coded it."
 -- Linus Torvalds.




Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Mon Jun 12 08:47:07 2000
Received: by humbolt.nl.linux.org id <S92262AbQFLGqL>;
	Mon, 12 Jun 2000 08:46:11 +0200
Received: from mb03.swip.net ([193.12.122.217]:14490 "EHLO mb03.swip.net")
	by humbolt.nl.linux.org with ESMTP id <S92171AbQFLGpi>;
	Mon, 12 Jun 2000 08:45:38 +0200
Received: from lola (d212-151-104-45.swipnet.se [212.151.104.45]) 
          by mb03.swip.net (8.8.8/8.8.8) with ESMTP 
          id IAA00555; 
          Mon, 12 Jun 2000 08:45:04 +0200 (MET DST)
Received: from jens by lola with local (Exim 3.12 #1 (Debian))
	id 131Nxk-0007Wi-00; Mon, 12 Jun 2000 08:44:44 +0200
Date:   Mon, 12 Jun 2000 08:44:43 +0200
From:   jens persson <jens@persson.cx>
To:     kernel-audit@nl.linux.org
Cc:     mmurray@fscinternet.com
Subject: Re: Remote DOS in linux rpc.lockd
Message-ID: <20000612084443.A28662@lola>
References: <XFMail.20000608153842.mmurray@fscinternet.com>
Mime-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-md5;
	protocol="application/pgp-signature"; boundary="u3/rZRmxL6MmkK24"
User-Agent: Mutt/1.0.1i
In-Reply-To: <XFMail.20000608153842.mmurray@fscinternet.com>; from mmurray@FSCINTERNET.COM on Thu, Jun 08, 2000 at 03:38:42PM -0400
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list


--u3/rZRmxL6MmkK24
Content-Type: text/plain; charset=iso-8859-1
Content-Transfer-Encoding: quoted-printable


Hello!=20

I found the attached message on Bugtraq, and thought it to be
a good starting point for the audit, just to get something=20
going.

I have then repeted the test on my machine (Debian GNU/Linux
frozen with 2.2.14) that is also vunerable.

IANAKH[1] but looking trouh the code I found that the=20
log messages comes from the following files (I'm using the 2.2.16
code but this sections hasen't changed since 2.2.12 which is
the oldest kernel in my current cvs).

net/sunrpc/svcsock.c: svc_tcp_recvfrom()

=2E..
	/* Receive data. If we haven't got the record length yet, get
	 * the next four bytes. Otherwise try to gobble up as much as
	 * possible up to the complete record length.
	 */
	if (svsk->sk_tcplen < 4) {
		unsigned long   want =3D 4 - svsk->sk_tcplen;
		struct iovec    iov;

		iov.iov_base =3D ((char *) &svsk->sk_reclen) + svsk->sk_tcplen;
		iov.iov_len  =3D want;
		if ((len =3D svc_recvfrom(rqstp, &iov, 1, want)) < 0)
			goto error;
		svsk->sk_tcplen +=3D len;

		svsk->sk_reclen =3D ntohl(svsk->sk_reclen);
		if (!(svsk->sk_reclen & 0x80000000)) {
			/* FIXME: shutdown socket */
			printk(KERN_NOTICE "RPC: bad TCP reclen %08lx",
				(unsigned long) svsk->sk_reclen);
			return -EIO;
		}
		svsk->sk_reclen &=3D 0x7fffffff;
		dprintk("svc: TCP record, %d bytes\n", svsk->sk_reclen);
	}
=2E..

fs/lockd/svc.c: lockd()
=2E..
	/*
	* Find a socket with data available and call its
	* recvfrom routine.
	*/
	if ((err =3D svc_recv(serv, rqstp, timeout)) =3D=3D -EAGAIN)
		continue;
	if (err < 0) {
		if (err !=3D -EINTR)
			printk(KERN_WARNING
				"lockd: terminating on error %d\n",
				-err);
		break;
	}
=2E..

=46rom what my reading of the source, svc_tcp_recvfrom() takes care of the
data and checks if the network data has a bit set and if not, aborts
without shuting down the socket. lockd() then gets the errorcode but
does not check for this value (-EIO) and then teminates the service.

I think that the solution would be to expand the error checking in=20
lockd so that it just resets the connection (or some souch) if it gets
noice on the connection and to implement the shutdown of the socket in
rpc over tcp.

I will now start to set up a machine to test new kernels on so that my
main machine don't get fsckd up by my kernel patches :-).

/jp

[1] I am not a kernel hacker


--=20
 jens persson         #      Good coding practice would accomplish
 <jens@persson.cx>    #     this goal, but good programming practice
 =C4nggatan 3b          #       can sometimes be in short supply, and
 S-233 59 LUND;SWEDEN #         mandatory discipline makes a fair
                      #        substitute.           - Todd Lewis
      GPG key: 3552 185A 4C55 0AC5 E8A0  FAF3 C846 57F6 2FBE BC81



On Thu, Jun 08, 2000 at 03:38:42PM -0400, mmurray@FSCINTERNET.COM wrote:
>=20
> Hello, all...
>=20
>         Found what appears to be a remote DOS in the linux kernel code fo=
r NFS
> lockd.  Only requires a restart of the service, but the port stays bound =
(in a
> iclose_wait) state for what appears to be an indefinite time.  I have only
> tested this in RedHat 6.1 and 6.2 (that is, kernel 2.2.12 and 2.2.14), bu=
t I
> see no reason why it will not be present in other configurations of both =
the
> same kernel (and likely earlier kernels).
> The proof of concept is really simple: If you have port access (i.e. you =
are
> able to send packets to whatever port rpc.lockd is running on) to a Redha=
t 6.2
> machine running rpc.lockd (enabled by the default install), you can forci=
bly
> stop rpc.lockd from responding on that machine.
>         The lockd crashes whenever any malformed request is issued to it =
over
> its tcp channel; thus, if you simply connect to the tcp port that lockd is
> listening on, and hit 'return', and log out, you will have crashed lockd.
>=20
>         As an example, from a root prompt on my laptop, I issued the foll=
owing
> (where "target" is a machine running a fresh install of RH 6.2 up2date):
>=20
> [root@hiro /]# rpcinfo -p target
>    program vers proto   port
>     100000    2   tcp    111  portmapper
>     100000    2   udp    111  portmapper
>     100021    1   udp   1024  nlockmgr
>     100021    3   udp   1024  nlockmgr
>     100021    1   tcp   1024  nlockmgr
>     100021    3   tcp   1024  nlockmgr
>     100024    1   udp    831  status
>     100024    1   tcp    833  status
> [root@hiro /]# nc -p 1000 target 1024
> alksdjfalskdjfsdafs
>         Here, I issued a Ctrl-C to get out of netcat, and got:
> punt!
> [root@hiro /]#
> [root@hiro /]# rpcinfo -p target
>    program vers proto   port
>     100000    2   tcp    111  portmapper
>     100000    2   udp    111  portmapper
>     100024    1   udp    831  status
>     100024    1   tcp    833  status
> [root@hiro /]#
>=20
>         In the victim's /var/log/messages, the following message was writ=
ten:
> June  7 15:07:48 target kernel: RPC: bad TCP reclen 616c6b73<4>lockd:
> terminating on error 5
> June  7 15:07:48 target kernel: svc: server socket destroy delayed (sk_in=
use: 1)
>=20
>         As well, even with a restart of lockd, the original port (1024) i=
sn't
> ever freed (it stays in CLOSE_WAIT) as far as I can tell (although I'm ab=
out to
> go out for lunch, return, and check then).
>=20
>         As you can see, the service is no longer present after the port h=
as
> been connected to.
>=20
>                         Mike


--u3/rZRmxL6MmkK24
Content-Type: application/pgp-signature

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.1 (GNU/Linux)
Comment: For info see http://www.gnupg.org

iD8DBQE5RIbbyEZX9i++vIERAaWZAJ0YNvyPpqKqN6iHCC2Tjydmrs/wEQCcCqbT
RPdmIhFYlVYXCAYJBBPHnSI=
=nfsS
-----END PGP SIGNATURE-----

--u3/rZRmxL6MmkK24--

Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Mon Jun 12 09:03:57 2000
Received: by humbolt.nl.linux.org id <S92263AbQFLHCh>;
	Mon, 12 Jun 2000 09:02:37 +0200
Received: from smtp.kolej.mff.cuni.cz ([195.113.25.225]:29702 "EHLO
        smtp.kolej.mff.cuni.cz") by humbolt.nl.linux.org with ESMTP
	id <S92171AbQFLHBz>; Mon, 12 Jun 2000 09:01:55 +0200
Received: from p75.kolej.mff.cuni.cz (p75.kolej.mff.cuni.cz [195.113.27.52])
	by smtp.kolej.mff.cuni.cz (8.9.2/8.9.0) with ESMTP id IAA65776
	for <kernel-audit@nl.linux.org>; Mon, 12 Jun 2000 08:21:02 +0200 (CEST)
Received: by p75.kolej.mff.cuni.cz (Postfix, from userid 500)
	id C225D21D5; Mon, 12 Jun 2000 08:21:01 +0200 (CEST)
Date:   Mon, 12 Jun 2000 08:21:01 +0200
From:   Martin Macok <martin.macok@underground.cz>
To:     kernel-audit@nl.linux.org
Subject: Start with documentation?
Message-ID: <20000612082101.B1148@p75.kolej.mff.cuni.cz>
Reply-To: macok@kocour.ms.mff.cuni.cz
Mail-Followup-To: kernel-audit@nl.linux.org
References: <394434FB.983C8165@geocities.com>
Mime-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-md5;
	protocol="application/pgp-signature"; boundary="DBIVS5p969aUjpLe"
Content-Disposition: inline
User-Agent: Mutt/1.2i
In-Reply-To: <394434FB.983C8165@geocities.com>; from chriton@geocities.com on Sun, Jun 11, 2000 at 08:55:23PM -0400
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list


--DBIVS5p969aUjpLe
Content-Type: text/plain; charset=iso-8859-2
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Sun, Jun 11, 2000 at 08:55:23PM -0400, Chris and Tony wrote:
> 4) to what extent should LKAP be pursuing enhanced documentation.
[snip]
> 4) To the highest degree! Documentation helps prevent all sorts of
> security problems. Many security problems arise when one bit of code
> calls another bit that isn't understood well by the coder who writes the
> calling function. We should also document things we find to be secure
> and why so that coders who revisit the code don't accidentally optimize
> out security without first thinking about. In addition to the security
> ramifications of good documentation, it also adds a lot of value to the
> community making it easier for everyone to maintain and extend. Since we
> will be taking the time to understand everything in detail, we might as
> well document it well. This will also benefit us when we have to reaudit
> code due to changes or simply because someone has some spare time. Also,
> the 3/4 of the people on this list who aren't hard-core hackers might
> very well be capable of documenting the code better or more efficiently
> than the code auditors. We might as well put them all to work!

So I think this is a right place for start. Create documentation of
routines, semantics, structures and interfaces of lk. When we are done
with documentation, everybody can audit anything ...

I cannot imagine how to audit A, which calls something other from B and
which probably calls something others from C and D ... without having a
paper/docs that interface between A<->B is thisandthat, semantics is
thisandthat and documentation of that doB() does exactly thisandthat and
really doesn't do something different.

Without documentation - it would be chaos, everybody would be reinventing
the wheels (everybody auditing A must reinvent what really doB() means
etc.). It would be nice to look at docs, found what doB() does (and
preferably why) and continue with auditing A.

Auditing should be a process of proving that kernel do exactly what is in
documentation and it doesn't do less or more. Not just finding bugs or
overflows ...

With real documentation it could be possible to clearly detect design
flaws, and it would be the very good thing for kernel newbies hackers but
also for experienced and also for commercial vendors creating drivers etc.

Just my opinion. I see the lack of real documentation every day.

--=20
< Martin Ma=E8ok        martin.macok@underground.cz           <iso-8859-2>=
=20
  \\  http://kocour.ms.mff.cuni.cz/~macok/  http://underground.cz/  //
    \\\             -=3D  t.r.u.s.t  n.0  o.n.e  =3D-                ///

--DBIVS5p969aUjpLe
Content-Type: application/pgp-signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.1 (GNU/Linux)
Comment: For info see http://www.gnupg.org

iD8DBQE5RIFM9uSLtLrzBfMRAg2BAJ9mytbGoljguV2dVg8QoU+Oe1j2+gCgi5kT
5W7wZhqi0jroJqSMjy6iIGY=
=UU46
-----END PGP SIGNATURE-----

--DBIVS5p969aUjpLe--

Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Mon Jun 12 09:13:14 2000
Received: by humbolt.nl.linux.org id <S92264AbQFLHLt>;
	Mon, 12 Jun 2000 09:11:49 +0200
Received: from ns1.linuxpron.com ([63.89.111.2]:29712 "EHLO ns1.linuxpron.com")
	by humbolt.nl.linux.org with ESMTP id <S92171AbQFLHLY>;
	Mon, 12 Jun 2000 09:11:24 +0200
Received: from ns1.linuxpron.com (pgpkeys@ns1.linuxpron.com [63.89.111.2])
	by ns1.linuxpron.com (8.9.3/8.9.3) with ESMTP id CAA03331;
	Mon, 12 Jun 2000 02:08:00 -0500
Date:   Mon, 12 Jun 2000 02:08:00 -0500 (CDT)
From:   "David D.W. Downey" <pgpkeys@codecastle.com>
X-Sender: pgpkeys@ns1.linuxpron.com
To:     Bryan Paxton <evil7@bellsouth.net>
cc:     kernel-audit@nl.linux.org
Subject: Re: 300 subscribed!
In-Reply-To: <Pine.LNX.4.21.0006120044400.698-100000@sqa.speedbros.org>
Message-ID: <Pine.LNX.4.20.0006120206190.3322-100000@ns1.linuxpron.com>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list


I'd like to assist in the auditing, but I will need about a week or so to
roll into a new position I've taken in the Silicon Valley area. 

Could any of the group leaders give me an idea of what batch of files you
would like to assign to me for review and auditing? Also, where is the
criterium sheet for audits?

On Mon, 12 Jun 2000, Bryan Paxton wrote:

> yes that's right...
> 
> After only a few days(roughly 3) we have 300 users subscribed!
> 
> Lets keep this up, and get it rolling internally. 
> 
> 
> -- 
> Bryan Paxton
> 
> "How should I know if it works? That's what beta testers are for. I
>           only coded it."
>  -- Linus Torvalds.
> 
> 
> 
> 
> Kernel-audit:  discussion list for security and the linux kernel
> Archive:       http://mail.nl.linux.org/kernel-audit/
> 


Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Mon Jun 12 09:28:06 2000
Received: by humbolt.nl.linux.org id <S92265AbQFLH0t>;
	Mon, 12 Jun 2000 09:26:49 +0200
Received: from mail0.bna.bellsouth.net ([205.152.150.12]:20352 "EHLO
        mail0.bna.bellsouth.net") by humbolt.nl.linux.org with ESMTP
	id <S92171AbQFLH0I>; Mon, 12 Jun 2000 09:26:08 +0200
Received: from adsl-78-129-55.mem.bellsouth.net (adsl-78-129-55.mem.bellsouth.net [216.78.129.55])
	by mail0.bna.bellsouth.net (3.3.5alt/0.75.2) with ESMTP id DAA07408
	for <kernel-audit@nl.linux.org>; Mon, 12 Jun 2000 03:26:06 -0400 (EDT)
Date:   Mon, 12 Jun 2000 02:22:16 -0500 (CDT)
From:   Bryan Paxton <evil7@bellsouth.net>
X-Sender: evil7@sqa.speedbros.org
To:     kernel-audit@nl.linux.org
Subject: Re: Start with Documentation?
Message-ID: <Pine.LNX.4.21.0006120221130.942-100000@sqa.speedbros.org>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

heh noone has a thing against documentation...
Who's willing to take the time out to write it is the question at
hand.......



-- 
Bryan Paxton

"How should I know if it works? That's what beta testers are for. I
          only coded it."
 -- Linus Torvalds.




Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Mon Jun 12 09:33:24 2000
Received: by humbolt.nl.linux.org id <S92268AbQFLHb7>;
	Mon, 12 Jun 2000 09:31:59 +0200
Received: from mail0.bna.bellsouth.net ([205.152.150.12]:62082 "EHLO
        mail0.bna.bellsouth.net") by humbolt.nl.linux.org with ESMTP
	id <S92267AbQFLHbO>; Mon, 12 Jun 2000 09:31:14 +0200
Received: from adsl-78-129-55.mem.bellsouth.net (adsl-78-129-55.mem.bellsouth.net [216.78.129.55])
	by mail0.bna.bellsouth.net (3.3.5alt/0.75.2) with ESMTP id DAA10106
	for <kernel-audit@nl.linux.org>; Mon, 12 Jun 2000 03:31:12 -0400 (EDT)
Date:   Mon, 12 Jun 2000 02:27:22 -0500 (CDT)
From:   Bryan Paxton <evil7@bellsouth.net>
X-Sender: evil7@sqa.speedbros.org
To:     kernel-audit@nl.linux.org
Subject: Re: 300 subscribed!
Message-ID: <Pine.LNX.4.21.0006120223310.947-100000@sqa.speedbros.org>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list


On Mon, 12 Jun 2000, David D.W. Downey wrote:
> I'd like to assist in the auditing, but I will need about a week or so to
> roll into a new position I've taken in the Silicon Valley area. 
> 
> Could any of the group leaders give me an idea of what batch of files you
> would like to assign to me for review and auditing? Also, where is the
> criterium sheet for audits?
> 

I think everyone is trying to come to an agreement on how this is going to
be done. If you can't look back at the previous post via your mailer.
Check out the kernel-audit mail archives
http://mail.nl.linux.org/kernel-audit

Post you'll wanna look at are "Where do we start?" and possibly my
proposal for the audit.

And as of right now, there really aren't any "group leaders" per say.

That's something that will also have to be figured out.

And I'll probally post about that soon.


-- 
Bryan Paxton

"How should I know if it works? That's what beta testers are for. I
          only coded it."
 -- Linus Torvalds.




Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Mon Jun 12 09:49:54 2000
Received: by humbolt.nl.linux.org id <S92266AbQFLHsj>;
	Mon, 12 Jun 2000 09:48:39 +0200
Received: from zigana.eee.metu.edu.tr ([144.122.166.20]:30867 "HELO
        zigana.eee.metu.edu.tr") by humbolt.nl.linux.org with SMTP
	id <S92171AbQFLHsH>; Mon, 12 Jun 2000 09:48:07 +0200
Received: (qmail 19022 invoked by alias); 12 Jun 2000 07:40:30 -0000
Message-ID: <20000612074030.19021.qmail@zigana.eee.metu.edu.tr>
Received: (qmail 19014 invoked from network); 12 Jun 2000 07:40:30 -0000
Received: from ea.eee.metu.edu.tr (144.122.166.11)
  by zigana.eee.metu.edu.tr with SMTP; 12 Jun 2000 07:40:30 -0000
Received: from EA1_EEE/SpoolDir by ea.eee.metu.edu.tr (Mercury 1.44);
    12 Jun 00 10:52:46 GMT+0200
Received: from SpoolDir by EA1_EEE (Mercury 1.44); 12 Jun 00 10:52:11 GMT+0200
From:   "Can Erkin Acar" <canacar@ea.eee.metu.edu.tr>
Organization: EE Dept. METU
To:     kernel-audit@nl.linux.org
Date:   Mon, 12 Jun 2000 10:52:06 +0300
MIME-Version: 1.0
Content-type: text/plain; charset=US-ASCII
Content-transfer-encoding: 7BIT
Subject: Re: Start with Documentation?
In-reply-to: <Pine.LNX.4.21.0006120221130.942-100000@sqa.speedbros.org>
X-mailer: Pegasus Mail for Win32 (v3.12a)
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

On 12 Jun 00, at 2:22, Bryan Paxton wrote:

> heh noone has a thing against documentation...
> Who's willing to take the time out to write it is the question at
> hand.......
> 

Perhaps we should have a template for documenting functions.

the template would contain fields like:
- Function name, description, location (source file)
- maintainer if known (i.e. who wrote that function) 
- arguments and return values
- global variables/locks used by the function
- things to note when calling this function (i.e. do not call
  with a null argument etc.)
- other auditor notes.

A list of auditors would be nice (changelog format?)

whenever someone audits a part of code he can update the 
related documentation. thus documentation improves with audit.

there would be an accompanying doc file for each source file 
and these could be maintained as a CVS repository. To allow
easy access by all auditors (this would also take care of change 
history)

web based cvs access with search capabilities would be really useful.

just some ideas ...

Can Acar





--=< Can Erkin Acar (canacar@bigfoot.com) >=--

Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Mon Jun 12 10:49:21 2000
Received: by humbolt.nl.linux.org id <S92270AbQFLIsE>;
	Mon, 12 Jun 2000 10:48:04 +0200
Received: from lemuria.borgfelde.ricardo.de ([195.244.103.65]:12561 "HELO
        mail.lemuria.org") by humbolt.nl.linux.org with SMTP
	id <S92171AbQFLIrf>; Mon, 12 Jun 2000 10:47:35 +0200
Received: from lemuria.org by mail.lemuria.org
	via rsmtp with bsmtp
	id <m131Po1-0015vlC@mail.lemuria.org>
	for <kernel-audit@nl.linux.org>; Mon, 12 Jun 2000 10:42:49 +0200 (MEST)
	(Smail-3.2 1996-Jul-4 #1 built 1999-Nov-8)
Received: by lemuria.org
	via sendmail with stdio
	id <m131PSv-000HioC@lemuria.org>
	for kernel-audit@nl.linux.org; Mon, 12 Jun 2000 10:21:01 +0200 (MEST)
	(Smail-3.2 1996-Jul-4 #1 built 1999-Nov-8)
Date:   Mon, 12 Jun 2000 10:21:01 +0200
From:   Tom Vogt <tom@lemuria.org>
To:     kernel-audit@nl.linux.org
Subject: Re: suggestion
Message-ID: <20000612102101.A23592@lemuria.org>
References: <200006112234.AAA22881@octopus.phy.bg.ac.yu> <39441F44.nailUT1Z8J86@ed.ed>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
X-Mailer: Mutt 1.0pre3i
In-Reply-To: <39441F44.nailUT1Z8J86@ed.ed>
X-Privacy: If you can, please encrypt your mails - finger for key
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

root <evpopkov@carry.neonet.lv> wrote:
>  We will be  doing what is already  done, all the time,  otherwise why this
> project? 2.4.x will stabilize and mature,  sooner or later, like 2.0.x did,
> so why bother?

because the code is currently being reviewed and tested for function, not
for correctness and security.

I would like to suggest that we take one specific kernel version that is in
widespread use TODAY and concentrate on it. in order to avoid duplication
of efforts, we should follow along with future versions (i.e. read the
changelog) but stick with the kernel we have choosen.

there are three reasons for this:

1) it's a hell of a lot easier and less time consuming, because you don't
have to constantly re-evaluate everything
2) it's what people experienced in this kind of work do - see *BSD,
especially OpenBSD. does anyone remember their kernel-schedule?
3) there's no real reason to NOT do it this way. the very large majority of
production systems are frozen at a some (usually arbitrary) version
anyways. you do NOT have to keep up with the latest kernel release in order
to satisfy the vast majority of servers out there. it's desktop and testing
machines that are in flux.


-- 
Welcome to the Information Superspyway

Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Mon Jun 12 10:51:07 2000
Received: by humbolt.nl.linux.org id <S92171AbQFLIsc>;
	Mon, 12 Jun 2000 10:48:32 +0200
Received: from lemuria.borgfelde.ricardo.de ([195.244.103.65]:12817 "HELO
        mail.lemuria.org") by humbolt.nl.linux.org with SMTP
	id <S92267AbQFLIrg>; Mon, 12 Jun 2000 10:47:36 +0200
Received: from lemuria.org by mail.lemuria.org
	via rsmtp with bsmtp
	id <m131Po1-0015wKC@mail.lemuria.org>
	for <kernel-audit@nl.linux.org>; Mon, 12 Jun 2000 10:42:49 +0200 (MEST)
	(Smail-3.2 1996-Jul-4 #1 built 1999-Nov-8)
Received: by lemuria.org
	via sendmail with stdio
	id <m131Pdy-000HioC@lemuria.org>
	for kernel-audit@nl.linux.org; Mon, 12 Jun 2000 10:32:26 +0200 (MEST)
	(Smail-3.2 1996-Jul-4 #1 built 1999-Nov-8)
Date:   Mon, 12 Jun 2000 10:32:26 +0200
From:   Tom Vogt <tom@lemuria.org>
To:     kernel-audit@nl.linux.org
Subject: Re: Why all this effort?
Message-ID: <20000612103226.B23592@lemuria.org>
References: <394434FB.983C8165@geocities.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
X-Mailer: Mutt 1.0pre3i
In-Reply-To: <394434FB.983C8165@geocities.com>
X-Privacy: If you can, please encrypt your mails - finger for key
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

Chris and Tony <chriton@geocities.com> wrote:
> 2) should LKAP audit only the linux kernel or should concern itself with
> 
> GNU utilities or even more?

there is already a project to audit userspace tools, LSAP (www.lsap.org)


> 3) should LKAP be concerned with adding security enhancing functionality
> to the code or systems it audits?

I don't think so. there's about two dozen security-related kernel patches
out there somewhere, many of them incompatible with each other. where's the
bonus in creating a 25th?


> 4) to what extent should LKAP be pursuing enhanced documentation.

documentation is a pre-requisite for security. you need to understand the
process in order to see whether it's safe or not. you need documentation to
understand the process, unless you wrote the code yourself (which is, of
course, the reason why we don't have as much docs as we'd like to have).


> 5) should LKAP pool it's efforts with any similar projects or work in
> parallel?

yes. do not underestimate the effort this will take. anyone who thinks that
you can keep up with the kernel schedule should take the current 2.3.x and
diff it against the previous version, then try to UNDERSTAND all changes
before the next one appears.



-- 
Welcome to the Information Superspyway

Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Mon Jun 12 11:06:39 2000
Received: by humbolt.nl.linux.org id <S92269AbQFLJFq>;
	Mon, 12 Jun 2000 11:05:46 +0200
Received: from mrl.vipnet.hr ([195.29.159.14]:53212 "EHLO ita5.vipnet.hr")
	by humbolt.nl.linux.org with ESMTP id <S92267AbQFLJFJ>;
	Mon, 12 Jun 2000 11:05:09 +0200
Received: from zsfax.vipnet.hr (zsfax.vipnet.hr [10.243.149.10])
	by ita5.vipnet.hr (8.9.3/8.9.3/SS) with ESMTP id LAA25390
	for <kernel-audit@nl.linux.org>; Mon, 12 Jun 2000 11:05:03 +0200 (METDST)
Received: by zsfax.vipnet.hr with Internet Mail Service (5.5.2650.21)
	id <M4PK6431>; Mon, 12 Jun 2000 11:04:39 +0200
Message-ID: <FFDEEF271A0DD311AE63009027454391B3A5B7@zsdat03.vipnet.hr>
From:   Radoslav Dejanovic <r.dejanovic@vipnet.hr>
To:     kernel-audit@nl.linux.org
Subject: RE: suggestion
Date:   Mon, 12 Jun 2000 11:04:37 +0200
MIME-Version: 1.0
X-Mailer: Internet Mail Service (5.5.2650.21)
Content-Type: text/plain;
	charset="iso-8859-1"
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

> 3) there's no real reason to NOT do it this way. the very 
> large majority of
> production systems are frozen at a some (usually arbitrary) version
> anyways. you do NOT have to keep up with the latest kernel 

While this is true, we can still talk about it. Like the latest bug in the
kernel - it doesn't require
all machines to go to 2.2.16 - you can as well disable affected services.
But if you concentrate 
on,say, 2.2.0 kernel, things like that might force you to jump to 2.2.16 and
start again. 

IMHO, having a system that is somehow open to the world and not having fresh
kernel is often a call
for disaster. 

One more issue is the fact that many users do keep up to the latest kernel.
Desktop users and alike are 
more "vulnerable" to problems, because experienced administrators usualy
know what they're doing, and are
able to decide if some vulnerability can give them headaches or not. 

Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Mon Jun 12 14:16:12 2000
Received: by humbolt.nl.linux.org id <S92278AbQFLMOf>;
	Mon, 12 Jun 2000 14:14:35 +0200
Received: from 88.131.fl1.ip.foni.net ([212.7.131.88]:11268 "EHLO
        neuromancer.localdomain") by humbolt.nl.linux.org with ESMTP
	id <S92168AbQFLMON>; Mon, 12 Jun 2000 14:14:13 +0200
Received: from localhost (vrattel@localhost)
	by neuromancer.localdomain (8.9.3/8.9.3) with ESMTP id OAA01415
	for <kernel-audit@nl.linux.org>; Mon, 12 Jun 2000 14:17:02 +0200
X-Authentication-Warning: neuromancer.localdomain: vrattel owned process doing -bs
Date:   Mon, 12 Jun 2000 14:17:02 +0200 (CEST)
From:   Volker Rattel <vrattel@foni.net>
X-Sender: vrattel@neuromancer.localdomain
To:     kernel-audit@nl.linux.org
Subject: Some thoughts on standards
Message-ID: <Pine.LNX.4.21.0006121353230.1407-100000@neuromancer.localdomain>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

After reading this list a few days, I would like to make some
suggestions on coordinating the flow of information:

There should be a 'checkout list' on lkap.org. The purpose is to
overview who is currently reviewing what part of code. Taking this
list would produce an more or less accurate project status. This could
also be used to coordinate the process of auditing.

The idea of a general audit template is a must. Results of an audit
session have to be compareable. There should also be a 'guide' or
'howto' thing which explains in what steps a code audit takes place.

I think that the overall goal should be a 'simple to contribute'
project with 'self-explaining' steps, howto get the information I want
and howto contribute the bugs I've found.

Anyone?

-- 

Volker Rattel
---------------------------------------------------
                      The net is vast and infinite.


Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Mon Jun 12 15:14:30 2000
Received: by humbolt.nl.linux.org id <S92281AbQFLNNE>;
	Mon, 12 Jun 2000 15:13:04 +0200
Received: from octopus.phy.bg.ac.yu ([147.91.80.4]:21020 "EHLO
        octopus.phy.bg.ac.yu") by humbolt.nl.linux.org with ESMTP
	id <S92279AbQFLNMf>; Mon, 12 Jun 2000 15:12:35 +0200
Received: (from lynx@localhost)
	by octopus.phy.bg.ac.yu (8.9.0/8.9.0) id PAA31449;
	Mon, 12 Jun 2000 15:13:04 +0200
Date:   Mon, 12 Jun 2000 15:13:04 +0200
From:   Boris Dragovic <lynx@phy.bg.ac.yu>
Message-Id: <200006121313.PAA31449@octopus.phy.bg.ac.yu>
To:     kernel-audit@nl.linux.org, tom@lemuria.org
Subject: Re: suggestion
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

	3) there's no real reason to NOT do it this way. the very large majority of
	production systems are frozen at a some (usually arbitrary) version
	anyways. you do NOT have to keep up with the latest kernel release in order
	to satisfy the vast majority of servers out there. it's desktop and testing
	machines that are in flux.

I completely disagree... People wo are concerned with security are constantly
following and installing the new kernel versions. People who are still 
running 2.0.x or any not latest version of kernel and who are lazy to
upgrade won't bother to use our patches anyway... so I think we should 
start with current...

IMHO
lynx


Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Mon Jun 12 15:43:37 2000
Received: by humbolt.nl.linux.org id <S92169AbQFLNmR>;
	Mon, 12 Jun 2000 15:42:17 +0200
Received: from carry.netneo.com ([195.62.128.21]:4358 "EHLO carry.neonet.lv")
	by humbolt.nl.linux.org with ESMTP id <S92170AbQFLNlo>;
	Mon, 12 Jun 2000 15:41:44 +0200
Received: from ed.ed (as0h.netneo.com [195.62.135.199])
	by carry.neonet.lv (8.9.3/8.9.3) with ESMTP id PAA31425
	for <kernel-audit@nl.linux.org>; Mon, 12 Jun 2000 15:40:59 +0200
Received: (from root@localhost)
	by ed.ed (8.8.7/8.8.5) id NAA00336
	for kernel-audit@nl.linux.org; Mon, 12 Jun 2000 13:28:41 GMT
From:   root <evpopkov@carry.neonet.lv>
Date:   Mon, 12 Jun 2000 13:28:40 +0000
To:     kernel-audit@nl.linux.org
Subject: Re: suggestion
Message-ID: <3944E588.nail871QZKVG@ed.ed>
References: <200006112234.AAA22881@octopus.phy.bg.ac.yu>
 <39441F44.nailUT1Z8J86@ed.ed> <20000612102101.A23592@lemuria.org>
X-Mailer: nail 9.13 2000-05-30
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

> because the code is currently being reviewed and tested for function, not
> for correctness and security.

 Well, the question was rhetoric. However, from the tester's point of view,
is functional code correct?

> I would like to suggest that we  take one specific kernel version that is
> in
> widespread use TODAY and concentrate on it. in order to avoid duplication
> of efforts, we should follow along with future versions (i.e. read the
> changelog) but stick with the kernel we have choosen.
>
> there are three reasons for this:
>
> 1) it's a hell of a lot easier and less time consuming, because you don't
> have to constantly re-evaluate everything

 You contradict  yourself. Newer  releases will  introduce new  portions of
code and we'll have to start over again each time.

> 2) it's what people experienced in this kind of work do - see *BSD,
> especially OpenBSD. does anyone remember their kernel-schedule?

 Not me. I  don't know much of  *BSD. I'm trying to figure  what _we_ would
need, not them.

> 3) there's no real reason to NOT do it this way.

 Same as there's no reason not to start with the code that won't be changed
and proceed to the evolving versions.

> the very large majority of
> production systems are frozen at a some (usually arbitrary) version
> anyways.

 Yes. My production system is frozen  at 2.0.38. But that's not a majority.
We don't have exact  figures at hand, so let's not  appeal to any whimsical
majority.


---

 "Teddy - I suppose Mummy and Daddy are real, aren't they?"
 Teddy said, "You ask such silly questions, David. Nobody knows what
'real' really means. Let's go indoors."

 Brian W. Aldiss, Supertoys Last All Summer Long


Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Mon Jun 12 15:47:54 2000
Received: by humbolt.nl.linux.org id <S92170AbQFLNqS>;
	Mon, 12 Jun 2000 15:46:18 +0200
Received: from brutus.conectiva.com.br ([200.250.58.146]:27890 "EHLO
        duckman.distro.conectiva") by humbolt.nl.linux.org with ESMTP
	id <S92274AbQFLNph>; Mon, 12 Jun 2000 15:45:37 +0200
Received: from localhost (riel@localhost)
	by duckman.distro.conectiva (8.9.3/8.8.7) with ESMTP id KAA22070
	for <kernel-audit@nl.linux.org>; Mon, 12 Jun 2000 10:45:30 -0300
X-Authentication-Warning: duckman.distro.conectiva: riel owned process doing -bs
Date:   Mon, 12 Jun 2000 10:45:30 -0300 (BRST)
From:   Rik van Riel <riel@conectiva.com.br>
X-Sender: riel@duckman.distro.conectiva
To:     kernel-audit@nl.linux.org
Subject: Re: Why all this effort?
In-Reply-To: <39444081.555B7D1B@kalifornia.com>
Message-ID: <Pine.LNX.4.21.0006121042470.22013-100000@duckman.distro.conectiva>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; CHARSET=US-ASCII
Content-ID: <Pine.LNX.4.21.0006121042472.22013@duckman.distro.conectiva>
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

On Sun, 11 Jun 2000, David Ford wrote:
> Chris and Tony wrote:
> 
> > 4) to what extent should LKAP be pursuing enhanced documentation.
> 
> A lot.  Documentation is the best resource.

Also, if we find code that we don't understand, we should
probably work together with the author of the code to turn
it into something more readable.

Remember, only readable code is maintainable!  Everything
else will accumulate cruft, bugs and problems over time...


As for starting at one part of the kernel, I think that's
not the way to go. We have a number of people here who are
capable of reading source code and I really wouldn't want
to "force" them to spend their time reading code they don't
want to read. Hell, I know I wouldn't want to spend my time
doing that ;)

regards,

Rik
--
The Internet is not a network of computers. It is a network
of people. That is its real strength.

Wanna talk about the kernel?  irc.openprojects.net / #kernelnewbies
http://www.conectiva.com/		http://www.surriel.com/


Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Mon Jun 12 16:03:03 2000
Received: by humbolt.nl.linux.org id <S92273AbQFLOBp>;
	Mon, 12 Jun 2000 16:01:45 +0200
Received: from carry.netneo.com ([195.62.128.21]:46343 "EHLO carry.neonet.lv")
	by humbolt.nl.linux.org with ESMTP id <S92252AbQFLOBW>;
	Mon, 12 Jun 2000 16:01:22 +0200
Received: from ed.ed (as0q1.netneo.com [195.62.135.234])
	by carry.neonet.lv (8.9.3/8.9.3) with ESMTP id QAA32159
	for <kernel-audit@nl.linux.org>; Mon, 12 Jun 2000 16:00:40 +0200
Received: (from root@localhost)
	by ed.ed (8.8.7/8.8.5) id NAA00505
	for kernel-audit@nl.linux.org; Mon, 12 Jun 2000 13:47:24 GMT
From:   root <evpopkov@carry.neonet.lv>
Date:   Mon, 12 Jun 2000 13:47:24 +0000
To:     kernel-audit@nl.linux.org
Subject: Re: suggestion
Message-ID: <3944E9EC.nailDT11POZM@ed.ed>
References: <200006121313.PAA31449@octopus.phy.bg.ac.yu>
X-Mailer: nail 9.13 2000-05-30
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

> I  completely  disagree... People  wo  are  concerned with  security  are
> constantly
> following and installing the new kernel versions.

 Arguable. You probably have read this somewhere, right?

> People who are still
> running 2.0.x or any not latest version of kernel and who are lazy to
> upgrade won't bother to use our patches anyway...

 Absolutely wrong. I'm running 2.0.38, and it's enough for me. I don't want
new features of  2.2.x or 2.4.x series,  but I want to have  the kernel I'm
running reviewed.
 As to patch applicability.... This depends on the patch.


---

 "Teddy - I suppose Mummy and Daddy are real, aren't they?"
 Teddy said, "You ask such silly questions, David. Nobody knows what
'real' really means. Let's go indoors."

 Brian W. Aldiss, Supertoys Last All Summer Long


Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Mon Jun 12 16:08:51 2000
Received: by humbolt.nl.linux.org id <S92274AbQFLOHe>;
	Mon, 12 Jun 2000 16:07:34 +0200
Received: from jetson.astro.uiuc.edu ([128.174.51.201]:26380 "EHLO
        jetson.astro.uiuc.edu") by humbolt.nl.linux.org with ESMTP
	id <S92279AbQFLOGu>; Mon, 12 Jun 2000 16:06:50 +0200
Received: from blaze.bsod.net (junction.chatsubo.org [209.180.253.68])
	by jetson.astro.uiuc.edu (8.9.3/8.9.3) with ESMTP id JAA13371;
	Mon, 12 Jun 2000 09:08:46 -0500
Message-ID: <XFMail.20000612080836.petek@bsod.net>
X-Mailer: XFMail 1.4.4 on Linux
X-Priority: 3 (Normal)
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 8bit
MIME-Version: 1.0
In-Reply-To: <20000612074030.19021.qmail@zigana.eee.metu.edu.tr>
X-PGP-Key: Finger me for PGP public key: pkrawczy@uiuc.edu
Date:   Mon, 12 Jun 2000 08:08:36 -0600 (MDT)
From:   Pete Krawczyk <petek@bsod.net>
To:     Can Erkin Acar <canacar@ea.eee.metu.edu.tr>
Subject: Re: Start with Documentation?
Cc:     kernel-audit@nl.linux.org
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

Date: 12-Jun-2000
From: Can Erkin Acar
Subject: Re: Start with Documentation?

} Perhaps we should have a template for documenting functions.
} 
} the template would contain fields like:
} - Function name, description, location (source file)
} - maintainer if known (i.e. who wrote that function) 
} - arguments and return values
} - global variables/locks used by the function
} - things to note when calling this function (i.e. do not call
}   with a null argument etc.)
} - other auditor notes.

That would be great.  Eventually we could put this into a database, too. 
I'll try and whip up something like this, with some "documentation
documentation" about what we're trying to do.
 
} A list of auditors would be nice (changelog format?)
} 
} whenever someone audits a part of code he can update the 
} related documentation. thus documentation improves with audit.

The function document would serve as the reporting engine to tell everyone
that you had audited a file; even if all you filled out were the basics and
didn't fully document it.  That is, the only required fields for the time
being would be function name, location, and auditor notes.

} there would be an accompanying doc file for each source file 
} and these could be maintained as a CVS repository. To allow
} easy access by all auditors (this would also take care of change 
} history)

Yes.  Basically each file would be put in CVS (we do have CVS access at
SourceForge) and the structure of the CVS treee would exactly mirror the
kernel tree, except that each file is a directory in which the audit text
files are stored.  So if we have some file linux/net/foo.h we store its audit
in linux/net/foo.h/auditor-name.
 
} web based cvs access with search capabilities would be really useful.

I believe SourceForge provides this.  I know they provide the web-based
browse part of it.
 
Thanks,

-Pete K
-- 
Pete Krawczyk
  petek at bsod dot net or pkrawczy at uiuc dot edu
  http://www.uiuc.edu/ph/www/pkrawczy/
  Finger pkrawczy at uiuc dot edu for PGP public key

Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Mon Jun 12 16:11:31 2000
Received: by humbolt.nl.linux.org id <S92280AbQFLOJn>;
	Mon, 12 Jun 2000 16:09:43 +0200
Received: from brutus.conectiva.com.br ([200.250.58.146]:17910 "EHLO
        duckman.distro.conectiva") by humbolt.nl.linux.org with ESMTP
	id <S92289AbQFLOIA>; Mon, 12 Jun 2000 16:08:00 +0200
Received: from localhost (riel@localhost)
	by duckman.distro.conectiva (8.9.3/8.8.7) with ESMTP id LAA22193;
	Mon, 12 Jun 2000 11:05:33 -0300
X-Authentication-Warning: duckman.distro.conectiva: riel owned process doing -bs
Date:   Mon, 12 Jun 2000 11:05:33 -0300 (BRST)
From:   Rik van Riel <riel@conectiva.com.br>
X-Sender: riel@duckman.distro.conectiva
To:     Can Erkin Acar <canacar@ea.eee.metu.edu.tr>
cc:     kernel-audit@nl.linux.org, Alan Cox <alan@lxorguk.ukuu.org.uk>
Subject: Re: Start with Documentation?
In-Reply-To: <20000612074030.19021.qmail@zigana.eee.metu.edu.tr>
Message-ID: <Pine.LNX.4.21.0006121055140.22013-100000@duckman.distro.conectiva>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

[Hi Alan, it seems like some of the Linux Kernel Audit people
 want to (wisely) start with documentation. Maybe we want some
 extra template fields in the docbook setup to note down some
 of the extra fields below without cluttering the "normal" docs?]

On Mon, 12 Jun 2000, Can Erkin Acar wrote:
> On 12 Jun 00, at 2:22, Bryan Paxton wrote:
> 
> > heh noone has a thing against documentation...
> > Who's willing to take the time out to write it is the question at
> > hand.......
> 
> Perhaps we should have a template for documenting functions.
> 
> the template would contain fields like:
> - Function name, description, location (source file)
> - maintainer if known (i.e. who wrote that function) 
> - arguments and return values
> - global variables/locks used by the function
> - things to note when calling this function (i.e. do not call
>   with a null argument etc.)
> - other auditor notes.

I think we can do most of this with the current docdook setup
that's been integrated in the kernel by Alan. However, for the
auditor notes and some of the other stuff we may want to have
extra fields so it won't clutter the "normal" documentation...

> A list of auditors would be nice (changelog format?)
> 
> whenever someone audits a part of code he can update the 
> related documentation. thus documentation improves with audit.

Good plan.

> there would be an accompanying doc file for each source file 
> and these could be maintained as a CVS repository.

Here I'd really prefer it if the documentation was in the main
kernel tree, in docbook format inside the functions. That way
the developers can also update the documentation when _they_
change something ;)

regards,

Rik
--
The Internet is not a network of computers. It is a network
of people. That is its real strength.

Wanna talk about the kernel?  irc.openprojects.net / #kernelnewbies
http://www.conectiva.com/		http://www.surriel.com/


Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Mon Jun 12 16:17:01 2000
Received: by humbolt.nl.linux.org id <S92172AbQFLOPI>;
	Mon, 12 Jun 2000 16:15:08 +0200
Received: from corp.priceline.com ([208.219.50.155]:35293 "HELO webshield-02")
	by humbolt.nl.linux.org with SMTP id <S92252AbQFLOOZ>;
	Mon, 12 Jun 2000 16:14:25 +0200
Received: FROM exchange_server.corp.priceline.com BY webshield-02 ; Mon Jun 12 10:14:19 2000 -0400
Received: by mail.corp.priceline.com with Internet Mail Service (5.5.2650.21)
	id <MS5L1DYT>; Mon, 12 Jun 2000 10:15:26 -0400
Message-ID: <D505BA1425EED3119B7F00508B94D84E368F4A@CT-EXCH-03>
From:   "Whyte, Jesse" <Jesse.Whyte@priceline.com>
To:     'root' <evpopkov@carry.neonet.lv>, kernel-audit@nl.linux.org
Subject: RE: suggestion
Date:   Mon, 12 Jun 2000 10:12:57 -0400
MIME-Version: 1.0
X-Mailer: Internet Mail Service (5.5.2650.21)
Content-Type: text/plain;
	charset="iso-8859-1"
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

I agree completely.  "The leading edge is the bleeding edge..."  While a
generalization, it is more often right than wrong.  Running solid, verified
older code is one way to make sure that rushed implementations of new
features do not affect your stability.  I would think that a thorough review
of all "modern" kernels (2.0.x or greater) would be necessary to insure that
most of the install base is covered.

My $0.02.

Jesse

-----Original Message-----
From: root [mailto:evpopkov@carry.neonet.lv]
Sent: Monday, June 12, 2000 9:47 AM
To: kernel-audit@nl.linux.org
Subject: Re: suggestion


> I  completely  disagree... People  wo  are  concerned with  security  are
> constantly
> following and installing the new kernel versions.

 Arguable. You probably have read this somewhere, right?

> People who are still
> running 2.0.x or any not latest version of kernel and who are lazy to
> upgrade won't bother to use our patches anyway...

 Absolutely wrong. I'm running 2.0.38, and it's enough for me. I don't want
new features of  2.2.x or 2.4.x series,  but I want to have  the kernel I'm
running reviewed.
 As to patch applicability.... This depends on the patch.


---

 "Teddy - I suppose Mummy and Daddy are real, aren't they?"
 Teddy said, "You ask such silly questions, David. Nobody knows what
'real' really means. Let's go indoors."

 Brian W. Aldiss, Supertoys Last All Summer Long


Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Mon Jun 12 16:19:42 2000
Received: by humbolt.nl.linux.org id <S92290AbQFLORt>;
	Mon, 12 Jun 2000 16:17:49 +0200
Received: from brutus.conectiva.com.br ([200.250.58.146]:32759 "EHLO
        duckman.distro.conectiva") by humbolt.nl.linux.org with ESMTP
	id <S92252AbQFLOPe>; Mon, 12 Jun 2000 16:15:34 +0200
Received: from localhost (riel@localhost)
	by duckman.distro.conectiva (8.9.3/8.8.7) with ESMTP id LAA22268
	for <kernel-audit@nl.linux.org>; Mon, 12 Jun 2000 11:15:28 -0300
X-Authentication-Warning: duckman.distro.conectiva: riel owned process doing -bs
Date:   Mon, 12 Jun 2000 11:15:28 -0300 (BRST)
From:   Rik van Riel <riel@conectiva.com.br>
X-Sender: riel@duckman.distro.conectiva
To:     kernel-audit@nl.linux.org
Subject: Re: suggestion
In-Reply-To: <3944E588.nail871QZKVG@ed.ed>
Message-ID: <Pine.LNX.4.21.0006121107520.22013-100000@duckman.distro.conectiva>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

On Mon, 12 Jun 2000, root wrote:

> > 1) it's a hell of a lot easier and less time consuming, because you don't
> > have to constantly re-evaluate everything
> 
>  You contradict yourself. Newer releases will introduce new
> portions of code and we'll have to start over again each time.

The code may change often, but that doesn't mean it changes
fast.

Most of the time a kernel patch consists of a dozen or so
updated drivers, some updated architecture specific file and
maybe a few small changes to the core kernel.

Two kernel versions a week may seem impressive, but if you
look at kernel 2.2.0 and 2.4.0-test1 side by side you'll see
that the code in both kernels is still remarkably similar...

> > 2) it's what people experienced in this kind of work do - see *BSD,
> > especially OpenBSD. does anyone remember their kernel-schedule?
> 
>  Not me. I don't know much of *BSD. I'm trying to figure what
> _we_ would need, not them.

So look at OpenBSD a bit closer. Maybe our needs are somewhat
different from theirs, but I suspect that they're largely the
same. And even if they turned out not to be, there's no reason
not to learn from their mistakes.

I think I left my Wheel Reinvention Kit somewhere under a pile
of crud in the garage and I don't really feel like digging it
out...

> > 3) there's no real reason to NOT do it this way.
> 
>  Same as there's no reason not to start with the code that won't
> be changed and proceed to the evolving versions.

True. There are a number of things to keep in mind here:

1) the code changes often, but relatively slowly
2) our project will be a long-term, ongoing project that
   never really finishes
3) one of our goals is to make the Linux kernel more secure
   (not some fork of the source tree, but the kernel people
   actually use)

Because of that I think we may as well start with the 2.4
source base and work from there. I mean, we could start with
2.2, but by the time we've finished there nobody will be using
it any more. By working on the same version the developers are
working, OTOH, we will be able to work towards a long-term
improval of all Linux kernel source code.

>  Yes. My production system is frozen at 2.0.38. But that's not a
> majority. We don't have exact figures at hand, so let's not
> appeal to any whimsical majority.

Also, it makes little sense to start working towards today
next week. That way we'll always be behind the facts and
will always remain cleaning up an 'old' code base. IMHO it
would be more useful to work _with_ the developers to make
sure that future kernel code is clean and correct.

regards,

Rik
--
The Internet is not a network of computers. It is a network
of people. That is its real strength.

Wanna talk about the kernel?  irc.openprojects.net / #kernelnewbies
http://www.conectiva.com/		http://www.surriel.com/


Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Mon Jun 12 16:26:53 2000
Received: by humbolt.nl.linux.org id <S92291AbQFLOZ2>;
	Mon, 12 Jun 2000 16:25:28 +0200
Received: from lightning.swansea.uk.linux.org ([194.168.151.1]:43026 "EHLO
        the-village.bc.nu") by humbolt.nl.linux.org with ESMTP
	id <S92285AbQFLOYx>; Mon, 12 Jun 2000 16:24:53 +0200
Received: from alan by the-village.bc.nu with local (Exim 2.12 #1)
	id 131V5T-0004JY-00; Mon, 12 Jun 2000 15:21:12 +0100
Subject: Re: Start with Documentation?
To:     riel@conectiva.com.br (Rik van Riel)
Date:   Mon, 12 Jun 2000 15:21:10 +0100 (BST)
Cc:     canacar@ea.eee.metu.edu.tr (Can Erkin Acar),
        kernel-audit@nl.linux.org, alan@lxorguk.ukuu.org.uk (Alan Cox)
In-Reply-To: <Pine.LNX.4.21.0006121055140.22013-100000@duckman.distro.conectiva> from "Rik van Riel" at Jun 12, 2000 11:05:33 AM
X-Mailer: ELM [version 2.5 PL1]
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Message-Id: <E131V5T-0004JY-00@the-village.bc.nu>
From:   Alan Cox <alan@lxorguk.ukuu.org.uk>
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

>  extra template fields in the docbook setup to note down some
>  of the extra fields below without cluttering the "normal" docs?]

I think so.

I had been pondering

Locks:
Bugs:

Im way of getting internal stuff in the docs though. The point is that docs
about _how_ code works go out of date, docs about what the function does
do not

If they do add other audit specific fields then they can use Audit-XXXX:
and we can either sed out the audit- later or strip it easily

Alan


Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Mon Jun 12 17:19:41 2000
Received: by humbolt.nl.linux.org id <S92279AbQFLPS0>;
	Mon, 12 Jun 2000 17:18:26 +0200
Received: from octopus.phy.bg.ac.yu ([147.91.80.4]:5700 "EHLO
        octopus.phy.bg.ac.yu") by humbolt.nl.linux.org with ESMTP
	id <S92252AbQFLPRu>; Mon, 12 Jun 2000 17:17:50 +0200
Received: (from lynx@localhost)
	by octopus.phy.bg.ac.yu (8.9.0/8.9.0) id RAA00220;
	Mon, 12 Jun 2000 17:17:59 +0200
Date:   Mon, 12 Jun 2000 17:17:59 +0200
From:   Boris Dragovic <lynx@phy.bg.ac.yu>
Message-Id: <200006121517.RAA00220@octopus.phy.bg.ac.yu>
To:     evpopkov@carry.neonet.lv, kernel-audit@nl.linux.org
Subject: Re: suggestion
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

	 Arguable. You probably have read this somewhere, right?

No... I haven't read it... unfortunately. It is my personal experience which
is rather big...

lynx


Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Mon Jun 12 17:24:35 2000
Received: by humbolt.nl.linux.org id <S92289AbQFLPXJ>;
	Mon, 12 Jun 2000 17:23:09 +0200
Received: from carry.netneo.com ([195.62.128.21]:31758 "EHLO carry.neonet.lv")
	by humbolt.nl.linux.org with ESMTP id <S92252AbQFLPWa>;
	Mon, 12 Jun 2000 17:22:30 +0200
Received: from ed.ed (as0s.netneo.com [195.62.135.210])
	by carry.neonet.lv (8.9.3/8.9.3) with ESMTP id RAA02412
	for <kernel-audit@nl.linux.org>; Mon, 12 Jun 2000 17:21:52 +0200
Received: (from root@localhost)
	by ed.ed (8.8.7/8.8.5) id PAA00939
	for kernel-audit@nl.linux.org; Mon, 12 Jun 2000 15:07:11 GMT
From:   root <evpopkov@carry.neonet.lv>
Date:   Mon, 12 Jun 2000 15:07:11 +0000
To:     kernel-audit@nl.linux.org
Subject: RE: suggestion
Message-ID: <3944FC9F.nailPQ1AJ0OI@ed.ed>
References: <D505BA1425EED3119B7F00508B94D84E368F4A@CT-EXCH-03>
X-Mailer: nail 9.13 2000-05-30
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

> I agree completely. "The leading edge is the bleeding edge..."

 That's  it. New  release  is a  double-bladed sword.  It  brings both  new
features and bugfixes (well, at least in perfect world :)
 What if someone  just wants certain mistakes to be  corrected, without any
additions? Of  course, new features  can be  configured out, but  that will
make maintainers' lives even more a nightmare.


---

 "Teddy - I suppose Mummy and Daddy are real, aren't they?"
 Teddy said, "You ask such silly questions, David. Nobody knows what
'real' really means. Let's go indoors."

 Brian W. Aldiss, Supertoys Last All Summer Long


Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Mon Jun 12 17:27:22 2000
Received: by humbolt.nl.linux.org id <S92252AbQFLPZQ>;
	Mon, 12 Jun 2000 17:25:16 +0200
Received: from carry.netneo.com ([195.62.128.21]:32014 "EHLO carry.neonet.lv")
	by humbolt.nl.linux.org with ESMTP id <S92282AbQFLPXV>;
	Mon, 12 Jun 2000 17:23:21 +0200
Received: from ed.ed (as0s.netneo.com [195.62.135.210])
	by carry.neonet.lv (8.9.3/8.9.3) with ESMTP id RAA02415
	for <kernel-audit@nl.linux.org>; Mon, 12 Jun 2000 17:21:54 +0200
Received: (from root@localhost)
	by ed.ed (8.8.7/8.8.5) id PAA00961
	for kernel-audit@nl.linux.org; Mon, 12 Jun 2000 15:16:12 GMT
From:   root <evpopkov@carry.neonet.lv>
Date:   Mon, 12 Jun 2000 15:16:12 +0000
To:     kernel-audit@nl.linux.org
Subject: Re: suggestion
Message-ID: <3944FEBC.nailPQ21H40J@ed.ed>
References: <Pine.LNX.4.21.0006121107520.22013-100000@duckman.distro.conectiva>
X-Mailer: nail 9.13 2000-05-30
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

> The code may change often, but that doesn't mean it changes
> fast.

 How come? If  it changes every day,  it changes fast. If  it changes every
week, it's still changing fast.

> Most of the time a kernel patch consists of a dozen or so
> updated drivers, some updated architecture specific file and
> maybe a few small changes to the core kernel.

 It  doesn't  matter.  Any  change  can  introduce,  or  eliminate  certain
stability issue.

> So look at OpenBSD a bit closer. Maybe our needs are somewhat
> different from theirs, but I suspect that they're largely the
> same. And even if they turned out not to be, there's no reason
> not to learn from their mistakes.

 I  shall have  a  look at  *BSD.  Probably. If  I  were doing  comparative
analysis  of development  models,  I  had to  examine  all the  variations.
Currently this is not affordable for myself.

> That way we'll always be behind the facts and
> will always remain cleaning up an 'old' code base.

 How can  we be ahead  of the facts? We're  going to double-check  the code
already written, or have I missed something?

> IMHO it
> would be more useful to work _with_ the developers to make
> sure that future kernel code is clean and correct.

 What you  mean working with the  developers? Why one needs  LKAP for that?
Simply join  development group, and  you'll be working with  them, auditing
the code, no prob.


---

 "Teddy - I suppose Mummy and Daddy are real, aren't they?"
 Teddy said, "You ask such silly questions, David. Nobody knows what
'real' really means. Let's go indoors."

 Brian W. Aldiss, Supertoys Last All Summer Long


Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Mon Jun 12 18:16:52 2000
Received: by humbolt.nl.linux.org id <S92245AbQFLQP1>;
	Mon, 12 Jun 2000 18:15:27 +0200
Received: from alpha.rhodes.edu ([198.78.24.2]:28168 "EHLO alpha.rhodes.edu")
	by humbolt.nl.linux.org with ESMTP id <S92171AbQFLQPC>;
	Mon, 12 Jun 2000 18:15:02 +0200
Received: from dhcp-27-110.rhodes.edu (dhcp-27-110.rhodes.edu [198.78.27.110])
 by rhodes.edu (PMDF V6.0-24 #38991)
 with ESMTP id <01JQIHWO559M000A2O@rhodes.edu> for kernel-audit@nl.linux.org;
 Mon, 12 Jun 2000 11:13:44 -0500 (CDT)
Received: (from mesmd@localhost)	by dhcp-27-110.rhodes.edu (8.9.3/8.9.3)
 id LAA18556	for kernel-audit@nl.linux.org; Tue, 13 Jun 2000 11:15:54 -0500
Date:   Tue, 13 Jun 2000 11:15:54 -0500
From:   Mike Messmore <mesmd@rhodes.edu>
Subject: Re: suggestion
In-reply-to: <"from evpopkov"@carry.neonet.lv>
To:     kernel-audit@nl.linux.org
Message-id: <20000613111554.A18523@dhcp-27-110.rhodes.edu>
MIME-version: 1.0
Content-type: text/plain; charset=us-ascii
Content-transfer-encoding: 7BIT
Content-disposition: inline
User-Agent: Mutt/1.2i
References: <Pine.LNX.4.21.0006121107520.22013-100000@duckman.distro.conectiva>
 <3944FEBC.nailPQ21H40J@ed.ed>
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list


On Mon, Jun 12, 2000 at 03:16:12PM +0000, root probably said:
...
> 
> > IMHO it
> > would be more useful to work _with_ the developers to make
> > sure that future kernel code is clean and correct.
> 
>  What you  mean working with the  developers? Why one needs  LKAP for that?
> Simply join  development group, and  you'll be working with  them, auditing
> the code, no prob.
> 

I believe we are trying to aid the developers in an organised fashion, not fork
the code base here.  The purpose is to make the Linux kernel secure, not make A
secure kernel.  LKAP should provide the infrastructure to organise this audit
of the kernel source.  Much like an organised search part is much more 
effective than a bunch of people wandering through the woods. 

--Mike Messmore



> 
> ---
> 
>  "Teddy - I suppose Mummy and Daddy are real, aren't they?"
>  Teddy said, "You ask such silly questions, David. Nobody knows what
> 'real' really means. Let's go indoors."
> 
>  Brian W. Aldiss, Supertoys Last All Summer Long
> 
> 
> Kernel-audit:  discussion list for security and the linux kernel
> Archive:       http://mail.nl.linux.org/kernel-audit/













Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Mon Jun 12 18:23:03 2000
Received: by humbolt.nl.linux.org id <S92286AbQFLQVr>;
	Mon, 12 Jun 2000 18:21:47 +0200
Received: from prodigy.aztec.co.uk ([62.232.32.10]:28688 "EHLO
        prodigy.aztec.co.uk") by humbolt.nl.linux.org with ESMTP
	id <S92171AbQFLQVT>; Mon, 12 Jun 2000 18:21:19 +0200
Received: from aztec.co.uk (develop05 [10.66.2.105])
	by prodigy.aztec.co.uk (8.9.3/8.9.3) with ESMTP id RAA13105
	for <kernel-audit@nl.linux.org>; Mon, 12 Jun 2000 17:24:46 +0100
Message-ID: <39450E21.D6FF98A6@aztec.co.uk>
Date:   Mon, 12 Jun 2000 17:21:53 +0100
From:   James Lyon <james.lyon@aztec.co.uk>
Organization: Aztec Business Solutions
X-Mailer: Mozilla 4.73 [en] (WinNT; U)
X-Accept-Language: en
MIME-Version: 1.0
To:     LKAP : General <kernel-audit@nl.linux.org>
Subject: Re: suggestion
Content-Type: multipart/mixed;
 boundary="------------2ED29A53BC99736A97895C9A"
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

This is a multi-part message in MIME format.
--------------2ED29A53BC99736A97895C9A
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit

> I believe we are trying to aid the developers in an organised fashion, not fork
> the code base here.  The purpose is to make the Linux kernel secure, not make A
> secure kernel.

Yes, I think that is precisely what I understood from the general
intent, comments,
and so on. It also makes absolute sense to me :)
--------------2ED29A53BC99736A97895C9A
Content-Type: text/x-vcard; charset=us-ascii;
 name="james.lyon.vcf"
Content-Transfer-Encoding: 7bit
Content-Description: Card for James Lyon
Content-Disposition: attachment;
 filename="james.lyon.vcf"

begin:vcard 
n:Lyon;James
tel;pager:24-hour contact via Work number
tel;cell:+44 (7973) 824857
tel;fax:+44 (24) 7670 2501
tel;home:Please use Cellular number.
tel;work:+44 (24) 7670 2500
x-mozilla-html:TRUE
url:http://www.aztec.co.uk/
org:Business IT Research Ltd t/a Aztec Business Solutions
version:2.1
email;internet:james.lyon@aztec.co.uk
title:Managing Director
adr;quoted-printable:;;Enterprise House=0D=0ACourtaulds Way;Coventry;;CV6 5NX;UK
fn:James Lyon
end:vcard

--------------2ED29A53BC99736A97895C9A--


Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Mon Jun 12 18:49:36 2000
Received: by humbolt.nl.linux.org id <S92232AbQFLQsS>;
	Mon, 12 Jun 2000 18:48:18 +0200
Received: from qmail1.crane.sgi.net ([209.166.163.28]:25843 "HELO
        qmail1.crane.sgi.net") by humbolt.nl.linux.org with SMTP
	id <S92211AbQFLQrm>; Mon, 12 Jun 2000 18:47:42 +0200
Received: (qmail 15520 invoked from network); 12 Jun 2000 16:47:30 -0000
Received: from unknown (HELO star) (209.166.171.42)
  by qmail1-2.mx.stargate.net with SMTP; 12 Jun 2000 16:47:30 -0000
Reply-To: <jason@schwoo.com>
From:   "Jason Milletary" <jason@schwoo.com>
To:     "'LKAP : General'" <kernel-audit@nl.linux.org>
Subject: RE: suggestion
Date:   Mon, 12 Jun 2000 12:49:30 -0400
Message-ID: <31FC13508138D4119C6A000102495013459F@QUAKE01>
MIME-Version: 1.0
Content-Type: text/plain;
	charset="US-ASCII"
Content-Transfer-Encoding: 7bit
X-Priority: 3 (Normal)
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook CWS, Build 9.0.2416 (9.0.2910.0)
X-MimeOLE: Produced By Microsoft MimeOLE V5.00.2314.1300
Importance: Normal
In-Reply-To: <31FC13508138D4119C6A0001024950131CC2@QUAKE01>
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

Forgive me if these ideas have been mentioned before...

It seems to me and to the consensus of those that have posted so far is that
for LKAP to be most effective it eventually needs to be inserted as a
necessary step in the kernel development schedule (i.e the developers submit
code to the audit group for approval).  However, the entire auditing process
needs to be first defined and refined before it can be added to the
development/deployment schedule.

My suggestion would be to begin by auditing either 2.0.x or 2.2.x based
trees as an assessment project.  This way, bugs in the process can be
hammered out.  Eventually LKAP could be ready for prime time so to speak,
and be able to audit current kernel releases immediately after release, or
even before as mentioned above.

--Jason


Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Mon Jun 12 18:54:34 2000
Received: by humbolt.nl.linux.org id <S92233AbQFLQxS>;
	Mon, 12 Jun 2000 18:53:18 +0200
Received: from [207.224.253.222] ([207.224.253.222]:15400 "EHLO
        ellipsis.aniota.net") by humbolt.nl.linux.org with ESMTP
	id <S92249AbQFLQwz>; Mon, 12 Jun 2000 18:52:55 +0200
Received: from localhost (twhite@localhost)
	by ellipsis.aniota.net (8.8.7/8.8.7) with ESMTP id JAA25756;
	Mon, 12 Jun 2000 09:52:55 -0700
X-Authentication-Warning: ellipsis.aniota.net: twhite owned process doing -bs
Date:   Mon, 12 Jun 2000 09:52:52 -0700 (PDT)
From:   terry white <twhite@aniota.com>
To:     Boris Dragovic <lynx@phy.bg.ac.yu>
cc:     kernel-audit@nl.linux.org, tom@lemuria.org
Subject: Re: suggestion
In-Reply-To: <200006121313.PAA31449@octopus.phy.bg.ac.yu>
Message-ID: <Pine.LNX.4.10.10006120930380.25705-100000@ellipsis.aniota.net>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

on "06/12/00" "Boris Dragovic" writ:

: I completely disagree... People wo are concerned with security are constantly
: following and installing the new kernel versions. People who are still 
: running 2.0.x or any not latest version of kernel and who are lazy to
: upgrade won't bother to use our patches anyway... so I think we should 
: start with current...

   ... if efficiency a goal, "BLEEDING" edge releases are NOT the way to
go.  further, not upgrading to an unproven release may be MORE
'practical' than "lazy".
  
       as there are long running systems running 2.0.x, it might be
prudent to clean up the latest release of each major series.  there is a
possibility, that work done on earlier releases might reduce duplication of
effort ...

-- 
... i'm a man , and i can change ,
    if i really have to , i guess ...



Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Mon Jun 12 19:12:16 2000
Received: by humbolt.nl.linux.org id <S92230AbQFLRL0>;
	Mon, 12 Jun 2000 19:11:26 +0200
Received: from [207.224.253.222] ([207.224.253.222]:25640 "EHLO
        ellipsis.aniota.net") by humbolt.nl.linux.org with ESMTP
	id <S92173AbQFLRKr>; Mon, 12 Jun 2000 19:10:47 +0200
Received: from localhost (twhite@localhost)
	by ellipsis.aniota.net (8.8.7/8.8.7) with ESMTP id KAA25805;
	Mon, 12 Jun 2000 10:11:55 -0700
X-Authentication-Warning: ellipsis.aniota.net: twhite owned process doing -bs
Date:   Mon, 12 Jun 2000 10:11:54 -0700 (PDT)
From:   terry white <twhite@aniota.com>
To:     Rik van Riel <riel@conectiva.com.br>
cc:     kernel-audit@nl.linux.org
Subject: Re: suggestion
In-Reply-To: <Pine.LNX.4.21.0006121107520.22013-100000@duckman.distro.conectiva>
Message-ID: <Pine.LNX.4.10.10006121005590.25705-100000@ellipsis.aniota.net>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

on "06/12/00" "Rik van Riel" writ:

: 2.2, but by the time we've finished there nobody will be using
 
   ... that is clearly in "ERROR".

: it any more. By working on the same version the developers are
: working, OTOH, we will be able to work towards a long-term
: improval of all Linux kernel source code.

       not to make too fine a point of it, were that the case, there
would be no need for 'this' effort.

: will always remain cleaning up an 'old' code base. IMHO it
: would be more useful to work _with_ the developers to make
: sure that future kernel code is clean and correct.

       kinda like releasing 98 instead of fixing 95 ...

-- 
... i'm a man , and i can change ,
    if i really have to , i guess ...



Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Mon Jun 12 19:38:26 2000
Received: by humbolt.nl.linux.org id <S92211AbQFLRhb>;
	Mon, 12 Jun 2000 19:37:31 +0200
Received: from brutus.conectiva.com.br ([200.250.58.146]:3061 "EHLO
        duckman.distro.conectiva") by humbolt.nl.linux.org with ESMTP
	id <S92173AbQFLRgx>; Mon, 12 Jun 2000 19:36:53 +0200
Received: from localhost (riel@localhost)
	by duckman.distro.conectiva (8.9.3/8.8.7) with ESMTP id OAA23628;
	Mon, 12 Jun 2000 14:36:38 -0300
X-Authentication-Warning: duckman.distro.conectiva: riel owned process doing -bs
Date:   Mon, 12 Jun 2000 14:36:38 -0300 (BRST)
From:   Rik van Riel <riel@conectiva.com.br>
X-Sender: riel@duckman.distro.conectiva
To:     Jason Milletary <jason@schwoo.com>
cc:     "'LKAP : General'" <kernel-audit@nl.linux.org>
Subject: RE: suggestion
In-Reply-To: <31FC13508138D4119C6A000102495013459F@QUAKE01>
Message-ID: <Pine.LNX.4.21.0006121421260.22013-100000@duckman.distro.conectiva>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

On Mon, 12 Jun 2000, Jason Milletary wrote:

> It seems to me and to the consensus of those that have posted so
> far is that for LKAP to be most effective it eventually needs to
> be inserted as a necessary step in the kernel development
> schedule (i.e the developers submit code to the audit group for
> approval).  However, the entire auditing process needs to be
> first defined and refined before it can be added to the
> development/deployment schedule.

No. The people who cannot code and do not know what they
are talking about should stop trying to "guide" the people
who do know what they are talking about.

> My suggestion would be to begin by auditing either 2.0.x or
> 2.2.x based trees as an assessment project.

Sure, go ahead. But don't expect me to spend time on auditing
2.0 or 2.2 ...  For 2.4, OTOH, I plan on making a pretty good
effort in making the code better documented and more readable.

regards,

Rik
--
The Internet is not a network of computers. It is a network
of people. That is its real strength.

Wanna talk about the kernel?  irc.openprojects.net / #kernelnewbies
http://www.conectiva.com/		http://www.surriel.com/


Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Mon Jun 12 19:42:43 2000
Received: by humbolt.nl.linux.org id <S92238AbQFLRlK>;
	Mon, 12 Jun 2000 19:41:10 +0200
Received: from brutus.conectiva.com.br ([200.250.58.146]:43253 "EHLO
        duckman.distro.conectiva") by humbolt.nl.linux.org with ESMTP
	id <S92173AbQFLRkr>; Mon, 12 Jun 2000 19:40:47 +0200
Received: from localhost (riel@localhost)
	by duckman.distro.conectiva (8.9.3/8.8.7) with ESMTP id OAA23656
	for <kernel-audit@nl.linux.org>; Mon, 12 Jun 2000 14:40:33 -0300
X-Authentication-Warning: duckman.distro.conectiva: riel owned process doing -bs
Date:   Mon, 12 Jun 2000 14:40:33 -0300 (BRST)
From:   Rik van Riel <riel@conectiva.com.br>
X-Sender: riel@duckman.distro.conectiva
To:     kernel-audit@nl.linux.org
Subject: Re: suggestion
In-Reply-To: <Pine.LNX.4.10.10006121005590.25705-100000@ellipsis.aniota.net>
Message-ID: <Pine.LNX.4.21.0006121436490.22013-100000@duckman.distro.conectiva>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

On Mon, 12 Jun 2000, terry white wrote:
> on "06/12/00" "Rik van Riel" writ:
> 
> : 2.2, but by the time we've finished there nobody will be using
>  
>    ... that is clearly in "ERROR".

Why?  Please back up your assertions.

> : it any more. By working on the same version the developers are
> : working, OTOH, we will be able to work towards a long-term
> : improval of all Linux kernel source code.
> 
>        not to make too fine a point of it, were that the case,
> there would be no need for 'this' effort.

Oh yes there is. As long as people keep changing the code there
should be something like our project to watch those changes and
check to see if they are indeed correct.

> : will always remain cleaning up an 'old' code base. IMHO it
> : would be more useful to work _with_ the developers to make
> : sure that future kernel code is clean and correct.
> 
>        kinda like releasing 98 instead of fixing 95 ...

Ermmm. 98 _is_ 95 plus a few small bugfixes ...

regards,

Rik
--
The Internet is not a network of computers. It is a network
of people. That is its real strength.

Wanna talk about the kernel?  irc.openprojects.net / #kernelnewbies
http://www.conectiva.com/		http://www.surriel.com/


Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Mon Jun 12 19:46:16 2000
Received: by humbolt.nl.linux.org id <S92242AbQFLRod>;
	Mon, 12 Jun 2000 19:44:33 +0200
Received: from burr.ai.org ([199.8.100.1]:63242 "EHLO burr.ai.org")
	by humbolt.nl.linux.org with ESMTP id <S92173AbQFLRny>;
	Mon, 12 Jun 2000 19:43:54 +0200
Received: by burr.ai.org; id MAA22128; Mon, 12 Jun 2000 12:43:50 -0500 (EST)
Received: from homer.ai.org(165.139.95.160) by burr.ai.org via smap (V4.2)
	id xma021543; Mon, 12 Jun 00 12:42:56 -0500
Received: from localhost (gswallow@localhost)
	by ai.org (8.9.1/8.9.1) with ESMTP id MAA19451;
	Mon, 12 Jun 2000 12:42:55 -0500 (EST)
Date:   Mon, 12 Jun 2000 12:42:55 -0500 (EST)
From:   Greg Swallow <gswallow@ai.org>
To:     terry white <twhite@aniota.com>
cc:     Boris Dragovic <lynx@phy.bg.ac.yu>, kernel-audit@nl.linux.org,
        tom@lemuria.org
Subject: Re: suggestion
In-Reply-To: <Pine.LNX.4.10.10006120930380.25705-100000@ellipsis.aniota.net>
Message-ID: <Pine.GSO.4.10.10006121236030.18331-100000@homer.ai.org>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

On Mon, 12 Jun 2000, terry white wrote:

> on "06/12/00" "Boris Dragovic" writ:
> 
> : I completely disagree... People wo are concerned with security are constantly
> : following and installing the new kernel versions. People who are still 
> : running 2.0.x or any not latest version of kernel and who are lazy to
> : upgrade won't bother to use our patches anyway... so I think we should 
> : start with current...
> 
>    ... if efficiency a goal, "BLEEDING" edge releases are NOT the way to
> go.  further, not upgrading to an unproven release may be MORE
> 'practical' than "lazy".
>   
>        as there are long running systems running 2.0.x, it might be
> prudent to clean up the latest release of each major series.  there is a
> possibility, that work done on earlier releases might reduce duplication of
> effort ...

Sorry, everyone--I'm not a programmer, I just think this group would be a
good forum to keep on top of Linux security issues.  So please keep in
mind that I *know* I'll be lurking rather than contributing as time goes
on before you send any flames :)

On that note, here's my $.02...

Long running systems on 2.0.x generally have administrators that aren't
keen on compiling new kernels, don't they?  Therefore, why maintain the
2.0.x kernel?  If you've got a handful of developers each working on this
project as a hobby rather than as their main project, why spread them too
thin?  Perhaps auditing the latest 2.2.x kernel and then releasing it in
packages for each distribution would be more efficient use of time?  

Then you could pretty much forget about 2.2.x (since Linux will shift to
2.4.x soon) and just focus on new kernels, which clued-in administrators
will be thankful for.

The only reason I see to keep a 2.0.x kernel around is if you'd rather use
ipfwadm than ipchains.  2.4.x's ipfilter is supposed to be better still,
isn't it?  I won't upgrade my "firewall" from 2.2.16 yet :)

  Greg Swallow -- Assistant System Administrator (whew!) -- Access Indiana
   http://www.ai.org -- gswallow@ai.org -- (317) 233-2908 -- NASDAQ: EGOV 


Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Mon Jun 12 19:56:26 2000
Received: by humbolt.nl.linux.org id <S92235AbQFLRzR>;
	Mon, 12 Jun 2000 19:55:17 +0200
Received: from cv-2-65.campusview.indiana.edu ([149.159.2.65]:9267 "EHLO
        sietch.dhs.org") by humbolt.nl.linux.org with ESMTP
	id <S92173AbQFLRyp>; Mon, 12 Jun 2000 19:54:45 +0200
Received: from localhost ([127.0.0.1]) by sietch.dhs.org
	 with smtp (ident galexand using rfc1413) id m131YQ7-000BfVC
	(Debian Smail-3.2.0.102 1998-Aug-2 #2); Mon, 12 Jun 2000 12:54:43 -0500 (EST)
Date:   Mon, 12 Jun 2000 12:54:43 -0500 (EST)
From:   Greg Alexander <galexand@acm.org>
X-Sender: galexand@plow
To:     Jason Milletary <jason@schwoo.com>
cc:     "'LKAP : General'" <kernel-audit@nl.linux.org>
Subject: RE: suggestion
In-Reply-To: <31FC13508138D4119C6A000102495013459F@QUAKE01>
Message-ID: <Pine.LNX.3.96.1000612124610.32A-100000@plow>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

On Mon, 12 Jun 2000, Jason Milletary wrote:

> Forgive me if these ideas have been mentioned before...
> 
> It seems to me and to the consensus of those that have posted so far is that
> for LKAP to be most effective it eventually needs to be inserted as a
> necessary step in the kernel development schedule (i.e the developers submit
> code to the audit group for approval).  However, the entire auditing process
> needs to be first defined and refined before it can be added to the
> development/deployment schedule.
>
> My suggestion would be to begin by auditing either 2.0.x or 2.2.x based
> trees as an assessment project.  This way, bugs in the process can be
> hammered out.  Eventually LKAP could be ready for prime time so to speak,
> and be able to audit current kernel releases immediately after release, or
> even before as mentioned above.

No, I can guarantee that if you set your goals like that, it just won't happen.
Do you remember GGI?  Badly planned endavours can and do fail.
	Linux is GNU, free software, community development.  We need to make
changes, give information, make documentation, and give it to people...but
access to the source code to read it is all we need: the rest will take care
of itself if we find bugs.  The stage you are proposing already exists:
every patch waits a few days in Linus' inbox and he decides whether or not
it is sound.  Then there are several months at a .99 level before a new
'stable' kernel can be released -- we are welcome, as is the rest of the
world, to audit that kernel.  If we audit immediately after release,
we can fix problems and not start a war.  If we even try to audit before
release, we just piss people off and gain nothing in terms of effectiveness.
	If we want to try to start a group in a position of authority, that's
just not how it happens in the Linux world.  In a way this project is designed
wrong.  It's a person/group with an idea calling for people to implement it.
The way successful projects work is that a small group of people DOES IT,
and only THEN do they bother to try to get the rest of the world in on it
(look at Linux).  Alan Cox didn't say "you should have somebody who does foo
and bar [i.e., be a second clearinghouse for patches] and is trusted and
respected," he said "well here, I've done foo and bar," and then he became
trusted and respected.
	That is why we must never think of ourselves as a committee between
Linus and the rest of the world, we need to think of ourselves as a group
among the rest of the world.  Perhaps somehow as a group (or, more likely,
the spokespeople and major workers in the group) we'll gain some credibility
and people will start sending us code to review before it's released, but
that must not be even on our minds when we're starting.  We've got the
"feature freeze" stage between development and stable releases, and that is
all that we HAVE ANY USE AT ALL FOR, so that is all we should ask for and
it is certainly all we will receive to do the majority of the work.


Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Mon Jun 12 20:17:47 2000
Received: by humbolt.nl.linux.org id <S92239AbQFLSQa>;
	Mon, 12 Jun 2000 20:16:30 +0200
Received: from cv-2-65.campusview.indiana.edu ([149.159.2.65]:12084 "EHLO
        sietch.dhs.org") by humbolt.nl.linux.org with ESMTP
	id <S92173AbQFLSP4>; Mon, 12 Jun 2000 20:15:56 +0200
Received: from localhost ([127.0.0.1]) by sietch.dhs.org
	 with smtp (ident galexand using rfc1413) id m131Ykc-000BfVC
	(Debian Smail-3.2.0.102 1998-Aug-2 #2); Mon, 12 Jun 2000 13:15:54 -0500 (EST)
Date:   Mon, 12 Jun 2000 13:15:54 -0500 (EST)
From:   Greg Alexander <galexand@acm.org>
X-Sender: galexand@plow
To:     Greg Swallow <gswallow@ai.org>
cc:     kernel-audit@nl.linux.org
Subject: Re: suggestion
In-Reply-To: <Pine.GSO.4.10.10006121236030.18331-100000@homer.ai.org>
Message-ID: <Pine.LNX.3.96.1000612125543.32B-100000@plow>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

On Mon, 12 Jun 2000, Greg Swallow wrote:

> On Mon, 12 Jun 2000, terry white wrote:
> 
> > on "06/12/00" "Boris Dragovic" writ:
> > 
> > : I completely disagree... People wo are concerned with security are constantly
> > : following and installing the new kernel versions. People who are still 
> > : running 2.0.x or any not latest version of kernel and who are lazy to
> > : upgrade won't bother to use our patches anyway... so I think we should 
> > : start with current...
> > 
> >    ... if efficiency a goal, "BLEEDING" edge releases are NOT the way to
> > go.  further, not upgrading to an unproven release may be MORE
> > 'practical' than "lazy".
> >   
> >        as there are long running systems running 2.0.x, it might be
> > prudent to clean up the latest release of each major series.  there is a
> > possibility, that work done on earlier releases might reduce duplication of
> > effort ...
> 
> Sorry, everyone--I'm not a programmer, I just think this group would be a
> good forum to keep on top of Linux security issues.  So please keep in
> mind that I *know* I'll be lurking rather than contributing as time goes
> on before you send any flames :)
> 
> On that note, here's my $.02...
> 
> Long running systems on 2.0.x generally have administrators that aren't
> keen on compiling new kernels, don't they?  Therefore, why maintain the

No, they are keen on compiling new kernels.  I used 2.0 for a long time
because 2.2 was both unstable and had driver problems on my machine.  The
SBPCD driver, in particular, has gotten worse in 2.2 than it was in 2.0
(which is to say that it's absolutely horrible now).  My IDE driver was
initialized differently and I needed to flash my BIOS to get 2.2 to work
quite right (but i didn't know until I tried it that flasihng the BIOS
would solve the problems), and some programs (dhcpcd) needed to be upgraded.
	When the whole "2.0.x is obsolete" crowd was trying to find backup
tapes when 2.2.9 or whatever had that disk corruption bug (which has
probably been blown out of proportion, but existed nonetheless), I was
smugly running 2.0.x, counting down the days until my uptime on my desktop
machine reached 120 days.
	I think it's finally reached the point where people using 1.2.13
are finally not worth bothering with -- 2.0 has proven itself stable and as
secure as 1.2.13, and has enough new features to justify the upgrade in
almost any situation.

> 2.0.x kernel?  If you've got a handful of developers each working on this

2.0.x may or may not be worth it.  In a few months people will be saying
that 2.2 is obsolete, but I know I will be using 2.2.x for at least another
year.

> project as a hobby rather than as their main project, why spread them too

Actually, in this case, I think this could very easily be my main hobby.
I am routinely upset by crappy code so an audit is my game.  More
importantly, this is /THE/ game of the kernel newbie.  As someone who has
worked only minimally with the code of the kernel (just a couple drivers),
I know I can find bugs much more easily than experienced kernel developers.
Have you ever pounded your head on a bug for weeks or months only to have
someone who doesn't have any assumptions about it sit down and ask "what's
this line here all about?" and you look at it and right there, staring up
at you, is your bug?  Most of us programmers have had that experience.
The programmer who wrote the code will read only part of each line of code
when auditing, and he will immediately know what the code is supposed to do,
but someone who doesn't know the code will think "what does this code do?
it seems like it would do foo, but it's off by one" or whatever -- they have
to read each character individually just to get the gist of it, whereas
someone who worked with the code before just skims it.  We still need
solid, experienced programmers, but it's best if they haven't hacked the
kernel much.  As a side effect, we greatly expand the base of people who
have the basic working knowledge necessary to, for example, rewrite that
crappy SBPCD driver. :)

> thin?  Perhaps auditing the latest 2.2.x kernel and then releasing it in
> packages for each distribution would be more efficient use of time?  

The audit should preferably not fork the tree.  Right now the biggest
problem, I hope, is that most bugs aren't known about.  I suspect if we
get a conveniently accessible and clear list of bugs and give them to
people like Linus and Alan (and, where appropriate, the maintainer of a
driver), then we will have accomplished all that is necessary in an 
auditing project.  An audit doesn't make anything, it just makes a paper
trail to help you decide what changes to do.  As a product I could see
us eventually doing the groundwork for what could turn into a new book
on kernel internals, but that's a side effect.
	One big concern is just plain crappy code.  I bet a lot of what
happens in 2.3.x is someone taking one look at a pile of code and just
deleting the whole file and starting over, coming up with a new, improved,
and surprisingly bug free version.  They didn't directly classify or fix
any bugs, they merely replaced them with a new version which is probably
less buggy.  It would probably be a bad idea to try to port this general
cleanup effort back to 2.2 but it may be impractical to fix the bugs
without doing something like that.  Those are the driver cases, and those
are the cases where we won't be able to do much.

> Then you could pretty much forget about 2.2.x (since Linux will shift to
> 2.4.x soon) and just focus on new kernels, which clued-in administrators
> will be thankful for.

Yes, once 2.2.x has been fairly thoroughly audited we should start in on
2.4.x.  I think you may be underestimating the task of thoroughly auditing
2.2.x :)

> The only reason I see to keep a 2.0.x kernel around is if you'd rather use
> ipfwadm than ipchains.  2.4.x's ipfilter is supposed to be better still,
> isn't it?  I won't upgrade my "firewall" from 2.2.16 yet :)

There's an ipfwadm wrapper around ipchains.  That's not as big an issue as
drivers that have simply broken due to minor interface changes [or monkeys
with hammers submitting patches], etc.


Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Mon Jun 12 20:29:06 2000
Received: by humbolt.nl.linux.org id <S92243AbQFLS1w>;
	Mon, 12 Jun 2000 20:27:52 +0200
Received: from carry.netneo.com ([195.62.128.21]:31753 "EHLO carry.neonet.lv")
	by humbolt.nl.linux.org with ESMTP id <S92244AbQFLS1Z>;
	Mon, 12 Jun 2000 20:27:25 +0200
Received: from ed.ed (as0c.netneo.com [195.62.135.194])
	by carry.neonet.lv (8.9.3/8.9.3) with ESMTP id UAA06620;
	Mon, 12 Jun 2000 20:25:57 +0200
Received: (from root@localhost)
	by ed.ed (8.8.7/8.8.5) id SAA00634;
	Mon, 12 Jun 2000 18:24:07 GMT
From:   root <evpopkov@carry.neonet.lv>
Date:   Mon, 12 Jun 2000 18:24:07 +0000
To:     gswallow@ai.org, twhite@aniota.com
Subject: Re: suggestion
Cc:     tom@lemuria.org, lynx@phy.bg.ac.yu, kernel-audit@nl.linux.org
Message-ID: <39452AC7.nailGU2608W8@ed.ed>
References: <Pine.GSO.4.10.10006121236030.18331-100000@homer.ai.org>
X-Mailer: nail 9.13 2000-05-30
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

> Sorry, everyone--I'm not a programmer, I just think this group would be a
> good forum to keep on top of Linux security issues.

 To be able to  benefit from this list you _need_ to know  what the heck is
buffer overflow, executable stack and numerous other boring things.

> So please keep in
> mind that I *know* I'll be lurking rather than contributing as time goes
> on before you send any flames :)

 No  prob with  lurking IMHO.  Just check  again whether  LKAP is  what you
really need. I guess you're subscribed to BugTraq?

> Long running systems on 2.0.x generally have administrators that aren't
> keen on compiling new kernels, don't they? Therefore, why maintain the
> 2.0.x kernel?

 Awwww! Ever tried  to explain `green' to a blind?  I'm rebuilding my 2.0.x
once a month or so. It's running on my production machine. And it has all I
need, why do I have to upgrade to 2.4.x?
 Why maintain 2.0.x? Because it's being used.

> If you've got a handful of developers each working on this
> project as a hobby rather than as their main project, why spread them too
> thin?

 A hobby? I'm living off Linux development.  And I want my machine fast and
solid.  I admit  that I  don't have  sufficient skills  to audit  the whole
kernel on my own,  that's why I'm here looking for  someone to join efforts
with.

> Perhaps auditing the latest 2.2.x kernel and then releasing it in
> packages for each distribution would be more efficient use of time?

 Forking?

> Then you could pretty much forget about 2.2.x (since Linux will shift to
> 2.4.x soon) and just focus on new kernels, which clued-in administrators
> will be thankful for.

 Linux will shift. However, being able to  dload an rpm and install it each
time new kernel is released doesn't necessarily designate a cewed-in admin.

> The only reason  I see to keep  a 2.0.x kernel around is  if you'd rather
> use
> ipfwadm than ipchains.

 This is  not the only difference  between 2.0.x and 2.2.x,  and there's no
point to keep the older kernel only  because of ipfwadm. Ay least the point
is not obvious to me.
 TCP/IP stack should be better in  2.2.x and later kernels, but then again,
significance  of  improvements can  be  determined  _only_ on  case-by-case
basis.


---

 "Teddy - I suppose Mummy and Daddy are real, aren't they?"
 Teddy said, "You ask such silly questions, David. Nobody knows what
'real' really means. Let's go indoors."

 Brian W. Aldiss, Supertoys Last All Summer Long


Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Mon Jun 12 20:35:24 2000
Received: by humbolt.nl.linux.org id <S92287AbQFLSdm>;
	Mon, 12 Jun 2000 20:33:42 +0200
Received: from host.sandbender.voxel.net ([209.239.35.28]:5636 "EHLO
        sandbender.voxel.net") by humbolt.nl.linux.org with ESMTP
	id <S92246AbQFLSc7>; Mon, 12 Jun 2000 20:32:59 +0200
Received: (from lyonfyre@localhost)
	by sandbender.voxel.net (8.9.3/8.9.3) id OAA09047
	for kernel-audit@nl.linux.org; Mon, 12 Jun 2000 14:32:58 -0400
Date:   Mon, 12 Jun 2000 14:32:58 -0400
From:   Eric Gibson <emg@lyonfyre.net>
To:     kernel-audit@nl.linux.org
Subject: Re: A proposed model for the audit
Message-ID: <20000612143258.A29185@sandbender.voxel.net>
References: <Pine.LNX.4.21.0006112006100.839-100000@sqa.speedbros.org>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
X-Mailer: Mutt 1.0.1i
In-Reply-To: <Pine.LNX.4.21.0006112006100.839-100000@sqa.speedbros.org>; from evil7@bellsouth.net on Sun, Jun 11, 2000 at 08:06:41PM -0500
X-Eric-Conspiracy: There is no conspiracy
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

On Sun, Jun 11, 2000 at 08:06:41PM -0500, Bryan Paxton wrote:
> I've looked at all the posts, and I've put together a small layout plan.
> 
> But first you must remember that Linux development in general is far from 
> neighbors(*BSD) route on developing. Hence we can not particulary go in the 
> style of our friends next door. Linux development moves so fast, or rather it
> only goes forwards and not particulary backwards most of the time. This is wha
> you have to keep in mind when we setup a plan for auditing. Thus my proposal:
> 
> Of course this is all really up to _YOU_ the developers, but I think this is 
> the best way to go.
> 
> Starting kernel:
> A freeze on kernel 2.3.99-pre10-3 a.k.a. 2.4.0-test1
> 
> This kernel contains so many new features and pretty much has all the old ones.
> So that includes new problems and old ones as well. It's only logical to audit> this one for two reasons: 
> 1) As stated before, linux moves forwards and not backwards. 
> 2) This is the kernel that is gonna grab the publics attention, hence the mass
> amount of people going to be using this kernel is almost unmesureable. This 
> is going to be the kernel that is going to turn a lot of people over to linux
> IMHO.

  There has been much discussion about which kernels to audit, and
how to audit them. My opinion is that by profiling as many types of bugs as
we can and going back in time, possibly  from the latest development
kernels to the beginning of the 2.2.x series we can reach a wider audience
of programmers, and users interested in the debugging/problem report process.
This also requires laying out a standard navigational framework for the bug
tracking system, which can in turn coincide with the document templating.

The key is a sturdy and up to date function documentation for the
developers as well as a well defined Linux kernel bug finding/submission
process for the users. I don't what kind of line can be drawn as far as what
is considered a "security related" bug either, a seemingly harmless bug
could have serious implications as far as security is concerned in the
months ahead.

> this one for two reasons: 
> 1) As stated before, linux moves forwards and not backwards. 
> 2) This is the kernel that is gonna grab the publics attention, hence the mass
> amount of people going to be using this kernel is almost unmesureable. This 
> is going to be the kernel that is going to turn a lot of people over to linux
> IMHO.
> 
> So now there's a kernel audit...
> But what approach do way take as to where we start in this kernel...
> Well at a first glance it would seem that starting with the core would be more
> logical. This is far from the truth IMHO. Take a board puzzle for example... 
> Does it make sense to start from the inside out ? Sure you can get it done that
> way, but it's going to take longer and surely going to be messy in the proc. 
> 
> So where do we start ? Well where would you say the outside of the kernel is ?
> I'd say /usr/src/linux-2.4.0-test1/net 
> 

  This could quickly get out of control. The first step should be an
solid framework for bug and patch submission. To provide a valuable
service to the maintainers of a certain portion of the code, there
should be a navigateable pool of bug reports as well as patches
which can easily be browsed for the desired content (possibly thru the web?).

My main idea is that by laying out a proper framework of services you
won't need to assign tasks (unless a group of people so wish, this could be
accomodated by the framework as well) because you'll have a
manageable receptacle for everyones specific talents by the nature
of the system.

Say someone wants to work on some fs races they found in 2.2.x one day,
they just open there browser and go into the fs section of the 2.2.x tracking
system, read the latest comments, look at the latest submissions. Voila! You
are on your way focusing on what kernel revision you want to work on, in
what area you want to focus on.  This could also be a less unobtrusive
way of people learning and beginning to participate in kernel development
without clogging up (or being overwhelmed by) the mainstream mailing lists.

Just some thoughts,

Eric

> 
> 
> 
> 
> -- 
> Bryan Paxton
> 
> "How should I know if it works? That's what beta testers are for. I
>           only coded it."
>  -- Linus Torvalds.
> 
> 
> 
> 
> Kernel-audit:  discussion list for security and the linux kernel
> Archive:       http://mail.nl.linux.org/kernel-audit/

Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Mon Jun 12 20:38:24 2000
Received: by humbolt.nl.linux.org id <S92173AbQFLSgB>;
	Mon, 12 Jun 2000 20:36:01 +0200
Received: from qmail2.crane.sgi.net ([209.166.163.29]:19854 "HELO
        mail.stargate.net") by humbolt.nl.linux.org with SMTP
	id <S92288AbQFLSeK>; Mon, 12 Jun 2000 20:34:10 +0200
Received: (qmail 14342 invoked from network); 12 Jun 2000 18:34:07 -0000
Received: from unknown (HELO star) (209.166.171.42)
  by qmail2-2.mx.stargate.net with SMTP; 12 Jun 2000 18:34:07 -0000
Reply-To: <jason@schwoo.com>
From:   "Jason Milletary" <jason@schwoo.com>
To:     "'LKAP : General'" <kernel-audit@nl.linux.org>
Subject: RE: suggestion
Date:   Mon, 12 Jun 2000 14:35:59 -0400
Message-ID: <31FC13508138D4119C6A00010249501345A3@QUAKE01>
MIME-Version: 1.0
Content-Type: text/plain;
	charset="US-ASCII"
Content-Transfer-Encoding: 7bit
X-Priority: 3 (Normal)
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook CWS, Build 9.0.2416 (9.0.2910.0)
X-MimeOLE: Produced By Microsoft MimeOLE V5.00.2314.1300
Importance: Normal
In-Reply-To: <31FC13508138D4119C6A0001024950131CCF@QUAKE01>
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list


>Sure, go ahead. But don't expect me to spend time on auditing
>2.0 or 2.2 ...  For 2.4, OTOH, I plan on making a pretty good
>effort in making the code better documented and more readable.

That's a good start.  Has it been determined what is considered
"more readable?"  Nothing like a good code formatting flamewar.

Obviously the 2.2 audit wouldnt have to be a thorough and complete
one.  Just a little practice to hammer out teh details.  You dont
expect everyone to dive into 2.4 and do things their own way at first?
Especially if you are attempting to clean up the code from more than a
security and functional point of view.

--Jason


Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Mon Jun 12 20:41:25 2000
Received: by humbolt.nl.linux.org id <S92288AbQFLSjP>;
	Mon, 12 Jun 2000 20:39:15 +0200
Received: from lemuria.borgfelde.ricardo.de ([195.244.103.65]:36882 "HELO
        mail.lemuria.org") by humbolt.nl.linux.org with SMTP
	id <S92244AbQFLSiB>; Mon, 12 Jun 2000 20:38:01 +0200
Received: from lemuria.org by mail.lemuria.org
	via rsmtp with bsmtp
	id <m131Z0W-0015wTC@mail.lemuria.org>
	for <kernel-audit@nl.linux.org>; Mon, 12 Jun 2000 20:32:20 +0200 (MEST)
	(Smail-3.2 1996-Jul-4 #1 built 1999-Nov-8)
Received: by lemuria.org
	via sendmail with stdio
	id <m131Yj0-000HioC@lemuria.org>
	for kernel-audit@nl.linux.org; Mon, 12 Jun 2000 20:14:14 +0200 (MEST)
	(Smail-3.2 1996-Jul-4 #1 built 1999-Nov-8)
Date:   Mon, 12 Jun 2000 20:14:14 +0200
From:   Tom Vogt <tom@lemuria.org>
To:     kernel-audit@nl.linux.org
Subject: Re: suggestion
Message-ID: <20000612201414.A25179@lemuria.org>
References: <200006121313.PAA31449@octopus.phy.bg.ac.yu>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
X-Mailer: Mutt 1.0pre3i
In-Reply-To: <200006121313.PAA31449@octopus.phy.bg.ac.yu>
X-Privacy: If you can, please encrypt your mails - finger for key
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

Boris Dragovic <lynx@phy.bg.ac.yu> wrote:
> I completely disagree... People wo are concerned with security are constantly
> following and installing the new kernel versions. People who are still 
> running 2.0.x or any not latest version of kernel and who are lazy to
> upgrade won't bother to use our patches anyway... so I think we should 
> start with current...

can't agree on that. I *am* one of the "people who are concerned with
security" and the kernels of my company's productive systems MIGHT get an
upgrade to 2.2.16 because of the recent bug, but other than that they are
usually a couple releases behind.

unless you're a paranoid military system, security is always at max your #2
concern (at most companies, considerably lower). a working system is #1 and
upgrading kernels for no good reasons means downtime or at least
considerable amounts of work you could spend elsewhere.


-- 
Welcome to the Information Superspyway

Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Mon Jun 12 20:44:14 2000
Received: by humbolt.nl.linux.org id <S92234AbQFLSkQ>;
	Mon, 12 Jun 2000 20:40:16 +0200
Received: from lemuria.borgfelde.ricardo.de ([195.244.103.65]:37138 "HELO
        mail.lemuria.org") by humbolt.nl.linux.org with SMTP
	id <S92247AbQFLSiB>; Mon, 12 Jun 2000 20:38:01 +0200
Received: from lemuria.org by mail.lemuria.org
	via rsmtp with bsmtp
	id <m131Z0W-0015wWC@mail.lemuria.org>
	for <kernel-audit@nl.linux.org>; Mon, 12 Jun 2000 20:32:20 +0200 (MEST)
	(Smail-3.2 1996-Jul-4 #1 built 1999-Nov-8)
Received: by lemuria.org
	via sendmail with stdio
	id <m131YmZ-000HioC@lemuria.org>
	for kernel-audit@nl.linux.org; Mon, 12 Jun 2000 20:17:55 +0200 (MEST)
	(Smail-3.2 1996-Jul-4 #1 built 1999-Nov-8)
Date:   Mon, 12 Jun 2000 20:17:55 +0200
From:   Tom Vogt <tom@lemuria.org>
To:     kernel-audit@nl.linux.org
Subject: Re: suggestion
Message-ID: <20000612201755.B25179@lemuria.org>
References: <200006112234.AAA22881@octopus.phy.bg.ac.yu> <39441F44.nailUT1Z8J86@ed.ed> <20000612102101.A23592@lemuria.org> <3944E588.nail871QZKVG@ed.ed>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
X-Mailer: Mutt 1.0pre3i
In-Reply-To: <3944E588.nail871QZKVG@ed.ed>
X-Privacy: If you can, please encrypt your mails - finger for key
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

root <evpopkov@carry.neonet.lv> wrote:
> > because the code is currently being reviewed and tested for function, not
> > for correctness and security.
> 
>  Well, the question was rhetoric. However, from the tester's point of view,
> is functional code correct?

not necessarily. it is doing it's job, but there could be a lot of things
it's doing wrong outside of that. for example, it could be manipulating
entities that it shouldn't.


> > 1) it's a hell of a lot easier and less time consuming, because you don't
> > have to constantly re-evaluate everything
> 
>  You contradict  yourself. Newer  releases will  introduce new  portions of
> code and we'll have to start over again each time.

that is exactly what I do NOT want. the proposal was to review ONE version,
not start over again every time a new one happens to show up. however, you
should stay informed about changes, since some of them might be relevant to
your auditing.


> > the very large majority of
> > production systems are frozen at a some (usually arbitrary) version
> > anyways.
> 
>  Yes. My production system is frozen  at 2.0.38. But that's not a majority.
> We don't have exact  figures at hand, so let's not  appeal to any whimsical
> majority.

let's say: "majority according to what I have seen in my job and Linux
project experience". your mileage may, of course, vary. but from the large
number of systems I've seen, I risk to make a generalization.


-- 
Welcome to the Information Superspyway

Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Mon Jun 12 20:51:55 2000
Received: by humbolt.nl.linux.org id <S92179AbQFLSvB>;
	Mon, 12 Jun 2000 20:51:01 +0200
Received: from corp.priceline.com ([208.219.50.155]:53594 "HELO webshield-02")
	by humbolt.nl.linux.org with SMTP id <S92175AbQFLSue>;
	Mon, 12 Jun 2000 20:50:34 +0200
Received: FROM exchange_server.corp.priceline.com BY webshield-02 ; Mon Jun 12 14:50:27 2000 -0400
Received: by mail.corp.priceline.com with Internet Mail Service (5.5.2650.21)
	id <MS5L1N5T>; Mon, 12 Jun 2000 14:51:34 -0400
Message-ID: <D505BA1425EED3119B7F00508B94D84E368F57@CT-EXCH-03>
From:   "Whyte, Jesse" <Jesse.Whyte@priceline.com>
To:     'Tom Vogt' <tom@lemuria.org>, kernel-audit@nl.linux.org
Subject: RE: suggestion
Date:   Mon, 12 Jun 2000 14:49:26 -0400
MIME-Version: 1.0
X-Mailer: Internet Mail Service (5.5.2650.21)
Content-Type: text/plain;
	charset="iso-8859-1"
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

It seems like there is a clear split in consensus here.  I would hope that
somebody or some group providing leadership to this project could give us
direction.  I see clear points for either argument.

As a group, we have limited resources and can't expect to accomplish
everything overnight if we are auditing many different kernel releases.
But, there are definately valid reasons to be auditing as far back as the
2.0.x kernel.  I don't really forsee a meeting of the minds here.

Is there a charter or something of the like for this group?  Or should we
just draft one, have the group vote on it, and move forward with the
results?  I personally couldn't be happier than if the founder(s) of the
LKAP would just give their direction and the project could then move
forward.  If you disagree with the project, than drop off...

My two cents,
Jesse

-----Original Message-----
From: Tom Vogt [mailto:tom@lemuria.org]
Sent: Monday, June 12, 2000 2:14 PM
To: kernel-audit@nl.linux.org
Subject: Re: suggestion


Boris Dragovic <lynx@phy.bg.ac.yu> wrote:
> I completely disagree... People wo are concerned with security are
constantly
> following and installing the new kernel versions. People who are still 
> running 2.0.x or any not latest version of kernel and who are lazy to
> upgrade won't bother to use our patches anyway... so I think we should 
> start with current...

can't agree on that. I *am* one of the "people who are concerned with
security" and the kernels of my company's productive systems MIGHT get an
upgrade to 2.2.16 because of the recent bug, but other than that they are
usually a couple releases behind.

unless you're a paranoid military system, security is always at max your #2
concern (at most companies, considerably lower). a working system is #1 and
upgrading kernels for no good reasons means downtime or at least
considerable amounts of work you could spend elsewhere.


-- 
Welcome to the Information Superspyway

Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Mon Jun 12 21:18:57 2000
Received: by humbolt.nl.linux.org id <S92244AbQFLTSC>;
	Mon, 12 Jun 2000 21:18:02 +0200
Received: from lemuria.borgfelde.ricardo.de ([195.244.103.65]:60178 "HELO
        mail.lemuria.org") by humbolt.nl.linux.org with SMTP
	id <S92175AbQFLTRg>; Mon, 12 Jun 2000 21:17:36 +0200
Received: from lemuria.org by mail.lemuria.org
	via rsmtp with bsmtp
	id <m131ZYs-0015wMC@mail.lemuria.org>
	for <kernel-audit@nl.linux.org>; Mon, 12 Jun 2000 21:07:50 +0200 (MEST)
	(Smail-3.2 1996-Jul-4 #1 built 1999-Nov-8)
Received: by lemuria.org
	via sendmail with stdio
	id <m131Z77-000HioC@lemuria.org>
	for kernel-audit@nl.linux.org; Mon, 12 Jun 2000 20:39:09 +0200 (MEST)
	(Smail-3.2 1996-Jul-4 #1 built 1999-Nov-8)
Date:   Mon, 12 Jun 2000 20:39:09 +0200
From:   Tom Vogt <tom@lemuria.org>
To:     kernel-audit@nl.linux.org
Subject: Re: suggestion
Message-ID: <20000612203909.A25330@lemuria.org>
References: <Pine.LNX.4.10.10006120930380.25705-100000@ellipsis.aniota.net> <Pine.GSO.4.10.10006121236030.18331-100000@homer.ai.org>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
X-Mailer: Mutt 1.0pre3i
In-Reply-To: <Pine.GSO.4.10.10006121236030.18331-100000@homer.ai.org>
X-Privacy: If you can, please encrypt your mails - finger for key
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

Greg Swallow <gswallow@ai.org> wrote:
> Long running systems on 2.0.x generally have administrators that aren't
> keen on compiling new kernels, don't they?

not quite true. for example, until recently my home server (running mail
for a couple of people, among other things) was running 2.0.38 and the
other software wasn't much younger.

the simple reason is that it worked. why waste time on fixing something
that's not broken? even though I've compiled dozens of kernels past
year, I have better things to do with my time than replacing kernels just
for the fun of it.


in summary, there are various opinions about where to start, and all of
them have good points to make. how about meeting in the middle as a
compromise? 2.2.x is neither outdated nor bleeding edge, and shares lots of
code with both 2.0.x and 2.4


-- 
Welcome to the Information Superspyway

Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Mon Jun 12 21:20:44 2000
Received: by humbolt.nl.linux.org id <S92246AbQFLTSV>;
	Mon, 12 Jun 2000 21:18:21 +0200
Received: from lemuria.borgfelde.ricardo.de ([195.244.103.65]:60434 "HELO
        mail.lemuria.org") by humbolt.nl.linux.org with SMTP
	id <S92180AbQFLTRh>; Mon, 12 Jun 2000 21:17:37 +0200
Received: from lemuria.org by mail.lemuria.org
	via rsmtp with bsmtp
	id <m131ZYs-0015wWC@mail.lemuria.org>
	for <kernel-audit@nl.linux.org>; Mon, 12 Jun 2000 21:07:50 +0200 (MEST)
	(Smail-3.2 1996-Jul-4 #1 built 1999-Nov-8)
Received: by lemuria.org
	via sendmail with stdio
	id <m131ZVs-000HioC@lemuria.org>
	for kernel-audit@nl.linux.org; Mon, 12 Jun 2000 21:04:44 +0200 (MEST)
	(Smail-3.2 1996-Jul-4 #1 built 1999-Nov-8)
Date:   Mon, 12 Jun 2000 21:04:43 +0200
From:   Tom Vogt <tom@lemuria.org>
To:     kernel-audit@nl.linux.org
Subject: Re: suggestion
Message-ID: <20000612210443.B25330@lemuria.org>
References: <31FC13508138D4119C6A000102495013459F@QUAKE01> <Pine.LNX.3.96.1000612124610.32A-100000@plow>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
X-Mailer: Mutt 1.0pre3i
In-Reply-To: <Pine.LNX.3.96.1000612124610.32A-100000@plow>
X-Privacy: If you can, please encrypt your mails - finger for key
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

Greg Alexander <galexand@acm.org> wrote:
> The way successful projects work is that a small group of people DOES IT,
> and only THEN do they bother to try to get the rest of the world in on it

100% agree. so let's just do it.


I've said before that I won't have much time to do audits, but let's get
the ball rolling. I just grabbed the smallest .c from net/ipv4 and gave it
a good look.

File:		net/ipv4/utils.c
md5sum:		4546a92eb20861ff8785e9d9ae830853
Kernel Version:	2.2.13

Function Name:		in_ntoa
Maintainer:		kuznet
Auditor:		Tom Vogt <tom@lemuria.org>
Arguments:		__u32 in
Return Value:		char *
Global Variables:	-
Locks:			-
Functions Called:	sprintf
Things to Note:		return value is declared static - no need to
			allocate or free it
Other Notes:		return value has 18 bytes allocated, but will never
			need more than 16 (including \x0).


Function Name:		in_aton
Maintainer:		kuznet
Auditor:		Tom Vogt <tom@lemuria.org>
Arguments:		const char *str
Return Value:		__u32
Global Variables:	-
Locks:			-
Functions Called:	htonl
Things to Note:		direct return of the htonl() call
Other Notes:


that's it. easy to beat that, both in number of functions and lines of
code. :)


-- 
Welcome to the Information Superspyway

Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Mon Jun 12 21:22:44 2000
Received: by humbolt.nl.linux.org id <S92247AbQFLTV1>;
	Mon, 12 Jun 2000 21:21:27 +0200
Received: from jetson.astro.uiuc.edu ([128.174.51.201]:49676 "EHLO
        jetson.astro.uiuc.edu") by humbolt.nl.linux.org with ESMTP
	id <S92285AbQFLTUt>; Mon, 12 Jun 2000 21:20:49 +0200
Received: from jetson (jetson [128.174.51.201])
	by jetson.astro.uiuc.edu (8.9.3/8.9.3) with ESMTP id OAA13771;
	Mon, 12 Jun 2000 14:23:09 -0500
Date:   Mon, 12 Jun 2000 14:23:09 -0500 (CDT)
From:   Pete Krawczyk <petek@bsod.net>
X-Sender: petek@jetson
To:     Eric Gibson <emg@lyonfyre.net>
cc:     kernel-audit@nl.linux.org
Subject: Re: A proposed model for the audit
In-Reply-To: <20000612143258.A29185@sandbender.voxel.net>
Message-ID: <Pine.LNX.4.10.10006121416050.13768-100000@jetson>
X-PGP:  finger for PGP public key: pkrawczy@uiuc.edu
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

Date: Mon, 12 Jun 2000 14:32:58 -0400
From: Eric Gibson <emg@lyonfyre.net>
Subject: Re: A proposed model for the audit

}> So where do we start ? Well where would you say the outside of the kernel is ?
}> I'd say /usr/src/linux-2.4.0-test1/net 
}
}  This could quickly get out of control. The first step should be an
}solid framework for bug and patch submission. To provide a valuable
}service to the maintainers of a certain portion of the code, there
}should be a navigateable pool of bug reports as well as patches
}which can easily be browsed for the desired content (possibly thru the web?).

We've got this started at SourceForge.  Check out
http://kernel-audit.sourceforge.net/ for those things.  As far as
confirming audit of a file, we're still working on that.

}My main idea is that by laying out a proper framework of services you
}won't need to assign tasks (unless a group of people so wish, this could be
}accomodated by the framework as well) because you'll have a
}manageable receptacle for everyones specific talents by the nature
}of the system.

That's the general idea.

Eventaully we'll have a CVS tree up that will contain the bugs we find,
the audits we've performed, etc.  However, no good consensus on how that
should be structured has been reached.  I made a suggestion earlier, and I
believe another one was thrown in others including Alan Cox about using
the existing docbook format of the kernel.  The problem I see with that
method is that we have to continually update the kernel tree at the very
beginning here - and the diffs will get huge with documentation as the
reason for it.  Not that that's bad, but I say we should get it organized
first.

There is now an official homepage location - http://www.lkap.org/ - but I
don't think the homepage design has been finalized, etc.

-Pete K
-- 
Pete Krawczyk
  petek at bsod dot net or pkrawczy at uiuc dot edu
  http://www.uiuc.edu/ph/www/pkrawczy/
  Finger pkrawczy at uiuc dot edu for PGP public key




Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Mon Jun 12 21:54:26 2000
Received: by humbolt.nl.linux.org id <S92285AbQFLTxd>;
	Mon, 12 Jun 2000 21:53:33 +0200
Received: from mail2.bna.bellsouth.net ([205.152.150.14]:31891 "EHLO
        mail2.bna.bellsouth.net") by humbolt.nl.linux.org with ESMTP
	id <S92175AbQFLTw7>; Mon, 12 Jun 2000 21:52:59 +0200
Received: from adsl-78-129-55.mem.bellsouth.net (adsl-78-129-55.mem.bellsouth.net [216.78.129.55])
	by mail2.bna.bellsouth.net (3.3.5alt/0.75.2) with ESMTP id PAA00082
	for <kernel-audit@nl.linux.org>; Mon, 12 Jun 2000 15:52:56 -0400 (EDT)
Date:   Mon, 12 Jun 2000 14:49:01 -0500 (CDT)
From:   Bryan Paxton <evil7@bellsouth.net>
X-Sender: evil7@sqa.speedbros.org
To:     kernel-audit@nl.linux.org
Subject: Re: lkap.org
Message-ID: <Pine.LNX.4.21.0006121448150.663-100000@sqa.speedbros.org>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

First off I think you're missing the point by me getting so yahoo over a new 00 
in the mailing list. EVERYONE counts. Right down to the person who's learning
how to compile gcc for the first time.

And second, yes that is a great idea... And hehe yes we need lots of help...
This could also be a much more clean way of setting up groups for subsystems
of the kernel.



On Tue, 13 Jun 2000, you wrote:
> I have an idea.  Right now you are basing our numbers on the number of mailing
> list members.  I was thinking, I often join mailinglists, just to see what's 
> going on and not really to participate and I figure there are many other 
> parasites out there as well.
> 
> 
> Mike Messmore
> mesmd@rhodes.edu
> mmessmore@nwgs.com 

-- 
Bryan Paxton

"How should I know if it works? That's what beta testers are for. I
          only coded it."
 -- Linus Torvalds.




Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Mon Jun 12 21:56:35 2000
Received: by humbolt.nl.linux.org id <S92180AbQFLTzd>;
	Mon, 12 Jun 2000 21:55:33 +0200
Received: from mail0.bna.bellsouth.net ([205.152.150.12]:54758 "EHLO
        mail0.bna.bellsouth.net") by humbolt.nl.linux.org with ESMTP
	id <S92249AbQFLTyz>; Mon, 12 Jun 2000 21:54:55 +0200
Received: from adsl-78-129-55.mem.bellsouth.net (adsl-78-129-55.mem.bellsouth.net [216.78.129.55])
	by mail0.bna.bellsouth.net (3.3.5alt/0.75.2) with ESMTP id PAA24449
	for <kernel-audit@nl.linux.org>; Mon, 12 Jun 2000 15:54:52 -0400 (EDT)
Date:   Mon, 12 Jun 2000 14:50:59 -0500 (CDT)
From:   Bryan Paxton <evil7@bellsouth.net>
X-Sender: evil7@sqa.speedbros.org
To:     kernel-audit@nl.linux.org
Subject: Re: 300 subscribed!
Message-ID: <Pine.LNX.4.21.0006121450340.668-100000@sqa.speedbros.org>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

Welp Greg, I suppose the 300 morons on this list will miss you....


On Mon, 12 Jun 2000, Greg Alexander wrote:
> >yes that's right...
> >
> >After only a few days(roughly 3) we have 300 users subscribed!
> >
> >Lets keep this up, and get it rolling internally. 
> 
> Many of these users don't know heads from tails.  My mailbox is flooded.
> I'm unsubscribing tomorrow if it doesn't become moderated.

-- 
Bryan Paxton

"How should I know if it works? That's what beta testers are for. I
          only coded it."
 -- Linus Torvalds.




Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Mon Jun 12 22:02:36 2000
Received: by humbolt.nl.linux.org id <S92249AbQFLUBn>;
	Mon, 12 Jun 2000 22:01:43 +0200
Received: from carry.netneo.com ([195.62.128.21]:27149 "EHLO carry.neonet.lv")
	by humbolt.nl.linux.org with ESMTP id <S92175AbQFLUBQ>;
	Mon, 12 Jun 2000 22:01:16 +0200
Received: from ed.ed (as0c.netneo.com [195.62.135.194])
	by carry.neonet.lv (8.9.3/8.9.3) with ESMTP id WAA08243
	for <kernel-audit@nl.linux.org>; Mon, 12 Jun 2000 22:00:45 +0200
Received: (from root@localhost)
	by ed.ed (8.8.7/8.8.5) id TAA01423
	for kernel-audit@nl.linux.org; Mon, 12 Jun 2000 19:50:22 GMT
From:   root <evpopkov@carry.neonet.lv>
Date:   Mon, 12 Jun 2000 19:50:22 +0000
To:     kernel-audit@nl.linux.org
Subject: RE: suggestion
Message-ID: <39453EFE.nail13E1P272G@ed.ed>
References: <D505BA1425EED3119B7F00508B94D84E368F57@CT-EXCH-03>
X-Mailer: nail 9.13 2000-05-30
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

> Is there a charter or something of the like for this group? Or should we
> just draft one, have the group vote on it, and move forward with the
> results?

 Playing democracy is pure waste of  time IMHO. If the group, consisting on
3/4 of people  who won't be actually reviewing the  code, votes for picking
the most recent code, those  interested in thorough and professional review
of other versions will just bail out.
 Let everyone start with what they have  at hands now. I have 2.0.x and I'm
ready to go. If someone has newer kernel and want to work on them, who am I
to stop them?
 What I would really hate to see is postings, that deal with older kernels,
being spoken  about as irrelevant,  just because it's  not hot, not  in and
gives no recognition among wannabee crowd.

> I personally couldn't be happier than if the founder(s) of the
> LKAP would just give their direction and the project could then move
> forward. If you disagree with the project, than drop off...

 Makes  sense. We  can't  get any  far without  discipline.  It looks  like
everyone has  spoken out his  opinion. Bryan had  offered his way  as well.
What  we need  now is  a sober  and weighed  decision that  will become  an
_order_ to the group. And those who disagree must leave.


---

 "Teddy - I suppose Mummy and Daddy are real, aren't they?"
 Teddy said, "You ask such silly questions, David. Nobody knows what
'real' really means. Let's go indoors."

 Brian W. Aldiss, Supertoys Last All Summer Long


Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Mon Jun 12 22:04:35 2000
Received: by humbolt.nl.linux.org id <S92292AbQFLUD3>;
	Mon, 12 Jun 2000 22:03:29 +0200
Received: from smtp3.libero.it ([193.70.192.53]:36077 "EHLO smtp3.libero.it")
	by humbolt.nl.linux.org with ESMTP id <S92175AbQFLUCt>;
	Mon, 12 Jun 2000 22:02:49 +0200
Received: from armageddon.allanon.org (151.20.20.173) by smtp3.libero.it; 12 Jun 2000 22:01:57 +0200
Received: by armageddon.allanon.org (Postfix, from userid 0)
	id 1C7565FBC; Tue, 13 Jun 2000 18:32:07 +0200 (CEST)
Date:   Tue, 13 Jun 2000 18:32:07 +0200
From:   Gigi Sullivan <sullivan@sikurezza.org>
To:     Stephan Zaniolo <eaglefeather@mindspring.com>
Cc:     kernel-audit@nl.linux.org
Subject: Re: Only auditing current 2.4 code?
Message-ID: <20000613183207.B265@armageddon.libero.it>
References: <200006112253.SAA30177@maynard.mail.mindspring.net>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
X-Mailer: Mutt 0.95.5i
In-Reply-To: <200006112253.SAA30177@maynard.mail.mindspring.net>; from Stephan Zaniolo on Sun, Jun 11, 2000 at 05:54:22PM -0500
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

Aiee :)

	Hello!

> 
> 	I'm quite new to programming and never done a code audit before,
> but I had a thought.  Darron suggests below (as others have as well) that
> this project focus on the 2.2.x or earlier kernels as they are more
> stable.  Could it be more advantageous to work on the 2.4.x kernels
> BECAUSE they are in a state of flux?  Would the kernel hackers be more
> willing to incorporate changes in them now while they're still tinkering
> in the bowels of the code?  Although an audit of the stable kernels would
> make our job easier, would the kernel hackers (who are going to be
> focusing on the 2.4.x kernels) going to be as willing to patch a stable
> kernel that fewer people are working on, with code that might break
> something else at a higher level?

	This sounds good and it's right, however keep in mind that LOTS of 
	people won't upgrade their kernel when the new one will be out 
	(really out) for several reason that are pointless stated here.

	I guess we should concentrate our work on both kernel 2.2.X series
	and 2.4.X ones, with particoular care about the former, IMHO.

	Nevertheless to say that the current new kernel should not be put
	in a corner ...

> 
> IMHO,
> Stephan
> 

bye bye

			-- gg sullivan

-- 
Lorenzo Cavallaro	`Gigi Sullivan' <sullivan@sikurezza.org>

Until I loved, life had no beauty;
I did not know I lived until I had loved. (Theodor Korner)

Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Mon Jun 12 22:06:35 2000
Received: by humbolt.nl.linux.org id <S92175AbQFLUFL>;
	Mon, 12 Jun 2000 22:05:11 +0200
Received: from shafik-1.dsl.speakeasy.net ([216.254.73.173]:57866 "EHLO
        shafik.net") by humbolt.nl.linux.org with ESMTP id <S92295AbQFLUEK>;
	Mon, 12 Jun 2000 22:04:10 +0200
Received: from localhost (shafik@localhost)
	by shafik.net (8.9.3/8.9.3) with ESMTP id PAA22409;
	Mon, 12 Jun 2000 15:58:57 -0400
Date:   Mon, 12 Jun 2000 19:58:57 +0000 (/etc/localtime)
From:   <shafik@shafik.net>
To:     Bryan Paxton <evil7@bellsouth.net>
cc:     kernel-audit@nl.linux.org
Subject: Re: Start with Documentation?
In-Reply-To: <Pine.LNX.4.21.0006120221130.942-100000@sqa.speedbros.org>
Message-ID: <Pine.LNX.4.10.10006121930180.22257-100000@shafik.net>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

	Well, I am not sure this project can function very long or
effectively without documentation. I mean if this was a small group like
the 10 man OpenBSD team then we could probably do without but we are
talking 300+ so far. I think everyone who knows the kernel will get tired
very quickly of explaining the same things over and over again to those
that don't, no matter how much we would like to.

	This is just my experience from years on the CircleMud mailing
list, when it was small, the fact that little documentation existed was
okay but once the list had more and more newbies it became unbearable, and
I was just a passive list user, I can imagine how the people who tried to
answer all the questions felt, I just keep hitting delete ;{). 

	I mean most of the documentation will probably not change from
kernel to kernel, so once we get it done for e.g. 2.2.x series then
updating it and keeping it updated should not be too bad.

	I would spear-head this myself but I really don't believe I have
the spare time to devote to such an under-taking. 

	this book:

	http://www.coriolis.com/bookstore/bookdetail.cfm?id=1576104699

	is an perfect example of what the documentation should be like, I
have learned more from this book in a few days then I did from all the
other documentation I can find on the Internet put together, they are
either too high-level or too specific to a small section of code. 

my $0.02

On Mon, 12 Jun 2000, Bryan Paxton wrote:

> heh noone has a thing against documentation...
> Who's willing to take the time out to write it is the question at
> hand.......
> 
> 
> 
> -- 
> Bryan Paxton
> 
> "How should I know if it works? That's what beta testers are for. I
>           only coded it."
>  -- Linus Torvalds.
> 
> 
> 
> 
> Kernel-audit:  discussion list for security and the linux kernel
> Archive:       http://mail.nl.linux.org/kernel-audit/
> 

==========================================================================
--"the more you know and understand the more you must know and understand
   .. knowledge is an unsatiable hunger .. which makes life easier and at
   the same time harder .... knowledge is a paradox w/ no resolution just
   a boundless function of human nature .... knowledge is a trap which we
   embrace and which we run away from .... and in the end the only escape
   is death .... or maybe not "<grin>--
==========================================================================
                     -Unite for Java! - http://www.javalobby.org-
                     -This message transmitted on 100% recycled electrons-
                     -Save the whales, Feed the hungry, Free the mallocs-


Two cats on a roof,
Which one falls off first?
The one with the smaller mew.


Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Mon Jun 12 22:40:18 2000
Received: by humbolt.nl.linux.org id <S92293AbQFLUjX>;
	Mon, 12 Jun 2000 22:39:23 +0200
Received: from ns.dcu.ie ([136.206.1.3]:40197 "EHLO student-mailhub.dcu.ie")
	by humbolt.nl.linux.org with ESMTP id <S92167AbQFLUi6>;
	Mon, 12 Jun 2000 22:38:58 +0200
Received: from enigma.redbrick.dcu.ie ([136.206.15.21])
	by student-mailhub.dcu.ie (8.9.3/8.9.3/893-FD) with ESMTP id VAA31694
	for <kernel-audit@nl.linux.org>; Mon, 12 Jun 2000 21:38:58 +0100 (BST)
Received: by enigma.redbrick.dcu.ie (Postfix, from userid 1200)
	id C7FE57D43; Mon, 12 Jun 2000 21:38:58 +0100 (IST)
Date:   Mon, 12 Jun 2000 21:38:58 +0100
From:   Mark Dunne <pixies@redbrick.dcu.ie>
To:     kernel-audit@nl.linux.org
Message-ID: <20000612213858.B31183@enigma.redbrick.dcu.ie>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
User-Agent: Mutt/1.2i
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

auth c39d41a6 subscribe kernel-audit pixies@redbrick.dcu.ie

Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Mon Jun 12 22:53:48 2000
Received: by humbolt.nl.linux.org id <S92296AbQFLUwy>;
	Mon, 12 Jun 2000 22:52:54 +0200
Received: from a.kwic.com ([205.150.58.2]:60173 "EHLO a.kwic.com")
	by humbolt.nl.linux.org with ESMTP id <S92184AbQFLUwb> convert rfc822-to-8bit;
	Mon, 12 Jun 2000 22:52:31 +0200
Received: from bambam.completecomputerfriend.com (nobody@ct-1-til-ppp20.kwic.com [216.94.38.30])
	by a.kwic.com (8.9.3/8.9.3) with SMTP id QAA06392
	for <kernel-audit@nl.linux.org>; Mon, 12 Jun 2000 16:44:25 -0400 (EDT)
From:   Asmodeus <asmodeus@beast.tburg.net>
To:     kernel-audit@nl.linux.org
Subject: Re: suggestion
Date:   Mon, 12 Jun 2000 16:43:15 -0400
X-Mailer: KMail [version 1.0.21]
Content-Type: text/plain
MIME-Version: 1.0
Message-Id: <00061216444600.01339@bambam.completecomputerfriend.com>
Content-Transfer-Encoding: 8BIT
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list


On Mon, Jun 12, 2000 at 07:50:22PM +0000, root wrote:
 
>  Playing democracy is pure waste of  time IMHO. If the group, consisting on
> 3/4 of people  who won't be actually reviewing the  code, votes for picking
> the most recent code, those  interested in thorough and professional review
> of other versions will just bail out.
>  Let everyone start with what they have  at hands now. I have 2.0.x and I'm
> ready to go. If someone has newer kernel and want to work on them, who am I
> to stop them?
 
 I agree; jump in with whatever you have, and when/if the database gets
implemented, then we'll have some content to insert into it.
 
 Perhaps we should have three more lists: kernel-audit-2.0,
kernel-audit-2.2 and kernel-audit-2.4 where the people interested in auditing
each version of the kernel can discuss the specifics of how the kernel was
implemented at that time in its life.
 
 The current list can be easily used as a clearinghouse for issues which are
beyond the scope of a single stable kernel series, and as a method to tie the
three together.
 
>  What I would really hate to see is postings, that deal with older kernels,
> being spoken  about as irrelevant,  just because it's  not hot, not  in and
> gives no recognition among wannabee crowd.
 
 Again, I agree completely.  No matter what kernel revision you are using,
there's going to be other people who don't want to use that one.  Even if
you are the most bleeding-edge person, you're still behind the kernel
developers who play with the bleeding edge before its even the "bleeding
edge."
 
.Shawn
 
 
 
                                                     

Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Mon Jun 12 23:00:55 2000
Received: by humbolt.nl.linux.org id <S92184AbQFLVAD>;
	Mon, 12 Jun 2000 23:00:03 +0200
Received: from smtp1.libero.it ([193.70.192.51]:35267 "EHLO smtp1.libero.it")
	by humbolt.nl.linux.org with ESMTP id <S92167AbQFLU70>;
	Mon, 12 Jun 2000 22:59:26 +0200
Received: from armageddon.allanon.org (151.20.20.173) by smtp1.libero.it; 12 Jun 2000 22:59:01 +0200
Received: by armageddon.allanon.org (Postfix, from userid 0)
	id E85B15FBC; Wed, 14 Jun 2000 17:54:57 +0200 (CEST)
Date:   Wed, 14 Jun 2000 17:54:57 +0200
From:   Gigi Sullivan <sullivan@sikurezza.org>
To:     Bryan Paxton <evil7@bellsouth.net>
Cc:     kernel-audit@nl.linux.org
Subject: Re: A proposed model for the audit
Message-ID: <20000614175457.A422@armageddon.libero.it>
References: <Pine.LNX.4.21.0006112326210.606-100000@sqa.speedbros.org>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
X-Mailer: Mutt 0.95.5i
In-Reply-To: <Pine.LNX.4.21.0006112326210.606-100000@sqa.speedbros.org>; from Bryan Paxton on Sun, Jun 11, 2000 at 11:27:05PM -0500
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

Aiee :)

	Hello!

> > 
> > > A freeze on kernel 2.3.99-pre10-3 a.k.a. 2.4.0-test1
> > 
> > Do keep in mind these are two different kernels.  Code changed between them.
> 
> I wasn't aware that a lot of the code was managled, so ok. Lemme rephrase myself
> because I'm a moron. 
> 
> A freeze on kernel 2.4.0-test1

	Well, I'm saying again (forgive me, please :D) what I'm thinking.

	We should not *forget* that lots of people (lets say sites ;)) are
	now (and probably will continue for some times) running 2.2.X kernel
	series.

	Things changed a lot from 2.2 to 2.4.

	Maybe we can audit (and starting) two main kernel at a time.
	One current kernel, 2.2 and one `stable' (future) one, 2.4.

	We have to audit 2.2 kernel series.
	Even if the `new' young kernel is (will be) 2.4, there will be
	long time before quite everybody will turn into this new series.

	All above is IMHO :)


[snip]

> 
> -- 
> Bryan Paxton
> 
> "How should I know if it works? That's what beta testers are for. I
>           only coded it."
>  -- Linus Torvalds.

bye bye

			-- gg sullivan

-- 
Lorenzo Cavallaro	`Gigi Sullivan' <sullivan@sikurezza.org>

Until I loved, life had no beauty;
I did not know I lived until I had loved. (Theodor Korner)

Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Mon Jun 12 23:06:56 2000
Received: by humbolt.nl.linux.org id <S92167AbQFLVFn>;
	Mon, 12 Jun 2000 23:05:43 +0200
Received: from carry.netneo.com ([195.62.128.21]:61199 "EHLO carry.neonet.lv")
	by humbolt.nl.linux.org with ESMTP id <S92307AbQFLVFN>;
	Mon, 12 Jun 2000 23:05:13 +0200
Received: from ed.ed (as0c.netneo.com [195.62.135.194])
	by carry.neonet.lv (8.9.3/8.9.3) with ESMTP id XAA09241
	for <kernel-audit@nl.linux.org>; Mon, 12 Jun 2000 23:04:40 +0200
Received: (from root@localhost)
	by ed.ed (8.8.7/8.8.5) id VAA02697
	for kernel-audit@nl.linux.org; Mon, 12 Jun 2000 21:03:35 GMT
From:   root <evpopkov@carry.neonet.lv>
Date:   Mon, 12 Jun 2000 21:03:35 +0000
To:     kernel-audit@nl.linux.org
Subject: KMail
Message-ID: <39455027.nail22T11S9QA@ed.ed>
References: <00061216444600.01339@bambam.completecomputerfriend.com>
X-Mailer: nail 9.13 2000-05-30
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list


 I  don't know  whether it's  just  me, but  messages sent  with KMail  are
absolutely unreadable. This is off-topic, I know, but still....



---

 "Teddy - I suppose Mummy and Daddy are real, aren't they?"
 Teddy said, "You ask such silly questions, David. Nobody knows what
'real' really means. Let's go indoors."

 Brian W. Aldiss, Supertoys Last All Summer Long


Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Mon Jun 12 23:19:37 2000
Received: by humbolt.nl.linux.org id <S92295AbQFLVSo>;
	Mon, 12 Jun 2000 23:18:44 +0200
Received: from cpimssmtpu10.smtp.email.msn.com ([207.46.181.60]:6158 "EHLO
        smtp.email.msn.com") by humbolt.nl.linux.org with ESMTP
	id <S92298AbQFLVSN>; Mon, 12 Jun 2000 23:18:13 +0200
Received: from win98 - 63.27.57.152 by email.msn.com with Microsoft SMTPSVC;
	 Mon, 12 Jun 2000 14:17:54 -0700
From:   "Todd Fencl" <fencl12@email.msn.com>
To:     <kernel-audit@nl.linux.org>
Subject: RE: A proposed model for the audit
Date:   Mon, 12 Jun 2000 17:15:48 -0400
Message-ID: <AEEEKLJAHMJHEPBIJLPEKEJPCCAA.fencl12@email.msn.com>
MIME-Version: 1.0
Content-Type: text/plain;
	charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
X-Priority: 3 (Normal)
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook IMO, Build 9.0.2416 (9.0.2910.0)
In-Reply-To: <20000614175457.A422@armageddon.libero.it>
X-MimeOLE: Produced By Microsoft MimeOLE V5.00.2919.6600
Importance: Normal
Disposition-Notification-To: "Todd Fencl" <fencl12@email.msn.com>
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

## snip from Gigi
	We have to audit 2.2 kernel series.
	Even if the `new' young kernel is (will be) 2.4, there will be
	long time before quite everybody will turn into this new series.

I have to agree. I would vote to maintain / secure both code bases. I have
several machines (~15) that are running 2.2.x kernels and I have no great
desire to upgrade them as soon as 2.4.x is released. Maybe down the road
when 2.4.x has been out and tested in 'real world' systems, but not until
then.

--
Todd Fencl < fencl12@msn.com >
-- Where would you like to go today? ...
   the road is open, just as the source !!



Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Mon Jun 12 23:22:25 2000
Received: by humbolt.nl.linux.org id <S92301AbQFLVVF>;
	Mon, 12 Jun 2000 23:21:05 +0200
Received: from ppp100-yorkpa.netrax.net ([205.231.165.100]:55055 "EHLO
        yinyang.hjsoft.com") by humbolt.nl.linux.org with ESMTP
	id <S92298AbQFLVTv>; Mon, 12 Jun 2000 23:19:51 +0200
Received: from localhost (god@localhost)
	by yinyang.hjsoft.com (8.11.0.Beta1/8.11.0.Beta1) with ESMTP id e5CLJla19786
	for <kernel-audit@nl.linux.org>; Mon, 12 Jun 2000 17:19:47 -0400
Date:   Mon, 12 Jun 2000 17:19:34 -0400 (EDT)
From:   <god@yinyang.hjsoft.com>
Reply-To: god@yinyang.hjsoft.com
To:     kernel-audit@nl.linux.org
Subject: RE: suggestion
In-Reply-To: <39453EFE.nail13E1P272G@ed.ed>
Message-ID: <Pine.LNX.4.21.0006121659001.18618-100000@yinyang.hjsoft.com>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Mon, 12 Jun 2000, root wrote:

> > I personally couldn't be happier than if the founder(s) of the
> > LKAP would just give their direction and the project could then move
> > forward. If you disagree with the project, than drop off...
> 
>  Makes  sense. We  can't  get any  far without  discipline.  It looks  like
> everyone has  spoken out his  opinion. Bryan had  offered his way  as well.
> What  we need  now is  a sober  and weighed  decision that  will become  an
> _order_ to the group. And those who disagree must leave.
> 

Forgive me if this has been meantioned before, I occasion run
into a linux machine still running 1.2.8 or older. It would be nice to
have all the code for all available releases audited. This presents a
problem of getting old patches though. After the initial linux kernel
1.0.0 or whatever audit, only the changes would need audited. 

A compliement to the above would be to have a database of know security
flaws in the kernel and what versions or range of versions they
effect. A web front edn for this database would also be helpful. This will
also help provide something to compare the audit against. We should at
least be able to find all of the known security bugs.

I think that if we performed an audit from this far back it would not only
help with experience, but we may find something lurking in the code from
back in the 1.2.x days. Another aspect of the earlier kernels was they
were a lot smaller, so a complete audit would not take as long as a modern
descendant. Using the earliest kernel as phase 1 also gives us time to
find our common ground, get better organized, build some helpful tools,
and get a simpler kernel under our belt at the same time. 

As far as I'm concerned, I can help out the the known vulnerabilty
database and maybe some other aspects of this project. I'm not
expereienced enuogh to help out with the actual auditing.

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.0 (GNU/Linux)
Comment: Made with pgp4pine 1.75

iEYEARECAAYFAjlFU/AACgkQwtU6L/A4vVCzmACbBW1gU7d4d17pcTbWY5cYd6QH
fPcAnj1XEn0WrsK2KJvRfrxMeQUexp0y
=wmRI
-----END PGP SIGNATURE-----



Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Mon Jun 12 23:24:16 2000
Received: by humbolt.nl.linux.org id <S92298AbQFLVWc>;
	Mon, 12 Jun 2000 23:22:32 +0200
Received: from octopus.phy.bg.ac.yu ([147.91.80.4]:49695 "EHLO
        octopus.phy.bg.ac.yu") by humbolt.nl.linux.org with ESMTP
	id <S92300AbQFLVVt>; Mon, 12 Jun 2000 23:21:49 +0200
Received: (from lynx@localhost)
	by octopus.phy.bg.ac.yu (8.9.0/8.9.0) id XAA01982;
	Mon, 12 Jun 2000 23:21:32 +0200
Date:   Mon, 12 Jun 2000 23:21:32 +0200
From:   Boris Dragovic <lynx@phy.bg.ac.yu>
Message-Id: <200006122121.XAA01982@octopus.phy.bg.ac.yu>
To:     kernel-audit@nl.linux.org, tom@lemuria.org
Subject: Re: suggestion
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

	not quite true. for example, until recently my home server (running mail
	for a couple of people, among other things) was running 2.0.38 and the
	other software wasn't much younger.

of course.... home system...

	in summary, there are various opinions about where to start, and all of
	them have good points to make. how about meeting in the middle as a
	compromise? 2.2.x is neither outdated nor bleeding edge, and shares lots of
	code with both 2.0.x and 2.4

by the time we have finished with 2.2.x 2.6.x is going to be out and lot 
different to 2.2.x, let alone 2.0.x. if we are starting NOW we should start
with the latest one and then see what happens and how much time do we need.
if we continue these discussions we won't agree on anything until 3.0.x 
and then we will start all over again. is there someone over there who can
make the decision? the founders?

lynx

	-- 
	Welcome to the Information Superspyway

	Kernel-audit:  discussion list for security and the linux kernel
	Archive:       http://mail.nl.linux.org/kernel-audit/


Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Mon Jun 12 23:33:17 2000
Received: by humbolt.nl.linux.org id <S92306AbQFLVcY>;
	Mon, 12 Jun 2000 23:32:24 +0200
Received: from carry.netneo.com ([195.62.128.21]:59152 "EHLO carry.neonet.lv")
	by humbolt.nl.linux.org with ESMTP id <S92302AbQFLVbz>;
	Mon, 12 Jun 2000 23:31:55 +0200
Received: from ed.ed (as0c.netneo.com [195.62.135.194])
	by carry.neonet.lv (8.9.3/8.9.3) with ESMTP id XAA09669
	for <kernel-audit@nl.linux.org>; Mon, 12 Jun 2000 23:31:24 +0200
Received: (from root@localhost)
	by ed.ed (8.8.7/8.8.5) id VAA02856
	for kernel-audit@nl.linux.org; Mon, 12 Jun 2000 21:28:36 GMT
From:   root <evpopkov@carry.neonet.lv>
Date:   Mon, 12 Jun 2000 21:28:36 +0000
To:     kernel-audit@nl.linux.org
Subject: utils.c
Message-ID: <39455604.nail26Q11D0QR@ed.ed>
References: <31FC13508138D4119C6A000102495013459F@QUAKE01>
 <Pine.LNX.3.96.1000612124610.32A-100000@plow>
 <20000612210443.B25330@lemuria.org>
X-Mailer: nail 9.13 2000-05-30
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

File:		net/ipv4/utils.c
md5sum:		b8b7b98a736261aab800a2f222514b89
Kernel Version:	2.0.38

Function Name:		in_ntoa
Maintainer:		Fred N. van Kempen, <waltje@uWalt.NL.Mugnet.ORG>
Auditor:		KuroiNeko <hum@primechoice.com>
Arguments:		unsigned long in
Return Value:		char *
Global Variables:	-
Locks:			-
Functions Called:	sprintf
Things to Note:		return value is declared static - no need to
			allocate or free it, but one must be aware of
			overwrites by subsequent calls
Other Notes:		return value has 18 bytes allocated, but will never
			need more than 16 (including \x0). Also, the function
			doesn't appear to be aware of endianess. This may be
			irrelevant, I'll keep looking


Function Name:		in_aton
Maintainer:		Fred N. van Kempen, <waltje@uWalt.NL.Mugnet.ORG>
Auditor:		KuroiNeko <hum@primechoice.com>
Arguments:		const char *str
Return Value:		unsigned long
Global Variables:	-
Locks:			-
Functions Called:	htonl
Things to Note:		direct return of the htonl() call
Other Notes:		check behaviour on malformed string, eg when there
			are more than three or no digits between the dots

Absolutely Other Notes:	check whether these functions are mutually reversive,
			ie in_aton( in_ntoa()) and in_ntoa( in_aton()) work
			OK. Just an execrise for the reader :)


---

 "Teddy - I suppose Mummy and Daddy are real, aren't they?"
 Teddy said, "You ask such silly questions, David. Nobody knows what
'real' really means. Let's go indoors."

 Brian W. Aldiss, Supertoys Last All Summer Long


Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Mon Jun 12 23:35:06 2000
Received: by humbolt.nl.linux.org id <S92303AbQFLVcf>;
	Mon, 12 Jun 2000 23:32:35 +0200
Received: from carry.netneo.com ([195.62.128.21]:58896 "EHLO carry.neonet.lv")
	by humbolt.nl.linux.org with ESMTP id <S92297AbQFLVbx>;
	Mon, 12 Jun 2000 23:31:53 +0200
Received: from ed.ed (as0c.netneo.com [195.62.135.194])
	by carry.neonet.lv (8.9.3/8.9.3) with ESMTP id XAA09664
	for <kernel-audit@nl.linux.org>; Mon, 12 Jun 2000 23:31:22 +0200
Received: (from root@localhost)
	by ed.ed (8.8.7/8.8.5) id VAA02882
	for kernel-audit@nl.linux.org; Mon, 12 Jun 2000 21:30:29 GMT
From:   root <evpopkov@carry.neonet.lv>
Date:   Mon, 12 Jun 2000 21:30:28 +0000
To:     kernel-audit@nl.linux.org
Subject: Database
Message-ID: <39455674.nail26Q2G1PRC@ed.ed>
References: <31FC13508138D4119C6A000102495013459F@QUAKE01>
 <Pine.LNX.3.96.1000612124610.32A-100000@plow>
 <20000612210443.B25330@lemuria.org>
X-Mailer: nail 9.13 2000-05-30
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list


 Anyone who  has some time  and is familiar  with PGSQL, please  contact me
through the list or in private. Let's  wee whether we can DB these function
sheets.

 Thx


---

 "Teddy - I suppose Mummy and Daddy are real, aren't they?"
 Teddy said, "You ask such silly questions, David. Nobody knows what
'real' really means. Let's go indoors."

 Brian W. Aldiss, Supertoys Last All Summer Long


Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Mon Jun 12 23:46:20 2000
Received: by humbolt.nl.linux.org id <S92299AbQFLVpY>;
	Mon, 12 Jun 2000 23:45:24 +0200
Received: from jetson.astro.uiuc.edu ([128.174.51.201]:60172 "EHLO
        jetson.astro.uiuc.edu") by humbolt.nl.linux.org with ESMTP
	id <S92297AbQFLVoy>; Mon, 12 Jun 2000 23:44:54 +0200
Received: from jetson (jetson [128.174.51.201])
	by jetson.astro.uiuc.edu (8.9.3/8.9.3) with ESMTP id QAA13920;
	Mon, 12 Jun 2000 16:46:39 -0500
Date:   Mon, 12 Jun 2000 16:46:39 -0500 (CDT)
From:   Pete Krawczyk <petek@bsod.net>
X-Sender: petek@jetson
To:     Boris Dragovic <lynx@phy.bg.ac.yu>
cc:     kernel-audit@nl.linux.org
Subject: Re: suggestion
In-Reply-To: <200006122121.XAA01982@octopus.phy.bg.ac.yu>
Message-ID: <Pine.LNX.4.10.10006121630430.13774-100000@jetson>
X-PGP:  finger for PGP public key: pkrawczy@uiuc.edu
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

Date: Mon, 12 Jun 2000 23:21:32 +0200
From: Boris Dragovic <lynx@phy.bg.ac.yu>
Subject: Re: suggestion

}by the time we have finished with 2.2.x 2.6.x is going to be out and lot 
}different to 2.2.x, let alone 2.0.x. if we are starting NOW we should start
}with the latest one and then see what happens and how much time do we need.
}if we continue these discussions we won't agree on anything until 3.0.x 
}and then we will start all over again. is there someone over there who can
}make the decision? the founders?

Bryan was the founder; I think he suggested starting at 2.4.0-test1.  Rik
was one of the first people on the list, and he wants to do 2.4.  I myself
want to do 2.4 if only because it has all the features from the past and
if there is a problem in the current code we can go back and find out when
that change was made, etc.  Not to mention that auditing is a long
process, and we could well be watching 2.6 come off the wire before we're
close to done.

So I think there's been some consensus for a while.  There's been some
effort put forth to argue the case for 2.2.x, and while it's a reasonable
idea, it leaves us more that we have to catch up on when we complete the
first kernel.

We could do both, but I would suggest not since splitting our effort could
slow it down quite a bit (although some parts have changed little since
2.2 and so those audits could be moved forward simply).

-Pete K
-- 
Pete Krawczyk
  petek at bsod dot net or pkrawczy at uiuc dot edu
  http://www.uiuc.edu/ph/www/pkrawczy/
  Finger pkrawczy at uiuc dot edu for PGP public key




Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Tue Jun 13 00:14:31 2000
Received: by humbolt.nl.linux.org id <S92302AbQFLWN0>;
	Tue, 13 Jun 2000 00:13:26 +0200
Received: from mail1.bna.bellsouth.net ([205.152.150.13]:35738 "EHLO
        mail1.bna.bellsouth.net") by humbolt.nl.linux.org with ESMTP
	id <S92297AbQFLWM4>; Tue, 13 Jun 2000 00:12:56 +0200
Received: from adsl-78-129-55.mem.bellsouth.net (adsl-78-129-55.mem.bellsouth.net [216.78.129.55])
	by mail1.bna.bellsouth.net (3.3.5alt/0.75.2) with ESMTP id SAA26969
	for <kernel-audit@nl.linux.org>; Mon, 12 Jun 2000 18:12:54 -0400 (EDT)
Date:   Mon, 12 Jun 2000 17:09:01 -0500 (CDT)
From:   Bryan Paxton <evil7@bellsouth.net>
X-Sender: evil7@sqa.speedbros.org
To:     kernel-audit@nl.linux.org
Subject: Re: suggestion
Message-ID: <Pine.LNX.4.21.0006121708140.1504-100000@sqa.speedbros.org>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

I may have been the one to set this up, but it's far from my call what shall
be dealt with first. As I've stated before... I have simply provided(with the
help of others) a place for everyone to come together on this. In other words
I've laid the foundation, as to what goes up on it is entirely up to the 
community. I'm here to help in anyway I can to make this a better enviorment.
Consider my e-mail address a suggestion box(untill one goes up on the page). 

And yes I do believe starting with 2.4.x is the best approach(read my other posts).
It only makes sense IMHO. 

I think a lot of pete said in this post is also a lot of what I was trying to 
say. But yet this is entirely up to you, the coders/developers/hackers. 


On Mon, 12 Jun 2000, you wrote:
> Date: Mon, 12 Jun 2000 23:21:32 +0200
> From: Boris Dragovic <lynx@phy.bg.ac.yu>
> Subject: Re: suggestion
> 
> }by the time we have finished with 2.2.x 2.6.x is going to be out and lot 
> }different to 2.2.x, let alone 2.0.x. if we are starting NOW we should start
> }with the latest one and then see what happens and how much time do we need.
> }if we continue these discussions we won't agree on anything until 3.0.x 
> }and then we will start all over again. is there someone over there who can
> }make the decision? the founders?
> 
> Bryan was the founder; I think he suggested starting at 2.4.0-test1.  Rik
> was one of the first people on the list, and he wants to do 2.4.  I myself
> want to do 2.4 if only because it has all the features from the past and
> if there is a problem in the current code we can go back and find out when
> that change was made, etc.  Not to mention that auditing is a long
> process, and we could well be watching 2.6 come off the wire before we're
> close to done.

-- 
Bryan Paxton

"How should I know if it works? That's what beta testers are for. I
          only coded it."
 -- Linus Torvalds.




Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Tue Jun 13 00:16:39 2000
Received: by humbolt.nl.linux.org id <S92311AbQFLWPS>;
	Tue, 13 Jun 2000 00:15:18 +0200
Received: from brutus.conectiva.com.br ([200.250.58.146]:34286 "EHLO
        duckman.distro.conectiva") by humbolt.nl.linux.org with ESMTP
	id <S92300AbQFLWOf>; Tue, 13 Jun 2000 00:14:35 +0200
Received: from localhost (riel@localhost)
	by duckman.distro.conectiva (8.9.3/8.8.7) with ESMTP id TAA25607
	for <kernel-audit@nl.linux.org>; Mon, 12 Jun 2000 19:14:20 -0300
X-Authentication-Warning: duckman.distro.conectiva: riel owned process doing -bs
Date:   Mon, 12 Jun 2000 19:14:20 -0300 (BRST)
From:   Rik van Riel <riel@conectiva.com.br>
X-Sender: riel@duckman.distro.conectiva
To:     kernel-audit@nl.linux.org
Subject: Re: suggestion
In-Reply-To: <200006122121.XAA01982@octopus.phy.bg.ac.yu>
Message-ID: <Pine.LNX.4.21.0006121911290.22013-100000@duckman.distro.conectiva>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

On Mon, 12 Jun 2000, Boris Dragovic wrote:

> by the time we have finished with 2.2.x 2.6.x is going to be out
> and lot different to 2.2.x, let alone 2.0.x. if we are starting
> NOW we should start with the latest one and then see what
> happens and how much time do we need. if we continue these
> discussions we won't agree on anything until 3.0.x and then we
> will start all over again. is there someone over there who can
> make the decision? the founders?

It's much simpler than that. The people who do the work will
decide what they work on. The rest can sit and watch.

This is how things have always worked in Linux...
(and frankly, I couldn't see how else things could work)

regards,

Rik
--
The Internet is not a network of computers. It is a network
of people. That is its real strength.

Wanna talk about the kernel?  irc.openprojects.net / #kernelnewbies
http://www.conectiva.com/		http://www.surriel.com/


Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Tue Jun 13 00:27:41 2000
Received: by humbolt.nl.linux.org id <S92297AbQFLW05>;
	Tue, 13 Jun 2000 00:26:57 +0200
Received: from carry.netneo.com ([195.62.128.21]:47890 "EHLO carry.neonet.lv")
	by humbolt.nl.linux.org with ESMTP id <S92300AbQFLW0m>;
	Tue, 13 Jun 2000 00:26:42 +0200
Received: from ed.ed (as0c.netneo.com [195.62.135.194])
	by carry.neonet.lv (8.9.3/8.9.3) with ESMTP id AAA10445
	for <kernel-audit@nl.linux.org>; Tue, 13 Jun 2000 00:26:07 +0200
Received: (from root@localhost)
	by ed.ed (8.8.7/8.8.5) id WAA03838
	for kernel-audit@nl.linux.org; Mon, 12 Jun 2000 22:19:47 GMT
From:   root <evpopkov@carry.neonet.lv>
Date:   Mon, 12 Jun 2000 22:19:47 +0000
To:     kernel-audit@nl.linux.org
Subject: Re: suggestion
Message-ID: <39456203.nail2YC113I2S@ed.ed>
References: <Pine.LNX.4.21.0006121708140.1504-100000@sqa.speedbros.org>
X-Mailer: nail 9.13 2000-05-30
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

> And yes  I do believe  starting with 2.4.x  is the best  approach(read my
> other posts).
> It only makes sense IMHO.
>
> I think  a lot of pete  said in this  post is also  a lot of what  I was 
> trying to                                                                
> say. But yet this is entirely up to you, the coders/developers/hackers.  

 Well, as long  as no one minds,  I'll be posting 2.0.x stuff  from time to
time. I'm  also looking  forward to build  a DB of  function sheets.  No DB
wars, please, _I_ will be doing it in PGSQL, so anyone is welcome.
 Since we won't likely to get online  hosting for the DB right off, I could
host it provided that there's email batch i/f.


---

 "Teddy - I suppose Mummy and Daddy are real, aren't they?"
 Teddy said, "You ask such silly questions, David. Nobody knows what
'real' really means. Let's go indoors."

 Brian W. Aldiss, Supertoys Last All Summer Long


Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Tue Jun 13 00:45:21 2000
Received: by humbolt.nl.linux.org id <S92304AbQFLWoi>;
	Tue, 13 Jun 2000 00:44:38 +0200
Received: from dialupB242.sttl.uswest.net ([207.224.250.242]:61484 "EHLO
        ellipsis.aniota.net") by humbolt.nl.linux.org with ESMTP
	id <S92300AbQFLWny>; Tue, 13 Jun 2000 00:43:54 +0200
Received: from localhost (twhite@localhost)
	by ellipsis.aniota.net (8.8.7/8.8.7) with ESMTP id PAA26767;
	Mon, 12 Jun 2000 15:45:15 -0700
X-Authentication-Warning: ellipsis.aniota.net: twhite owned process doing -bs
Date:   Mon, 12 Jun 2000 15:45:15 -0700 (PDT)
From:   terry white <twhite@aniota.com>
To:     Asmodeus <asmodeus@beast.tburg.net>
cc:     kernel-audit@nl.linux.org
Subject: Re: suggestion
In-Reply-To: <00061216444600.01339@bambam.completecomputerfriend.com>
Message-ID: <Pine.LNX.4.10.10006121544230.26716-100000@ellipsis.aniota.net>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

on "06/12/00" "Asmodeus" writ:

:  Perhaps we should have three more lists: kernel-audit-2.0,
: kernel-audit-2.2 and kernel-audit-2.4 where the people interested in auditing
: each version of the kernel can discuss the specifics of how the kernel was
: implemented at that time in its life.

   ... this is a good idea ...

-- 
... i'm a man , and i can change ,
    if i really have to , i guess ...



Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Tue Jun 13 00:47:10 2000
Received: by humbolt.nl.linux.org id <S92307AbQFLWqM>;
	Tue, 13 Jun 2000 00:46:12 +0200
Received: from smtp.WPI.EDU ([130.215.24.62]:47116 "EHLO smtp.WPI.EDU")
	by humbolt.nl.linux.org with ESMTP id <S92300AbQFLWpS>;
	Tue, 13 Jun 2000 00:45:18 +0200
Received: from ernie.WPI.EDU (root@ernie.WPI.EDU [130.215.24.122])
	by smtp.WPI.EDU (8.11.0.Beta3/8.11.0.Beta3) with ESMTP id e5CMj4t07573
	for <kernel-audit@nl.linux.org>; Mon, 12 Jun 2000 18:45:04 -0400 (EDT)
Received: from localhost (bowden@localhost [127.0.0.1])
	by ernie.WPI.EDU (8.11.0.Beta3/8.11.0.Beta3) with ESMTP id e5CMjGU17522
	for <kernel-audit@nl.linux.org>; Mon, 12 Jun 2000 18:45:16 -0400 (EDT)
Date:   Mon, 12 Jun 2000 18:45:16 -0400 (EDT)
From:   Scott Bowden <bowden@WPI.EDU>
To:     kernel-audit@nl.linux.org
Subject: work together, but separately :)
Message-ID: <Pine.OSF.4.21.0006121841100.14744-100000@ernie.WPI.EDU>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

OK, there has been a lot of discussion/arguing over what kernel we should
audit. I have a novel little idea: lets do all of them! The people who want 
to work on 2.0.x can do so, as can the people who want to work on 2.2.x ,
ditto with 2.4.x . 

However, at the same time, we should work together. For example, if a
problem is found in the 2.2.x tree that might still have existed in 2.0.x
and might still exist in 2.2.x , that saves those two groups from having
to find it themselves. Its a pretty simple concept.

How about we stop bickering about which kernel to audit, and get
auditing? Basically, get the general documentation infrastructure going,
and then go with it. Enough arguing already!

  - Scott Bowden

 ---------------------------------------------------------------
| Scott Bowden   | "Windows hasn't increased computer literacy. |
| AXP DSPhi 681  |  It has simply lowered the standard."        |
| WPI CS 2002    |                                              |
| bowden@wpi.edu |                                   -- anon    |
 ---------------------------------------------------------------
|     WPI Linux Association Secretary: http://www.wpila.cx      |
 ---------------------------------------------------------------



Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Tue Jun 13 01:02:49 2000
Received: by humbolt.nl.linux.org id <S92310AbQFLXBi>;
	Tue, 13 Jun 2000 01:01:38 +0200
Received: from carry.netneo.com ([195.62.128.21]:14084 "EHLO carry.neonet.lv")
	by humbolt.nl.linux.org with ESMTP id <S92308AbQFLXBH>;
	Tue, 13 Jun 2000 01:01:07 +0200
Received: from ed.ed (as0c.netneo.com [195.62.135.194])
	by carry.neonet.lv (8.9.3/8.9.3) with ESMTP id BAA10886
	for <kernel-audit@nl.linux.org>; Tue, 13 Jun 2000 01:00:35 +0200
Received: (from root@localhost)
	by ed.ed (8.8.7/8.8.5) id WAA03965
	for kernel-audit@nl.linux.org; Mon, 12 Jun 2000 22:34:33 GMT
From:   root <evpopkov@carry.neonet.lv>
Date:   Mon, 12 Jun 2000 22:34:33 +0000
To:     kernel-audit@nl.linux.org
Subject: utils.c testbed
Message-ID: <39456579.nail3201RUVWK@ed.ed>
References: <31FC13508138D4119C6A000102495013459F@QUAKE01>
 <Pine.LNX.3.96.1000612124610.32A-100000@plow>
 <20000612210443.B25330@lemuria.org>
X-Mailer: nail 9.13 2000-05-30
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list


 http://www.primechoice.com/hum/lkap.tar.gz

 1740 bytes, contains Makefile, slightly modified utils.c (2.0.38, includes
fixed) and lkap.c that calls  utils.c functions with different params. Copy
your utils.c over, tweak it and see how the functions work.
 When we figure possible problems, we'll  have to check how these functions
are called.


---

 "Teddy - I suppose Mummy and Daddy are real, aren't they?"
 Teddy said, "You ask such silly questions, David. Nobody knows what
'real' really means. Let's go indoors."

 Brian W. Aldiss, Supertoys Last All Summer Long


Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Tue Jun 13 02:01:43 2000
Received: by humbolt.nl.linux.org id <S92300AbQFMAAl>;
	Tue, 13 Jun 2000 02:00:41 +0200
Received: from [208.153.175.9] ([208.153.175.9]:260 "HELO
        nine.bluemarblecomputers.com") by humbolt.nl.linux.org with SMTP
	id <S92312AbQFMAAU>; Tue, 13 Jun 2000 02:00:20 +0200
Received: (qmail 3503 invoked from network); 12 Jun 2000 23:01:59 -0000
Received: from techroom.bluemarblecomputers.com (HELO techroom) (192.168.0.4)
  by nine.bluemarblecomputers.com with SMTP; 12 Jun 2000 23:01:59 -0000
Message-ID: <016801bfd4d2$b447faa0$0400a8c0@bluemarblecomputers.com>
From:   "Daniel N." <daniel@bluemarblecomputers.com>
To:     <kernel-audit@nl.linux.org>
Subject: A starting point and my suggestion
Date:   Mon, 12 Jun 2000 18:00:01 -0700
MIME-Version: 1.0
Content-Type: text/plain;
	charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 5.00.2919.6600
X-MimeOLE: Produced By Microsoft MimeOLE V5.00.2919.6600
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

   I agree, 2.4.x is the best starting point, however, some people will
not let older releases go.  Knowing this, why doesn't lkap.org simply
start the process with 2.4.x and keep its arms open to older releases?
   I see four critical needs: (1) databases to house all the
information,
one for each release would probably be best, (2) www.lkap.org
developed enough to serve all the information, (3) someone/thing to
moderate what goes into the databases, and (4) a standard audit
format.
   Also, lkap.org should start small and focused.  i.e. Start focusing
on
./net/ethernet/*  I feel lkap.org is going to have to tell (or ask)
people to
a degree what needs to be done, otherwise we'll end up with a mob of
people throwing various audits of various files from various releases at
no one in particular.  I for one would be willing to help develop
www.lkap.org   All this is not to say audits aside from what lkap.org is
focusing on shouldn't be accepted, of course.
   In short, I say, lets focus on getting a system in place--what
release
to audit seems a moot point when there's not even really a place to
put the audits.  So, who should I talk to regarding www.lkap.org?
(Bryan?)

   Thoughts?

Daniel N.


Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Tue Jun 13 02:50:02 2000
Received: by humbolt.nl.linux.org id <S92312AbQFMAtI>;
	Tue, 13 Jun 2000 02:49:08 +0200
Received: from serv1.northnet.net ([156.46.235.2]:51214 "EHLO
        serv1.northnet.net") by humbolt.nl.linux.org with ESMTP
	id <S92199AbQFMAsp>; Tue, 13 Jun 2000 02:48:45 +0200
Received: from ABS.ATGroup (appp167.northnet.net [216.145.154.199]) by serv1.northnet.net (8.9.3/8.8.5) with SMTP id TAA06960 for <kernel-audit@nl.linux.org>; Mon, 12 Jun 2000 19:54:20 -0500
From:   Adam <reifer33092@foxvalley.tec.wi.us>
To:     kernel-audit@nl.linux.org
Subject: root users, etc....
Date:   Mon, 12 Jun 2000 19:52:19 -0500
X-Mailer: KMail [version 1.0.28]
Content-Type: text/plain
MIME-Version: 1.0
Message-Id: <00061219551900.01827@ABS.ATGroup>
Content-Transfer-Encoding: 8bit
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

I really don't care what kernel we start with, I just want to start. I am sick
of this bickering, but I can't help but inject my $0.02 worth. What the hell
are people who don't know enough not to use their root accounts with doing on
this email list. No one should ever check their email with a root account, how
dumb are they? 
	Thanks,
		Adam

Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Tue Jun 13 03:00:33 2000
Received: by humbolt.nl.linux.org id <S92199AbQFMA7f>;
	Tue, 13 Jun 2000 02:59:35 +0200
Received: from carry.netneo.com ([195.62.128.21]:43783 "EHLO carry.neonet.lv")
	by humbolt.nl.linux.org with ESMTP id <S92308AbQFMA7A>;
	Tue, 13 Jun 2000 02:59:00 +0200
Received: from ed.ed (as0c.netneo.com [195.62.135.194])
	by carry.neonet.lv (8.9.3/8.9.3) with ESMTP id CAA12360
	for <kernel-audit@nl.linux.org>; Tue, 13 Jun 2000 02:58:28 +0200
Received: (from root@localhost)
	by ed.ed (8.8.7/8.8.5) id AAA05404
	for kernel-audit@nl.linux.org; Tue, 13 Jun 2000 00:58:27 GMT
From:   root <evpopkov@carry.neonet.lv>
Date:   Tue, 13 Jun 2000 00:58:27 +0000
To:     kernel-audit@nl.linux.org
Subject: Re: root users, etc....
Message-ID: <39458733.nail46211IQ0Y@ed.ed>
References: <00061219551900.01827@ABS.ATGroup>
X-Mailer: nail 9.13 2000-05-30
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

>What the hell
>are people who don't know enough not to use their root accounts with doing on
>this email list. No one should ever check their email with a root account, how
>dumb are they?

 Just watch yourself, OK? You don't know rat's ass of what you're talking about,
so please get back to the books and learn something. And I mean a book, not
ZDNet Sunday column for imbeciles.

 Thank you.


---

 "Teddy - I suppose Mummy and Daddy are real, aren't they?"
 Teddy said, "You ask such silly questions, David. Nobody knows what
'real' really means. Let's go indoors."

 Brian W. Aldiss, Supertoys Last All Summer Long


Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Tue Jun 13 03:24:23 2000
Received: by humbolt.nl.linux.org id <S92187AbQFMBXa>;
	Tue, 13 Jun 2000 03:23:30 +0200
Received: from dial-59-10.nitnet.com.br ([200.244.59.10]:10501 "EHLO
        paulo.prrar.net") by humbolt.nl.linux.org with ESMTP
	id <S92188AbQFMBW7>; Tue, 13 Jun 2000 03:22:59 +0200
Received: from nitnet.com.br (IDENT:prrar@paulo.prrar.net [192.168.0.1])
	by paulo.prrar.net (8.9.3/8.9.3) with ESMTP id WAA03076
	for <kernel-audit@nl.linux.org>; Mon, 12 Jun 2000 22:31:32 -0300
Message-ID: <39458EF3.83DA15E8@nitnet.com.br>
Date:   Mon, 12 Jun 2000 22:31:31 -0300
From:   Paulo Ribeiro <prrar@nitnet.com.br>
X-Mailer: Mozilla 4.72 [en] (X11; U; Linux 2.2.16 i586)
X-Accept-Language: en
MIME-Version: 1.0
CC:     kernel-audit@nl.linux.org
Subject: Re: root users, etc....
References: <00061219551900.01827@ABS.ATGroup> <39458733.nail46211IQ0Y@ed.ed>
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
To:     unlisted-recipients:; (no To-header on input)
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

Hey, everyone.

It's the beggining of this list... please, don't post personal
discussions here... Let's first decide where to start... please!

Yours,
Paulo Ribeiro.

Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Tue Jun 13 03:35:04 2000
Received: by humbolt.nl.linux.org id <S92308AbQFMBeB>;
	Tue, 13 Jun 2000 03:34:01 +0200
Received: from mail5.svr.pol.co.uk ([195.92.193.20]:21768 "EHLO
        mail5.svr.pol.co.uk") by humbolt.nl.linux.org with ESMTP
	id <S92195AbQFMBdp>; Tue, 13 Jun 2000 03:33:45 +0200
Received: from modem-104.silicon.dialup.pol.co.uk ([62.136.13.104] helo=braecklein.freeserve.co.uk)
	by mail5.svr.pol.co.uk with esmtp (Exim 3.13 #0)
	id 131faK-0000Kn-00
	for kernel-audit@nl.linux.org; Tue, 13 Jun 2000 02:33:45 +0100
Received: (from live@localhost)
	by braecklein.freeserve.co.uk (8.9.1/8.9.1) id CAA19054
	for kernel-audit@nl.linux.org; Tue, 13 Jun 2000 02:26:43 GMT
Date:   Tue, 13 Jun 2000 02:26:42 +0000
From:   Natasha Live <live@braecklein.freeserve.co.uk>
To:     kernel-audit@nl.linux.org
Subject: Re: A proposed model for the audit
Message-ID: <20000613022642.B17226@braecklein.freeserve.co.uk>
References: <Pine.LNX.4.21.0006112326210.606-100000@sqa.speedbros.org> <20000614175457.A422@armageddon.libero.it>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
User-Agent: Mutt/1.2i
In-Reply-To: <20000614175457.A422@armageddon.libero.it>; from sullivan@sikurezza.org on Wed, Jun 14, 2000 at 05:54:57PM +0200
X-Operating-System: Linux braecklein 2.2.14 
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

Argh.

A quick question.. If the system for auditing is to be setup (and all agree
we will need one). There is there not room in it so that both 2.4.0.pre and
2.2.X can be audited at the same time?

There are ppl out there who will insist that 2.2X be audited, wether this
is due to their use of 2.2.X or just that the prefer to start at the begining.

Whilst others will not see the benifits of useing an older "known" kernel and
wish to be at the cutting edge of technology (plz remember that more ppl will
want the newer ones, espically if you want proper access to stuff like USB and
AGP). these ppl will never waste their time with anything less than the newest.

It looks as if we will have to accept (and embrace) this two pronged way of
doing it. To do otherwise may well alienate and otherwise useful supply of
coders.

0.5p of thought.


-- 
________________N__L_I_V_E_________________________________________
|  mailto://live@braecklein.freeserve.co.uk  | Lynx Browser :     |
|    http://www.braecklein.freeserve.co.uk   |   lynx.browser.org |
-------------------------------------------------------------------

Linux braecklein 2.2.14 #4 Thu Apr 6 23:20:06 GMT 2000 i486 unknown

Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Tue Jun 13 03:40:13 2000
Received: by humbolt.nl.linux.org id <S92315AbQFMBjQ>;
	Tue, 13 Jun 2000 03:39:16 +0200
Received: from brutus.conectiva.com.br ([200.250.58.146]:31218 "EHLO
        duckman.distro.conectiva") by humbolt.nl.linux.org with ESMTP
	id <S92188AbQFMBiW>; Tue, 13 Jun 2000 03:38:22 +0200
Received: from localhost (riel@localhost)
	by duckman.distro.conectiva (8.9.3/8.8.7) with ESMTP id WAA26837;
	Mon, 12 Jun 2000 22:38:05 -0300
X-Authentication-Warning: duckman.distro.conectiva: riel owned process doing -bs
Date:   Mon, 12 Jun 2000 22:38:05 -0300 (BRST)
From:   Rik van Riel <riel@conectiva.com.br>
X-Sender: riel@duckman.distro.conectiva
To:     root <evpopkov@carry.neonet.lv>
cc:     kernel-audit@nl.linux.org
Subject: Re: root users, etc....
In-Reply-To: <39458733.nail46211IQ0Y@ed.ed>
Message-ID: <Pine.LNX.4.21.0006122236020.26806-100000@duckman.distro.conectiva>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

On Tue, 13 Jun 2000, root wrote:

> >What the hell
> >are people who don't know enough not to use their root accounts with doing on
> >this email list. No one should ever check their email with a root account, how
> >dumb are they?
> 
>  Just watch yourself, OK? You don't know rat's ass of what
> you're talking about, so please get back to the books and learn
> something. And I mean a book, not ZDNet Sunday column for
> imbeciles.

I propose an alternative to the "flaming contest" you
two might get engaged in. Show us the code.

That is, prove yourself by auditing part of the kernel.
And if you can't do that, show us that you people can at
least behave yourselves.

thank you,

Rik
--
The Internet is not a network of computers. It is a network
of people. That is its real strength.

Wanna talk about the kernel?  irc.openprojects.net / #kernelnewbies
http://www.conectiva.com/		http://www.surriel.com/


Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Tue Jun 13 04:46:26 2000
Received: by humbolt.nl.linux.org id <S92309AbQFMCpb>;
	Tue, 13 Jun 2000 04:45:31 +0200
Received: from ip172.gte26.rb1.bel.nwlink.com ([207.202.207.172]:11526 "EHLO
        speedbros.org") by humbolt.nl.linux.org with ESMTP
	id <S92188AbQFMCpH>; Tue, 13 Jun 2000 04:45:07 +0200
Received: from jasonc by speedbros.org with local (Exim 3.12 #1 (Debian))
	id 131gh1-0002sF-00
	for <kernel-audit@nl.linux.org>; Mon, 12 Jun 2000 19:44:43 -0700
Date:   Mon, 12 Jun 2000 19:44:43 -0700
From:   jasonc@nixed.net
To:     kernel-audit@nl.linux.org
Subject: web site..
Message-ID: <20000612194443.A11046@nixed.net>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
User-Agent: Mutt/1.0.1i
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

Hello, my name is jason... Bryan asked me to be the master of the pages.. so let me know what you want!.....

for those of you who dont know I am slaker on irc.openprojecs.com and on irc.dal.net #linux an #perl 


later...

Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Tue Jun 13 05:50:17 2000
Received: by humbolt.nl.linux.org id <S92195AbQFMDtX>;
	Tue, 13 Jun 2000 05:49:23 +0200
Received: from mail.xuma.com ([209.0.254.4]:13064 "EHLO mail.xuma.com")
	by humbolt.nl.linux.org with ESMTP id <S92201AbQFMDss>;
	Tue, 13 Jun 2000 05:48:48 +0200
Received: from obi.sf.xuma.com (cnc2.xuma.com [208.37.147.2])
	by mail.xuma.com (8.8.7/8.8.8) with SMTP id UAA08567;
	Mon, 12 Jun 2000 20:48:46 -0700
Received: (from yoda@localhost)
	by obi.sf.xuma.com (8.9.3/8.9.3) id UAA05783;
	Mon, 12 Jun 2000 20:51:21 -0700
X-Authentication-Warning: obi.sf.xuma.com: yoda set sender to yoda@xuma.com using -f
Date:   Mon, 12 Jun 2000 20:51:21 -0700
From:   Jesse Nelson <yoda@xuma.com>
To:     Adam <reifer33092@foxvalley.tec.wi.us>
Cc:     kernel-audit@nl.linux.org
Subject: Re: root users, etc....
Message-ID: <20000612205121.D4769@obi.sf.xuma.com>
References: <00061219551900.01827@ABS.ATGroup>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
User-Agent: Mutt/1.2i
In-Reply-To: <00061219551900.01827@ABS.ATGroup>; from reifer33092@foxvalley.tec.wi.us on Mon, Jun 12, 2000 at 07:52:19PM -0500
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

agreed!, yeah I know I don't add anything to the subject but this kindda chaps my ass.

Previously, Adam wrote:
> I really don't care what kernel we start with, I just want to start. I am sick
> of this bickering, but I can't help but inject my $0.02 worth. What the hell
> are people who don't know enough not to use their root accounts with doing on
> this email list. No one should ever check their email with a root account, how
> dumb are they? 
> 	Thanks,
> 		Adam
> 
> Kernel-audit:  discussion list for security and the linux kernel
> Archive:       http://mail.nl.linux.org/kernel-audit/

-- 
Jesse Nelson		X U M A  <build-to-order e-business>    X   .~.
Senior 			160 Pine Street, 2nd Floor              U   /V\
Engineer		San Francisco, CA 94111	                M  // \\
			tel: 415.645.9988                       I /(   )\
<Xuma Security Team>	http://www.xuma.com	                X  ^`~'^
PGP Key fingerprint = 9DE9 4C9F 014D F68E 893D  097E 079D 5FF3 9614 3E86


A kid'll eat the middle of an Oreo, eventually.

Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Tue Jun 13 09:29:05 2000
Received: by humbolt.nl.linux.org id <S92203AbQFMH2D>;
	Tue, 13 Jun 2000 09:28:03 +0200
Received: from lemuria.borgfelde.ricardo.de ([195.244.103.65]:23813 "HELO
        mail.lemuria.org") by humbolt.nl.linux.org with SMTP
	id <S92314AbQFMH1j>; Tue, 13 Jun 2000 09:27:39 +0200
Received: from lemuria.org by mail.lemuria.org
	via rsmtp with bsmtp
	id <m131kw5-0015whC@mail.lemuria.org>
	for <kernel-audit@nl.linux.org>; Tue, 13 Jun 2000 09:16:33 +0200 (MEST)
	(Smail-3.2 1996-Jul-4 #1 built 1999-Nov-8)
Received: by lemuria.org
	via sendmail with stdio
	id <m131kfw-000HioC@lemuria.org>
	for kernel-audit@nl.linux.org; Tue, 13 Jun 2000 08:59:52 +0200 (MEST)
	(Smail-3.2 1996-Jul-4 #1 built 1999-Nov-8)
Date:   Tue, 13 Jun 2000 08:59:51 +0200
From:   Tom Vogt <tom@lemuria.org>
To:     kernel-audit@nl.linux.org
Subject: Re: utils.c
Message-ID: <20000613085951.C27441@lemuria.org>
References: <31FC13508138D4119C6A000102495013459F@QUAKE01> <Pine.LNX.3.96.1000612124610.32A-100000@plow> <20000612210443.B25330@lemuria.org> <39455604.nail26Q11D0QR@ed.ed>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
X-Mailer: Mutt 1.0pre3i
In-Reply-To: <39455604.nail26Q11D0QR@ed.ed>
X-Privacy: If you can, please encrypt your mails - finger for key
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

root <evpopkov@carry.neonet.lv> wrote:
> File:		net/ipv4/utils.c
> md5sum:		b8b7b98a736261aab800a2f222514b89
> Kernel Version:	2.0.38

we should possibly sed out the comment blocks and run a second md5sum on
the pure code, to see whether there were actual code changes.


> Function Name:		in_ntoa
> Maintainer:		Fred N. van Kempen, <waltje@uWalt.NL.Mugnet.ORG>

is mentioned in my file as the author, but the $Id CVS tag says kuznet was
the last one to change anything.

which one do we take?



> Other Notes:		check behaviour on malformed string, eg when there
> 			are more than three or no digits between the dots

behaves correctly for any malfunction, including the address "..." (which
will return 0). on very long strings the int might roll over, but then the
input is nonsensical anyways so it doesn't matter that the return value is
nonsense, too.


-- 
Welcome to the Information Superspyway

Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Tue Jun 13 09:30:53 2000
Received: by humbolt.nl.linux.org id <S92205AbQFMH2M>;
	Tue, 13 Jun 2000 09:28:12 +0200
Received: from lemuria.borgfelde.ricardo.de ([195.244.103.65]:23557 "HELO
        mail.lemuria.org") by humbolt.nl.linux.org with SMTP
	id <S92201AbQFMH1j>; Tue, 13 Jun 2000 09:27:39 +0200
Received: from lemuria.org by mail.lemuria.org
	via rsmtp with bsmtp
	id <m131kw5-0015vnC@mail.lemuria.org>
	for <kernel-audit@nl.linux.org>; Tue, 13 Jun 2000 09:16:33 +0200 (MEST)
	(Smail-3.2 1996-Jul-4 #1 built 1999-Nov-8)
Received: by lemuria.org
	via sendmail with stdio
	id <m131kQj-000HioC@lemuria.org>
	for kernel-audit@nl.linux.org; Tue, 13 Jun 2000 08:44:09 +0200 (MEST)
	(Smail-3.2 1996-Jul-4 #1 built 1999-Nov-8)
Date:   Tue, 13 Jun 2000 08:44:09 +0200
From:   Tom Vogt <tom@lemuria.org>
To:     kernel-audit@nl.linux.org
Subject: Re: suggestion
Message-ID: <20000613084409.A27441@lemuria.org>
References: <200006122121.XAA01982@octopus.phy.bg.ac.yu>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
X-Mailer: Mutt 1.0pre3i
In-Reply-To: <200006122121.XAA01982@octopus.phy.bg.ac.yu>
X-Privacy: If you can, please encrypt your mails - finger for key
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

Boris Dragovic <lynx@phy.bg.ac.yu> wrote:
> by the time we have finished with 2.2.x 2.6.x is going to be out and lot 
> different to 2.2.x, let alone 2.0.x.

so? as I said before, being on the bleeding edge is NOT on the priority
list of any production system I know. having a working system is. which
means there are and there will continue to be real-life systems out there
that are way behind in kernel releases.


> if we are starting NOW we should start
> with the latest one and then see what happens and how much time do we need.
> if we continue these discussions we won't agree on anything until 3.0.x 
> and then we will start all over again. is there someone over there who can
> make the decision? the founders?

the only people who can make a decision are those who are doing the work.
anything else is bound to drive those out you need most.


personally, I don't care much and would rather argue for 2.4.x if my
personal preferences where driving my arguments. but I don't think "3.0
will be out" is an argument at all. let it be out - as long as lots of
people continue to run 2.2, it doesn't matter the least whether 2.4 or 3.0
or 6.x "is out". it's what's "in" that we have to concern ourselves with.


-- 
Welcome to the Information Superspyway

Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Tue Jun 13 09:32:33 2000
Received: by humbolt.nl.linux.org id <S92201AbQFMH21>;
	Tue, 13 Jun 2000 09:28:27 +0200
Received: from lemuria.borgfelde.ricardo.de ([195.244.103.65]:24837 "HELO
        mail.lemuria.org") by humbolt.nl.linux.org with SMTP
	id <S92316AbQFMH1t>; Tue, 13 Jun 2000 09:27:49 +0200
Received: from lemuria.org by mail.lemuria.org
	via rsmtp with bsmtp
	id <m131kw5-0015wMC@mail.lemuria.org>
	for <kernel-audit@nl.linux.org>; Tue, 13 Jun 2000 09:16:33 +0200 (MEST)
	(Smail-3.2 1996-Jul-4 #1 built 1999-Nov-8)
Received: by lemuria.org
	via sendmail with stdio
	id <m131kTs-000HioC@lemuria.org>
	for kernel-audit@nl.linux.org; Tue, 13 Jun 2000 08:47:24 +0200 (MEST)
	(Smail-3.2 1996-Jul-4 #1 built 1999-Nov-8)
Date:   Tue, 13 Jun 2000 08:47:24 +0200
From:   Tom Vogt <tom@lemuria.org>
To:     kernel-audit@nl.linux.org
Subject: Re: suggestion
Message-ID: <20000613084724.B27441@lemuria.org>
References: <200006122121.XAA01982@octopus.phy.bg.ac.yu> <Pine.LNX.4.21.0006121911290.22013-100000@duckman.distro.conectiva>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
X-Mailer: Mutt 1.0pre3i
In-Reply-To: <Pine.LNX.4.21.0006121911290.22013-100000@duckman.distro.conectiva>
X-Privacy: If you can, please encrypt your mails - finger for key
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

Rik van Riel <riel@conectiva.com.br> wrote:
> It's much simpler than that. The people who do the work will
> decide what they work on. The rest can sit and watch.

agree, though it would be positive for the project to focus the efforts.

while I've been arguing for 2.2.x, I could live with 2.4.x being "the one",
and besides I don't have much time to input anyways.

the question is: how many people will stand up and leave if we declare that
this is a "2.4.x only project" ?

if we get a relevant headcount on that answer, we should abstain from
enforcing a 2.4.x-ism. likewise for 2.2.x. if everyone can live with
focusing on version X, there's no reason not to do it, right?

-- 
Welcome to the Information Superspyway

Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Tue Jun 13 09:42:33 2000
Received: by humbolt.nl.linux.org id <S92313AbQFMHll>;
	Tue, 13 Jun 2000 09:41:41 +0200
Received: from ns.crihan.fr ([195.221.20.10]:6923 "EHLO ns.crihan.fr")
	by humbolt.nl.linux.org with ESMTP id <S92320AbQFMHlL>;
	Tue, 13 Jun 2000 09:41:11 +0200
Received: from spectrum.crihan.fr (IDENT:ev@spectrum.crihan.fr [195.221.20.6])
	by ns.crihan.fr (8.9.3/8.9.1) with ESMTP id JAA14211
	for <kernel-audit@mail.nl.linux.org>; Tue, 13 Jun 2000 09:41:06 +0200
Date:   Tue, 13 Jun 2000 09:41:06 +0200 (CEST)
From:   Eric Vielet <ev@crihan.fr>
To:     kernel-audit@nl.linux.org
Message-ID: <Pine.LNX.4.21.0006130940560.20388-100000@spectrum.crihan.fr>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list


auth 266ab617 subscribe kernel-audit ev@crihan.fr


Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Tue Jun 13 09:50:04 2000
Received: by humbolt.nl.linux.org id <S92317AbQFMHtL>;
	Tue, 13 Jun 2000 09:49:11 +0200
Received: from mrl.vipnet.hr ([195.29.159.14]:34807 "EHLO ita5.vipnet.hr")
	by humbolt.nl.linux.org with ESMTP id <S92314AbQFMHsk>;
	Tue, 13 Jun 2000 09:48:40 +0200
Received: from zsdat01.vipnet.hr (zsdat01.vipnet.hr [10.243.149.11])
	by ita5.vipnet.hr (8.9.3/8.9.3/SS) with ESMTP id JAA18985
	for <kernel-audit@nl.linux.org>; Tue, 13 Jun 2000 09:48:46 +0200 (METDST)
Received: by zsdat01.vipnet.hr with Internet Mail Service (5.5.2650.21)
	id <M4P9B92J>; Tue, 13 Jun 2000 09:48:21 +0200
Message-ID: <FFDEEF271A0DD311AE63009027454391B3A5BE@zsdat03.vipnet.hr>
From:   Radoslav Dejanovic <r.dejanovic@vipnet.hr>
To:     kernel-audit@nl.linux.org
Subject: RE: suggestion
Date:   Tue, 13 Jun 2000 09:48:18 +0200
MIME-Version: 1.0
X-Mailer: Internet Mail Service (5.5.2650.21)
Content-Type: text/plain;
	charset="iso-8859-1"
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

> Long running systems on 2.0.x generally have administrators 
> that aren't
> keen on compiling new kernels, don't they?  Therefore, why 
> maintain the
> 2.0.x kernel?  If you've got a handful of developers each 

Well, neither I am a coder, so all I can do here is lurking and learning, 
but however there are some points about the issue.

One of them, never discussed before (I think), is the business issue. 

Indeed, there are people running Linux for money out there. They need to
have reliable system.
They also want to be on the cutting edge of computer technology. That
implies they'll most probably
use the latest stable kernel to work with (or sell the computer with it). 

Now, if people here perform checks just for one version of the kernel, it
will hardly be the one
used in business. Unless, of course, business people are smart enough to
stay with the audited kernel version.


On the other hand, they'll demand things like USB support, so they can
use/sell computers. 

I am not one of those who have to install development kernel just because
some SCSI driver (that I don't use
nor I need it) has some minor fix, but there are technologies that will be
widely used. USB support is one of them. 
While it still sucks a big time, this is something you and me will have to
use very soon. Auditing the kernel without
USB support could become obsolete in no time, not just for business, but for
home user too. 

To cut a long story short - business is one of areas that could benefit
greatly if the right kernel is audited. 

P.S. another question for you - what can people like me (not really good
coders, no real knowledge of kernel, etc.)
 do to help the project?  Except to shut up?!? ;-)


Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Tue Jun 13 09:52:13 2000
Received: by humbolt.nl.linux.org id <S92318AbQFMHvM>;
	Tue, 13 Jun 2000 09:51:12 +0200
Received: from cafe.affinity-systems.ab.ca ([139.142.10.12]:57101 "EHLO
        cafe.affinity-systems.ab.ca") by humbolt.nl.linux.org with ESMTP
	id <S92316AbQFMHug>; Tue, 13 Jun 2000 09:50:36 +0200
Received: (from jbourne@localhost)
	by cafe.affinity-systems.ab.ca (8.9.3/8.9.3/asi-redhat) id BAA15876;
	Tue, 13 Jun 2000 01:50:29 -0600
Date:   Tue, 13 Jun 2000 01:50:28 -0600 (MDT)
From:   James Bourne <jbourne@affinity-systems.ab.ca>
To:     Todd Fencl <fencl12@email.msn.com>
cc:     kernel-audit@nl.linux.org
Subject: RE: A proposed model for the audit
In-Reply-To: <AEEEKLJAHMJHEPBIJLPEKEJPCCAA.fencl12@email.msn.com>
Message-ID: <Pine.LNX.4.21.0006130118230.13865-100000@cafe.affinity-systems.ab.ca>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

On Mon, 12 Jun 2000, Todd Fencl wrote:

> ## snip from Gigi
> 	We have to audit 2.2 kernel series.
> 	Even if the `new' young kernel is (will be) 2.4, there will be
> 	long time before quite everybody will turn into this new series.
> 
> I have to agree. I would vote to maintain / secure both code bases. I have
> several machines (~15) that are running 2.2.x kernels and I have no great
> desire to upgrade them as soon as 2.4.x is released. Maybe down the road
> when 2.4.x has been out and tested in 'real world' systems, but not until
> then.

This is what I was trying to say before when I was pushing for the 2.2
stuff.

The point is, how long until 2.4 stabilizes to something usable in an
environment such as a server?  Lets take a look at something historical to
find out:
(from ftp.us.kernel.org)
us:/pub/linux/kernel/v2.2> ls -l linux-2.2.0.tar.gz
-rw-r--r--   1 lnx-krnl lnx-krnl 13080195 Jan 26  1999 linux-2.2.0.tar.gz
us:/pub/linux/kernel/v2.2> ls -l linux-2.2.16.tar.gz
-rw-r--r--   1 lnx-krnl lnx-krnl 17106471 Jun  7 21:34 linux-2.2.16.tar.gz

So in about a year and a half, the kernel has gone through 16 revisions, not
all of which were completely stable IIRC, and I personally would *maybe* put
2.2.16 on a serious server now... *maybe*, if the good parts outweighed the
bad.

Starting at 2.4 now I think would be a mistake.  2.0.4 came out in about
July of '96, and 2.0.38 in Aug of '99.  2.4 will likely become stable
enough sometime in 2001, maybe even 2002...

I think that will give us enough time to audit 2.2.

Regards
Jim

PS: and I'm in the 25% of this list, just for the record..

Once 2.4 stabilizes, then I think it would be good

> 
> --
> Todd Fencl < fencl12@msn.com >
> -- Where would you like to go today? ...
>    the road is open, just as the source !!
> 
> 
> 
> Kernel-audit:  discussion list for security and the linux kernel
> Archive:       http://mail.nl.linux.org/kernel-audit/
> 

-- 
James Bourne                  | Email:  jbourne@affinity-systems.ab.ca
Affinity Systems Inc.         | WWW: http://www.affinity-systems.ab.ca
Everything Linux              | Linux:  The choice of a GNU generation
----------------------------------------------------------------------
Unix System Administration, System programming, Network Administration


Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Tue Jun 13 10:02:13 2000
Received: by humbolt.nl.linux.org id <S92319AbQFMIBB>;
	Tue, 13 Jun 2000 10:01:01 +0200
Received: from prodigy.aztec.co.uk ([62.232.32.10]:7953 "EHLO
        prodigy.aztec.co.uk") by humbolt.nl.linux.org with ESMTP
	id <S92314AbQFMIA0>; Tue, 13 Jun 2000 10:00:26 +0200
Received: from aztec.co.uk (develop05 [10.66.2.105])
	by prodigy.aztec.co.uk (8.9.3/8.9.3) with ESMTP id JAA17817
	for <kernel-audit@nl.linux.org>; Tue, 13 Jun 2000 09:03:51 +0100
Message-ID: <3945EA37.747D069E@aztec.co.uk>
Date:   Tue, 13 Jun 2000 09:00:56 +0100
From:   James Lyon <james.lyon@aztec.co.uk>
Organization: Aztec Business Solutions
X-Mailer: Mozilla 4.73 [en] (WinNT; U)
X-Accept-Language: en
MIME-Version: 1.0
To:     LKAP : General <kernel-audit@nl.linux.org>
Subject: Foundation Discussions
Content-Type: multipart/mixed;
 boundary="------------04C5CCC3F986A9686B346277"
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

This is a multi-part message in MIME format.
--------------04C5CCC3F986A9686B346277
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit

I'm off for a break, but will return when the list settles down a bit.

--------------04C5CCC3F986A9686B346277
Content-Type: text/x-vcard; charset=us-ascii;
 name="james.lyon.vcf"
Content-Transfer-Encoding: 7bit
Content-Description: Card for James Lyon
Content-Disposition: attachment;
 filename="james.lyon.vcf"

begin:vcard 
n:Lyon;James
tel;pager:24-hour contact via Work number
tel;cell:+44 (7973) 824857
tel;fax:+44 (24) 7670 2501
tel;home:Please use Cellular number.
tel;work:+44 (24) 7670 2500
x-mozilla-html:TRUE
url:http://www.aztec.co.uk/
org:Business IT Research Ltd t/a Aztec Business Solutions
version:2.1
email;internet:james.lyon@aztec.co.uk
title:Managing Director
adr;quoted-printable:;;Enterprise House=0D=0ACourtaulds Way;Coventry;;CV6 5NX;UK
fn:James Lyon
end:vcard

--------------04C5CCC3F986A9686B346277--


Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Tue Jun 13 10:09:04 2000
Received: by humbolt.nl.linux.org id <S92320AbQFMIIN>;
	Tue, 13 Jun 2000 10:08:13 +0200
Received: from nifty.blue-labs.org ([208.179.0.193]:15659 "EHLO
        nifty.Blue-Labs.org") by humbolt.nl.linux.org with ESMTP
	id <S92316AbQFMIHd>; Tue, 13 Jun 2000 10:07:33 +0200
Received: from kalifornia.com (david@localhost [127.0.0.1])
	by nifty.Blue-Labs.org (8.9.3/8.9.0) with ESMTP id VAA30787;
	Mon, 12 Jun 2000 21:59:56 -0700
Message-ID: <3945BFCC.D73146A4@kalifornia.com>
Date:   Mon, 12 Jun 2000 21:59:56 -0700
From:   David Ford <david@kalifornia.com>
Reply-To: david+validemail@kalifornia.com
Organization: Talon Technology, Intl.
X-Mailer: Mozilla 4.73 [en] (X11; U; Linux 2.4.0-test1-ac12 i686)
X-Accept-Language: en
MIME-Version: 1.0
To:     jasonc@nixed.net
CC:     kernel-audit@nl.linux.org
Subject: Re: web site..
References: <20000612194443.A11046@nixed.net>
Content-Type: multipart/mixed;
 boundary="------------36C4A4A8A2B208A212DA2470"
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

This is a multi-part message in MIME format.
--------------36C4A4A8A2B208A212DA2470
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit

php and [postgre]sql, css design, etc  :)

-d

jasonc@nixed.net wrote:

> Hello, my name is jason... Bryan asked me to be the master of the pages.. so let me know what you want!.....
>
> for those of you who dont know I am slaker on irc.openprojecs.com and on irc.dal.net #linux an #perl
>
> later...
>
> Kernel-audit:  discussion list for security and the linux kernel
> Archive:       http://mail.nl.linux.org/kernel-audit/

--
"The difference between 'involvement' and 'commitment' is like an
eggs-and-ham breakfast: the chicken was 'involved' - the pig was
'committed'."



--------------36C4A4A8A2B208A212DA2470
Content-Type: text/x-vcard; charset=us-ascii;
 name="david.vcf"
Content-Transfer-Encoding: 7bit
Content-Description: Card for David Ford
Content-Disposition: attachment;
 filename="david.vcf"

begin:vcard 
n:Ford;David
x-mozilla-html:TRUE
org:<img src="http://www.kalifornia.com/images/poweredbylinux.gif">
adr:;;;;;;
version:2.1
email;internet:david@kalifornia.com
title:Blue Labs Developer
x-mozilla-cpt:;-26528
fn:David Ford
end:vcard

--------------36C4A4A8A2B208A212DA2470--


Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Tue Jun 13 10:14:40 2000
Received: by humbolt.nl.linux.org id <S92333AbQFMINS>;
	Tue, 13 Jun 2000 10:13:18 +0200
Received: from nifty.blue-labs.org ([208.179.0.193]:16683 "EHLO
        nifty.Blue-Labs.org") by humbolt.nl.linux.org with ESMTP
	id <S92322AbQFMIMo>; Tue, 13 Jun 2000 10:12:44 +0200
Received: from kalifornia.com (david@localhost [127.0.0.1])
	by nifty.Blue-Labs.org (8.9.3/8.9.0) with ESMTP id WAA30800
	for <kernel-audit@nl.linux.org>; Mon, 12 Jun 2000 22:05:27 -0700
Message-ID: <3945C117.BCF2EBA@kalifornia.com>
Date:   Mon, 12 Jun 2000 22:05:27 -0700
From:   David Ford <david@kalifornia.com>
Reply-To: david+validemail@kalifornia.com
Organization: Talon Technology, Intl.
X-Mailer: Mozilla 4.73 [en] (X11; U; Linux 2.4.0-test1-ac12 i686)
X-Accept-Language: en
MIME-Version: 1.0
CC:     kernel-audit@nl.linux.org
Subject: Re: root users, etc....
References: <00061219551900.01827@ABS.ATGroup> <20000612205121.D4769@obi.sf.xuma.com>
Content-Type: multipart/mixed;
 boundary="------------1A222D3267317185EA2C732E"
To:     unlisted-recipients:; (no To-header on input)
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

This is a multi-part message in MIME format.
--------------1A222D3267317185EA2C732E
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit

Jesse Nelson wrote:

> agreed!, yeah I know I don't add anything to the subject but this kindda chaps my ass.
>
> Previously, Adam wrote:
> > I really don't care what kernel we start with, I just want to start. I am sick
> > of this bickering, but I can't help but inject my $0.02 worth. What the hell
> > are people who don't know enough not to use their root accounts with doing on
> > this email list. No one should ever check their email with a root account, how
> > dumb are they?

'root' is a text identifier and can be associated with any numerical user id.  you'll
find some people do this as an amusement to toy with people.

-d

--
"The difference between 'involvement' and 'commitment' is like an
eggs-and-ham breakfast: the chicken was 'involved' - the pig was
'committed'."



--------------1A222D3267317185EA2C732E
Content-Type: text/x-vcard; charset=us-ascii;
 name="david.vcf"
Content-Transfer-Encoding: 7bit
Content-Description: Card for David Ford
Content-Disposition: attachment;
 filename="david.vcf"

begin:vcard 
n:Ford;David
x-mozilla-html:TRUE
org:<img src="http://www.kalifornia.com/images/poweredbylinux.gif">
adr:;;;;;;
version:2.1
email;internet:david@kalifornia.com
title:Blue Labs Developer
x-mozilla-cpt:;-26528
fn:David Ford
end:vcard

--------------1A222D3267317185EA2C732E--


Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Tue Jun 13 10:45:43 2000
Received: by humbolt.nl.linux.org id <S92316AbQFMIol>;
	Tue, 13 Jun 2000 10:44:41 +0200
Received: from dialupC187.sttl.uswest.net ([207.224.251.187]:5936 "EHLO
        ellipsis.aniota.net") by humbolt.nl.linux.org with ESMTP
	id <S92321AbQFMIoM>; Tue, 13 Jun 2000 10:44:12 +0200
Received: from localhost (twhite@localhost)
	by ellipsis.aniota.net (8.8.7/8.8.7) with ESMTP id BAA27873;
	Tue, 13 Jun 2000 01:40:06 -0700
X-Authentication-Warning: ellipsis.aniota.net: twhite owned process doing -bs
Date:   Tue, 13 Jun 2000 01:40:05 -0700 (PDT)
From:   terry white <twhite@aniota.com>
To:     Natasha Live <live@braecklein.freeserve.co.uk>
cc:     kernel-audit@nl.linux.org
Subject: Re: A proposed model for the audit
In-Reply-To: <20000613022642.B17226@braecklein.freeserve.co.uk>
Message-ID: <Pine.LNX.4.10.10006130116020.27632-100000@ellipsis.aniota.net>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

on "06/13/00" "Natasha Live" writ:

: access to stuff like USB and AGP). these ppl will never waste their
: time with anything less than the newest.

   ... which, in and of itself, begs the question of their intrinsic
value to this project.  they might be better suited to the 'kernel
development' effort instead.
  
       it seems to me, 'auditing' similar to that function in
bookkeeping:  "can't be done till the books are closed."  anything prior
to that, a potential waste of time.
  
       as i see it, the last stable release in 2.0 and 2.2 are prime for
inspection as they are in use, and share a good deal of common code.
finding that commonality, and those differences, might prove efficient
...

-- 
... i'm a man , and i can change ,
    if i really have to , i guess ...



Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Tue Jun 13 10:50:54 2000
Received: by humbolt.nl.linux.org id <S92321AbQFMIty>;
	Tue, 13 Jun 2000 10:49:54 +0200
Received: from nifty.blue-labs.org ([208.179.0.193]:19755 "EHLO
        nifty.Blue-Labs.org") by humbolt.nl.linux.org with ESMTP
	id <S92326AbQFMItV>; Tue, 13 Jun 2000 10:49:21 +0200
Received: from kalifornia.com (david@localhost [127.0.0.1])
	by nifty.Blue-Labs.org (8.9.3/8.9.0) with ESMTP id WAA30888
	for <kernel-audit@nl.linux.org>; Mon, 12 Jun 2000 22:42:04 -0700
Message-ID: <3945C9AC.A819F3A5@kalifornia.com>
Date:   Mon, 12 Jun 2000 22:42:04 -0700
From:   David Ford <david@kalifornia.com>
Reply-To: david+validemail@kalifornia.com
Organization: Talon Technology, Intl.
X-Mailer: Mozilla 4.73 [en] (X11; U; Linux 2.4.0-test1-ac12 i686)
X-Accept-Language: en
MIME-Version: 1.0
CC:     kernel-audit@nl.linux.org
Subject: Re: utils.c
References: <31FC13508138D4119C6A000102495013459F@QUAKE01> <Pine.LNX.3.96.1000612124610.32A-100000@plow> <20000612210443.B25330@lemuria.org> <39455604.nail26Q11D0QR@ed.ed> <20000613085951.C27441@lemuria.org>
Content-Type: multipart/mixed;
 boundary="------------4299ABDD059CC82421C2F3C6"
To:     unlisted-recipients:; (no To-header on input)
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

This is a multi-part message in MIME format.
--------------4299ABDD059CC82421C2F3C6
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit

kuznet is the active maintainer of the file at the moment.  i send my patches
to him.

i think comments should be included in the md5 simply because it makes our
jobs easier for a) less script work and b) a new comment could be important
and we should notice it.

-d

Tom Vogt wrote:

> root <evpopkov@carry.neonet.lv> wrote:
> > File:         net/ipv4/utils.c
> > md5sum:               b8b7b98a736261aab800a2f222514b89
> > Kernel Version:       2.0.38
>
> we should possibly sed out the comment blocks and run a second md5sum on
> the pure code, to see whether there were actual code changes.
>
> > Function Name:                in_ntoa
> > Maintainer:           Fred N. van Kempen, <waltje@uWalt.NL.Mugnet.ORG>
>
> is mentioned in my file as the author, but the $Id CVS tag says kuznet was
> the last one to change anything.
>
> which one do we take?
>
> > Other Notes:          check behaviour on malformed string, eg when there
> >                       are more than three or no digits between the dots
>
> behaves correctly for any malfunction, including the address "..." (which
> will return 0). on very long strings the int might roll over, but then the
> input is nonsensical anyways so it doesn't matter that the return value is
> nonsense, too.
>
> --
> Welcome to the Information Superspyway
>
> Kernel-audit:  discussion list for security and the linux kernel
> Archive:       http://mail.nl.linux.org/kernel-audit/

--
"The difference between 'involvement' and 'commitment' is like an
eggs-and-ham breakfast: the chicken was 'involved' - the pig was
'committed'."



--------------4299ABDD059CC82421C2F3C6
Content-Type: text/x-vcard; charset=us-ascii;
 name="david.vcf"
Content-Transfer-Encoding: 7bit
Content-Description: Card for David Ford
Content-Disposition: attachment;
 filename="david.vcf"

begin:vcard 
n:Ford;David
x-mozilla-html:TRUE
org:<img src="http://www.kalifornia.com/images/poweredbylinux.gif">
adr:;;;;;;
version:2.1
email;internet:david@kalifornia.com
title:Blue Labs Developer
x-mozilla-cpt:;-26528
fn:David Ford
end:vcard

--------------4299ABDD059CC82421C2F3C6--


Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Tue Jun 13 10:55:23 2000
Received: by humbolt.nl.linux.org id <S92323AbQFMIyP>;
	Tue, 13 Jun 2000 10:54:15 +0200
Received: from nsm.htp.org ([202.241.243.104]:28688 "HELO nsm.htp.org")
	by humbolt.nl.linux.org with SMTP id <S92322AbQFMIxj>;
	Tue, 13 Jun 2000 10:53:39 +0200
Received: (qmail 8375 invoked from network); 13 Jun 2000 08:48:32 -0000
Received: from localhost (127.0.0.1)
  by localhost with SMTP; 13 Jun 2000 08:48:32 -0000
To:     kernel-audit@nl.linux.org
Subject: Re: A proposed model for the audit
From:   sen_ml@eccosys.com
In-Reply-To: <Pine.LNX.4.10.10006130116020.27632-100000@ellipsis.aniota.net>
References: <20000613022642.B17226@braecklein.freeserve.co.uk>
	<Pine.LNX.4.10.10006130116020.27632-100000@ellipsis.aniota.net>
X-Mailer: Mew version 1.94.1 on Emacs 20.6 / Mule 4.0 (HANANOEN)
X-No-Archive: Yes
Mime-Version: 1.0
Content-Type: Text/Plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Message-Id: <20000613175328M.1001@eccosys.com>
Date:   Tue, 13 Jun 2000 17:53:28 +0900
X-Dispatcher: imput version 20000228(IM140)
Lines:  18
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

just a minor point.

From: terry white <twhite@aniota.com>
Subject: Re: A proposed model for the audit
Date: Tue, 13 Jun 2000 01:40:05 -0700 (PDT)
Message-ID: <Pine.LNX.4.10.10006130116020.27632-100000@ellipsis.aniota.net>

>        it seems to me, 'auditing' similar to that function in
> bookkeeping:  "can't be done till the books are closed."  anything prior
> to that, a potential waste of time.

even if some code that exists now doesn't get used later, if it
contains mistakes/holes or is particularly good code, people stand a
chance of learning general lessons from it -- even more people can
benefit if a summary of the situation is created and posted somewhere.

so, i don't think it's necessarily a waste of time from that point of
view.

Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Tue Jun 13 10:57:13 2000
Received: by humbolt.nl.linux.org id <S92326AbQFMIzb>;
	Tue, 13 Jun 2000 10:55:31 +0200
Received: from dialupC187.sttl.uswest.net ([207.224.251.187]:6448 "EHLO
        ellipsis.aniota.net") by humbolt.nl.linux.org with ESMTP
	id <S92322AbQFMIyj>; Tue, 13 Jun 2000 10:54:39 +0200
Received: from localhost (twhite@localhost)
	by ellipsis.aniota.net (8.8.7/8.8.7) with ESMTP id BAA27878
	for <kernel-audit@nl.linux.org>; Tue, 13 Jun 2000 01:50:53 -0700
X-Authentication-Warning: ellipsis.aniota.net: twhite owned process doing -bs
Date:   Tue, 13 Jun 2000 01:50:52 -0700 (PDT)
From:   terry white <twhite@aniota.com>
To:     kernel-audit@nl.linux.org
Subject: in passing ...
Message-ID: <Pine.LNX.4.10.10006130145120.27632-100000@ellipsis.aniota.net>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

 
   ... i've noticed a couple posts that seemed less than enthusiastic.
it just occured to me , there are 'probably' elements not wishing this
effort any success at all ...

-- 
... i'm a man , and i can change ,
    if i really have to , i guess ...



Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Tue Jun 13 11:02:54 2000
Received: by humbolt.nl.linux.org id <S92329AbQFMJBt>;
	Tue, 13 Jun 2000 11:01:49 +0200
Received: from carry.netneo.com ([195.62.128.21]:21261 "EHLO carry.neonet.lv")
	by humbolt.nl.linux.org with ESMTP id <S92334AbQFMJBQ>;
	Tue, 13 Jun 2000 11:01:16 +0200
Received: from ed.ed (as0x.netneo.com [195.62.135.215])
	by carry.neonet.lv (8.9.3/8.9.3) with ESMTP id LAA20987
	for <kernel-audit@nl.linux.org>; Tue, 13 Jun 2000 11:00:33 +0200
Received: (from root@localhost)
	by ed.ed (8.8.7/8.8.5) id IAA00292
	for kernel-audit@nl.linux.org; Tue, 13 Jun 2000 08:16:19 GMT
From:   root <evpopkov@carry.neonet.lv>
Date:   Tue, 13 Jun 2000 08:16:18 +0000
To:     kernel-audit@nl.linux.org
Subject: Re: web site..
Message-ID: <3945EDD2.nail7Q1BD57H@ed.ed>
References: <20000612194443.A11046@nixed.net>
X-Mailer: nail 9.13 2000-05-30
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

> Hello, my name is jason... Bryan asked me to be the master of the pages..
so let me know what you want!.....

 Hi Jason. I think we need an  archive online. Nothing cute, just a list of
files with short descriptions.

 Thx

 Ed


---

 "Teddy - I suppose Mummy and Daddy are real, aren't they?"
 Teddy said, "You ask such silly questions, David. Nobody knows what
'real' really means. Let's go indoors."

 Brian W. Aldiss, Supertoys Last All Summer Long


Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Tue Jun 13 11:27:56 2000
Received: by humbolt.nl.linux.org id <S92331AbQFMJ0w>;
	Tue, 13 Jun 2000 11:26:52 +0200
Received: from desh.cisco.com ([192.122.173.43]:33207 "EHLO desh.cisco.com")
	by humbolt.nl.linux.org with ESMTP id <S92325AbQFMJ0Q>;
	Tue, 13 Jun 2000 11:26:16 +0200
Received: from cisco.com (desh.cisco.com [192.122.173.43])
	by desh.cisco.com (8.8.8-Cisco List Logging/8.8.8) with ESMTP id OAA24661;
	Tue, 13 Jun 2000 14:56:05 +0530 (IST)
Message-ID: <3945FE2A.7546AA24@cisco.com>
Date:   Tue, 13 Jun 2000 14:56:04 +0530
From:   Bikram Kumar Gupta <bgupta@cisco.com>
X-Mailer: Mozilla 4.51C-CISCOENG [en] (X11; I; SunOS 5.6 sun4u)
X-Accept-Language: en
MIME-Version: 1.0
To:     kernel-audit@nl.linux.org
CC:     terry white <twhite@aniota.com>,
        Natasha Live <live@braecklein.freeserve.co.uk>
Subject: Re: A proposed model for the audit
References: <Pine.LNX.4.10.10006130116020.27632-100000@ellipsis.aniota.net>
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

I am new to a discussion list like this. Also I have just started 
going through Linux Kernel.

I think auditing should be done on a kernel which is stable. The 
purpose of this discussion is to improve existing kernel in terms
of efficiency and other things (hidden bugs, code style, etc). Am I 
right? If it is so, then we should work on a stable, proven and
mostly used kernel.

Also I feel (excuse me for not knowing the philosophy of a public
discussion group) that, the founders of the mailing list should
show the direction by drawing conclusions on various issues time
to time.

Thanks,
Bikram.

terry white wrote:
> 
> on "06/13/00" "Natasha Live" writ:
> 
> : access to stuff like USB and AGP). these ppl will never waste their
> : time with anything less than the newest.
> 
>    ... which, in and of itself, begs the question of their intrinsic
> value to this project.  they might be better suited to the 'kernel
> development' effort instead.
> 
>        it seems to me, 'auditing' similar to that function in
> bookkeeping:  "can't be done till the books are closed."  anything prior
> to that, a potential waste of time.
> 
>        as i see it, the last stable release in 2.0 and 2.2 are prime for
> inspection as they are in use, and share a good deal of common code.
> finding that commonality, and those differences, might prove efficient
> ...
> 
> --
> ... i'm a man , and i can change ,
>     if i really have to , i guess ...
> 
> Kernel-audit:  discussion list for security and the linux kernel
> Archive:       http://mail.nl.linux.org/kernel-audit/

Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Tue Jun 13 11:54:03 2000
Received: by humbolt.nl.linux.org id <S92327AbQFMJw7>;
	Tue, 13 Jun 2000 11:52:59 +0200
Received: from nifty.blue-labs.org ([208.179.0.193]:24619 "EHLO
        nifty.Blue-Labs.org") by humbolt.nl.linux.org with ESMTP
	id <S92325AbQFMJwf>; Tue, 13 Jun 2000 11:52:35 +0200
Received: from kalifornia.com (david@localhost [127.0.0.1])
	by nifty.Blue-Labs.org (8.9.3/8.9.0) with ESMTP id XAA30912
	for <kernel-audit@nl.linux.org>; Mon, 12 Jun 2000 23:45:17 -0700
Message-ID: <3945D87C.A54F4892@kalifornia.com>
Date:   Mon, 12 Jun 2000 23:45:16 -0700
From:   David Ford <david@kalifornia.com>
Reply-To: david+validemail@kalifornia.com
Organization: Talon Technology, Intl.
X-Mailer: Mozilla 4.73 [en] (X11; U; Linux 2.4.0-test1-ac12 i686)
X-Accept-Language: en
MIME-Version: 1.0
CC:     kernel-audit@nl.linux.org
Subject: Re: A proposed model for the audit
References: <Pine.LNX.4.21.0006130118230.13865-100000@cafe.affinity-systems.ab.ca>
Content-Type: multipart/mixed;
 boundary="------------4FF6807CA8A346CB1D82000E"
To:     unlisted-recipients:; (no To-header on input)
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

This is a multi-part message in MIME format.
--------------4FF6807CA8A346CB1D82000E
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit

James Bourne wrote:

> The point is, how long until 2.4 stabilizes to something usable in an
> environment such as a server?  Lets take a look at something historical to
> find out:

Stabilizes?  Hmm, I have 2.3/2.4 kernels that are more stable than anything
less than them.

-d

>
> (from ftp.us.kernel.org)
> us:/pub/linux/kernel/v2.2> ls -l linux-2.2.0.tar.gz
> -rw-r--r--   1 lnx-krnl lnx-krnl 13080195 Jan 26  1999 linux-2.2.0.tar.gz
> us:/pub/linux/kernel/v2.2> ls -l linux-2.2.16.tar.gz
> -rw-r--r--   1 lnx-krnl lnx-krnl 17106471 Jun  7 21:34 linux-2.2.16.tar.gz
>
> So in about a year and a half, the kernel has gone through 16 revisions, not
> all of which were completely stable IIRC, and I personally would *maybe* put
> 2.2.16 on a serious server now... *maybe*, if the good parts outweighed the
> bad.

And 2.0 now has 38 versions.  Being a daily participant of lkml since 1.1, I
have been made aware of numerous flaws and shortcomings in 2.0 and 2.2.


> Starting at 2.4 now I think would be a mistake.  2.0.4 came out in about
> July of '96, and 2.0.38 in Aug of '99.  2.4 will likely become stable
> enough sometime in 2001, maybe even 2002...

Well, by this logic, if 2.0.38 came out, it must have been for bug fixes so
it's not stable yet so we should work on 1.2.13 because 1.3 is a dev tree.

2.4 is quite nearly as stable as 2.2 is with reservation to a list of known
bugs that are being fixed before release.  A stability factor of "99" is still
"99" from the point of inception to five years down the road with no change.
Empirical stats lends weight to "99" but it is still "99".

Different configurations of 2.0/2.2 can be wildly unstable or rock solid, this
is a known and supported fact.  If there weren't bugs in the old code, there
wouldn't be bug fixes.

And I'm an active part of the 25%, and my vote is towards 2.4 code.

-d


--
"The difference between 'involvement' and 'commitment' is like an
eggs-and-ham breakfast: the chicken was 'involved' - the pig was
'committed'."



--------------4FF6807CA8A346CB1D82000E
Content-Type: text/x-vcard; charset=us-ascii;
 name="david.vcf"
Content-Transfer-Encoding: 7bit
Content-Description: Card for David Ford
Content-Disposition: attachment;
 filename="david.vcf"

begin:vcard 
n:Ford;David
x-mozilla-html:TRUE
org:<img src="http://www.kalifornia.com/images/poweredbylinux.gif">
adr:;;;;;;
version:2.1
email;internet:david@kalifornia.com
title:Blue Labs Developer
x-mozilla-cpt:;-26528
fn:David Ford
end:vcard

--------------4FF6807CA8A346CB1D82000E--


Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Tue Jun 13 11:57:31 2000
Received: by humbolt.nl.linux.org id <S92332AbQFMJzx>;
	Tue, 13 Jun 2000 11:55:53 +0200
Received: from nifty.blue-labs.org ([208.179.0.193]:25387 "EHLO
        nifty.Blue-Labs.org") by humbolt.nl.linux.org with ESMTP
	id <S92325AbQFMJzU>; Tue, 13 Jun 2000 11:55:20 +0200
Received: from kalifornia.com (david@localhost [127.0.0.1])
	by nifty.Blue-Labs.org (8.9.3/8.9.0) with ESMTP id XAA30917
	for <kernel-audit@nl.linux.org>; Mon, 12 Jun 2000 23:48:00 -0700
Message-ID: <3945D920.54D606CA@kalifornia.com>
Date:   Mon, 12 Jun 2000 23:48:00 -0700
From:   David Ford <david@kalifornia.com>
Reply-To: david+validemail@kalifornia.com
Organization: Talon Technology, Intl.
X-Mailer: Mozilla 4.73 [en] (X11; U; Linux 2.4.0-test1-ac12 i686)
X-Accept-Language: en
MIME-Version: 1.0
CC:     kernel-audit@nl.linux.org
Subject: Re: suggestion
References: <FFDEEF271A0DD311AE63009027454391B3A5BE@zsdat03.vipnet.hr>
Content-Type: multipart/mixed;
 boundary="------------35E26A1B1CB75724B6540D2C"
To:     unlisted-recipients:; (no To-header on input)
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

This is a multi-part message in MIME format.
--------------35E26A1B1CB75724B6540D2C
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit

Radoslav Dejanovic wrote:

> P.S. another question for you - what can people like me (not really good
> coders, no real knowledge of kernel, etc.)
>  do to help the project?  Except to shut up?!? ;-)

Documentation grammar, spelling, etc checking.  Researching points.  Web/ftp
site maintenance, news letters.  Don't think for a moment that perusing code is
the only thing to be done :)

-d

--
"The difference between 'involvement' and 'commitment' is like an
eggs-and-ham breakfast: the chicken was 'involved' - the pig was
'committed'."



--------------35E26A1B1CB75724B6540D2C
Content-Type: text/x-vcard; charset=us-ascii;
 name="david.vcf"
Content-Transfer-Encoding: 7bit
Content-Description: Card for David Ford
Content-Disposition: attachment;
 filename="david.vcf"

begin:vcard 
n:Ford;David
x-mozilla-html:TRUE
org:<img src="http://www.kalifornia.com/images/poweredbylinux.gif">
adr:;;;;;;
version:2.1
email;internet:david@kalifornia.com
title:Blue Labs Developer
x-mozilla-cpt:;-26528
fn:David Ford
end:vcard

--------------35E26A1B1CB75724B6540D2C--


Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Tue Jun 13 12:02:53 2000
Received: by humbolt.nl.linux.org id <S92325AbQFMKBb>;
	Tue, 13 Jun 2000 12:01:31 +0200
Received: from nifty.blue-labs.org ([208.179.0.193]:26155 "EHLO
        nifty.Blue-Labs.org") by humbolt.nl.linux.org with ESMTP
	id <S92337AbQFMKAx>; Tue, 13 Jun 2000 12:00:53 +0200
Received: from kalifornia.com (david@localhost [127.0.0.1])
	by nifty.Blue-Labs.org (8.9.3/8.9.0) with ESMTP id XAA30923
	for <kernel-audit@nl.linux.org>; Mon, 12 Jun 2000 23:53:35 -0700
Message-ID: <3945DA6F.111BF5AD@kalifornia.com>
Date:   Mon, 12 Jun 2000 23:53:35 -0700
From:   David Ford <david@kalifornia.com>
Reply-To: david+validemail@kalifornia.com
Organization: Talon Technology, Intl.
X-Mailer: Mozilla 4.73 [en] (X11; U; Linux 2.4.0-test1-ac12 i686)
X-Accept-Language: en
MIME-Version: 1.0
CC:     kernel-audit@nl.linux.org
Subject: Re: A proposed model for the audit
References: <Pine.LNX.4.10.10006130116020.27632-100000@ellipsis.aniota.net> <3945FE2A.7546AA24@cisco.com>
Content-Type: multipart/mixed;
 boundary="------------4AC77CCE53EC013FC9720462"
To:     unlisted-recipients:; (no To-header on input)
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

This is a multi-part message in MIME format.
--------------4AC77CCE53EC013FC9720462
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit

Bikram Kumar Gupta wrote:

> I think auditing should be done on a kernel which is stable. The
> purpose of this discussion is to improve existing kernel in terms
> of efficiency and other things (hidden bugs, code style, etc). Am I
> right? If it is so, then we should work on a stable, proven and
> mostly used kernel.

Which kernel is stable varies.  If you load up a 2.2 box with a large drive
array, toss in dual cpus, and serve up a big database, you are asking for
trouble.  SMP is atrocious.  There are race conditions and driver bugs.

On the other hand, you can set up a 2.4 box that serves up a million pages a
day and keeps going and going.

What is 'stable' depends significantly on the hardware, configuration, and
operations.

-d

--
"The difference between 'involvement' and 'commitment' is like an
eggs-and-ham breakfast: the chicken was 'involved' - the pig was
'committed'."



--------------4AC77CCE53EC013FC9720462
Content-Type: text/x-vcard; charset=us-ascii;
 name="david.vcf"
Content-Transfer-Encoding: 7bit
Content-Description: Card for David Ford
Content-Disposition: attachment;
 filename="david.vcf"

begin:vcard 
n:Ford;David
x-mozilla-html:TRUE
org:<img src="http://www.kalifornia.com/images/poweredbylinux.gif">
adr:;;;;;;
version:2.1
email;internet:david@kalifornia.com
title:Blue Labs Developer
x-mozilla-cpt:;-26528
fn:David Ford
end:vcard

--------------4AC77CCE53EC013FC9720462--


Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Tue Jun 13 12:12:03 2000
Received: by humbolt.nl.linux.org id <S92338AbQFMKKw>;
	Tue, 13 Jun 2000 12:10:52 +0200
Received: from nifty.blue-labs.org ([208.179.0.193]:27179 "EHLO
        nifty.Blue-Labs.org") by humbolt.nl.linux.org with ESMTP
	id <S92336AbQFMKKS>; Tue, 13 Jun 2000 12:10:18 +0200
Received: from kalifornia.com (david@localhost [127.0.0.1])
	by nifty.Blue-Labs.org (8.9.3/8.9.0) with ESMTP id AAA30932
	for <kernel-audit@nl.linux.org>; Tue, 13 Jun 2000 00:03:00 -0700
Message-ID: <3945DCA3.2FE6CCB7@kalifornia.com>
Date:   Tue, 13 Jun 2000 00:02:59 -0700
From:   David Ford <david@kalifornia.com>
Reply-To: david+validemail@kalifornia.com
Organization: Talon Technology, Intl.
X-Mailer: Mozilla 4.73 [en] (X11; U; Linux 2.4.0-test1-ac12 i686)
X-Accept-Language: en
MIME-Version: 1.0
CC:     kernel-audit@nl.linux.org
Subject: Re: A place to start
References: <91468650040FD411A51100104B63E23123AFD8@postman.chi.navtech.com> <20000611095523.E19971@lemuria.org> <3943D71A.FA3916B4@kalifornia.com> <20000611162730.B9330@optitech.com>
Content-Type: multipart/mixed;
 boundary="------------42FC677649AF10FAB8EEA6F7"
To:     unlisted-recipients:; (no To-header on input)
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

This is a multi-part message in MIME format.
--------------42FC677649AF10FAB8EEA6F7
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit

Ray L wrote:

> not true in general, unfortunately.  a change in another file might prevent
> arp.c from even compiling, let alone implementing correct semantics.  md5sums
> are certainly valid for a large class of errors, but not all.

Actually, it is true.  The focus of an audit is that input, change, and output
follow expected definition.  If a change in another file happens, the ICO rules
still apply to 'arp.c', if your input has changed, that means the API has
changed.  If the API changes, then your ICO rules don't match and must be
updated.

An audit focuses on the data path from input to output.  Valid data will always
be processed correctly and output correctly.  Invalid data will always be handled
correctly.  There are only these two conditions.

If the API and valid input data change, then the file must change and be audited
again.  If your audited file follows the above two rules, then it will never be
the guilty party in a bug.  A developer who doesn't update the entire data path
correctly introduces fault in the system but all files that are audited will
correctly reject invalid data, not segfault etc.

Therefore an md5sum of a perfectly audited 'arp.c' will be valid.

-d

--
"The difference between 'involvement' and 'commitment' is like an
eggs-and-ham breakfast: the chicken was 'involved' - the pig was
'committed'."



--------------42FC677649AF10FAB8EEA6F7
Content-Type: text/x-vcard; charset=us-ascii;
 name="david.vcf"
Content-Transfer-Encoding: 7bit
Content-Description: Card for David Ford
Content-Disposition: attachment;
 filename="david.vcf"

begin:vcard 
n:Ford;David
x-mozilla-html:TRUE
org:<img src="http://www.kalifornia.com/images/poweredbylinux.gif">
adr:;;;;;;
version:2.1
email;internet:david@kalifornia.com
title:Blue Labs Developer
x-mozilla-cpt:;-26528
fn:David Ford
end:vcard

--------------42FC677649AF10FAB8EEA6F7--


Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Tue Jun 13 13:02:43 2000
Received: by humbolt.nl.linux.org id <S92334AbQFMLBl>;
	Tue, 13 Jun 2000 13:01:41 +0200
Received: from carry.netneo.com ([195.62.128.21]:34314 "EHLO carry.neonet.lv")
	by humbolt.nl.linux.org with ESMTP id <S92324AbQFMLBN>;
	Tue, 13 Jun 2000 13:01:13 +0200
Received: from ed.ed (as0a.netneo.com [195.62.135.192])
	by carry.neonet.lv (8.9.3/8.9.3) with ESMTP id NAA25664
	for <kernel-audit@nl.linux.org>; Tue, 13 Jun 2000 13:00:32 +0200
Received: (from root@localhost)
	by ed.ed (8.8.7/8.8.5) id LAA00999
	for kernel-audit@nl.linux.org; Tue, 13 Jun 2000 11:00:18 GMT
From:   root <evpopkov@carry.neonet.lv>
Date:   Tue, 13 Jun 2000 11:00:17 +0000
To:     kernel-audit@nl.linux.org
Subject: Re: utils.c
Message-ID: <39461441.nailQY11I6BL@ed.ed>
References: <31FC13508138D4119C6A000102495013459F@QUAKE01>
 <Pine.LNX.3.96.1000612124610.32A-100000@plow>
 <20000612210443.B25330@lemuria.org> <39455604.nail26Q11D0QR@ed.ed>
 <20000613085951.C27441@lemuria.org>
X-Mailer: nail 9.13 2000-05-30
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

> we should possibly sed out the comment blocks and run a second md5sum on
> the pure code, to see whether there were actual code changes.

 I don't know,  really. Comments contain useful  information, starting from
explanations and authors' emails, up to version control tags. Also, sedding
'em out means more work, you  know, because this requires some intelligence
:)

> is mentioned in my file as the author, but the $Id CVS tag says kuznet
> was
> the last one to change anything.

 CVS tag contains no username here. BTW, kuznet can be Fred's username :)

> which one do we take?

 I guess we need  to rename Maintainer field to Contacts  or smth like that
and list all the names and emails there.

> behaves correctly for any malfunction, including the address "..." (which
> will return 0).

 Same here, surprise :)

> on very long strings the int might roll over, but then the
> input is nonsensical anyways so it doesn't matter that the return value
> is
> nonsense, too.

 Well, in fact it rolls over on strings of valid length too, try 1.999.2.2,
see the testbed.
 Now I'm going to grep the source and see whence these functions are called
from to  try to  determine the risk  of unwanted results,  eg if  there's a
chance of calling in_ntoa in host with  long in host byte order, or calling
in_aton with user-supplied string, etc.

 Side-note: I guess we spend abit  more time on these functions to smoothen
the procedure.


---

 "Teddy - I suppose Mummy and Daddy are real, aren't they?"
 Teddy said, "You ask such silly questions, David. Nobody knows what
'real' really means. Let's go indoors."

 Brian W. Aldiss, Supertoys Last All Summer Long


Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Tue Jun 13 14:10:59 2000
Received: by humbolt.nl.linux.org id <S92335AbQFMMJz>;
	Tue, 13 Jun 2000 14:09:55 +0200
Received: from brutus.conectiva.com.br ([200.250.58.146]:45821 "EHLO
        duckman.distro.conectiva") by humbolt.nl.linux.org with ESMTP
	id <S92328AbQFMMJ3>; Tue, 13 Jun 2000 14:09:29 +0200
Received: from localhost (riel@localhost)
	by duckman.distro.conectiva (8.9.3/8.8.7) with ESMTP id JAA29681;
	Tue, 13 Jun 2000 09:09:11 -0300
X-Authentication-Warning: duckman.distro.conectiva: riel owned process doing -bs
Date:   Tue, 13 Jun 2000 09:09:10 -0300 (BRST)
From:   Rik van Riel <riel@conectiva.com.br>
X-Sender: riel@duckman.distro.conectiva
To:     sen_ml@eccosys.com
cc:     kernel-audit@nl.linux.org
Subject: Re: A proposed model for the audit
In-Reply-To: <20000613175328M.1001@eccosys.com>
Message-ID: <Pine.LNX.4.21.0006130906410.29510-100000@duckman.distro.conectiva>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

On Tue, 13 Jun 2000 sen_ml@eccosys.com wrote:

> just a minor point.

On the contrary, this is one of the major points...

> >        it seems to me, 'auditing' similar to that function in
> > bookkeeping:  "can't be done till the books are closed."  anything prior
> > to that, a potential waste of time.
> 
> even if some code that exists now doesn't get used later, if it
> contains mistakes/holes or is particularly good code, people stand a
> chance of learning general lessons from it -- even more people can
> benefit if a summary of the situation is created and posted somewhere.

This seems to be one of the major ways in which an auditing
project can influence long-term software quality.

In order to do that, all "discoveries" made should be properly
documented, categorised and made visible to everybody (I guess
there's some work for the non-coders here...).

regards,

Rik
--
The Internet is not a network of computers. It is a network
of people. That is its real strength.

Wanna talk about the kernel?  irc.openprojects.net / #kernelnewbies
http://www.conectiva.com/		http://www.surriel.com/


Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Tue Jun 13 15:04:05 2000
Received: by humbolt.nl.linux.org id <S92330AbQFMNCx>;
	Tue, 13 Jun 2000 15:02:53 +0200
Received: from vesuri.helsinki.fi ([128.214.205.10]:24333 "EHLO
        vesuri.Helsinki.FI") by humbolt.nl.linux.org with ESMTP
	id <S92328AbQFMNCX>; Tue, 13 Jun 2000 15:02:23 +0200
Received: from localhost (ammonton@localhost)
	by vesuri.Helsinki.FI (8.10.1/8.10.1) with ESMTP id e5DD24B17773
	for <kernel-audit@nl.linux.org>; Tue, 13 Jun 2000 16:02:10 +0300 (EET DST)
X-Authentication-Warning: vesuri.Helsinki.FI: ammonton owned process doing -bs
Date:   Tue, 13 Jun 2000 16:02:04 +0300 (EET DST)
From:   Anders M Montonen <ammonton@cc.helsinki.fi>
To:     kernel-audit@nl.linux.org
Subject: Re: A proposed model for the audit
In-Reply-To: <3945DA6F.111BF5AD@kalifornia.com>
Message-ID: <Pine.OSF.4.20.0006131555220.12362-100000@vesuri.Helsinki.FI>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

On Mon, 12 Jun 2000, David Ford wrote:

> What is 'stable' depends significantly on the hardware, configuration, and
> operations.

For this project there are also other 'stability' issues, namely
architectural changes. If an architectural change comes along that
provides significant performance increase then it will be a serious
temptation to upgrade, regardless of whether that change has been audited
or not. Keep in mind that these changes are not limited to development
kernels, as the VM patches in recent 2.2 kernels will testify.

-a


Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Tue Jun 13 15:19:23 2000
Received: by humbolt.nl.linux.org id <S92336AbQFMNSN>;
	Tue, 13 Jun 2000 15:18:13 +0200
Received: from on-air-0.in-addr.de ([212.8.197.250]:4875 "EHLO
        hermes.marowsky-bree.de") by humbolt.nl.linux.org with ESMTP
	id <S92328AbQFMNRo>; Tue, 13 Jun 2000 15:17:44 +0200
Received: by hermes.marowsky-bree.de (Postfix, from userid 500)
	id 6E9854D07E; Tue, 13 Jun 2000 15:17:35 +0200 (CEST)
Date:   Tue, 13 Jun 2000 15:17:35 +0200
From:   Lars Marowsky-Bree <lmb@suse.de>
To:     Anders M Montonen <ammonton@cc.helsinki.fi>
Cc:     kernel-audit@nl.linux.org
Subject: Re:  A proposed model for the audit
Message-ID: <20000613151735.I4512@marowsky-bree.de>
References: <3945DA6F.111BF5AD@kalifornia.com> <Pine.OSF.4.20.0006131555220.12362-100000@vesuri.Helsinki.FI>
Mime-Version: 1.0
Content-Type: text/plain; charset=iso-8859-1
Content-Transfer-Encoding: 8bit
X-Mailer: Mutt 1.0i
In-Reply-To: <Pine.OSF.4.20.0006131555220.12362-100000@vesuri.Helsinki.FI>; from "Anders M Montonen" on 2000-06-13T16:02:04
X-Ctuhulu: HASTUR
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

On 2000-06-13T16:02:04,
   Anders M Montonen <ammonton@cc.helsinki.fi> said:

> For this project there are also other 'stability' issues, namely
> architectural changes. If an architectural change comes along that
> provides significant performance increase then it will be a serious
> temptation to upgrade, regardless of whether that change has been audited
> or not. Keep in mind that these changes are not limited to development
> kernels, as the VM patches in recent 2.2 kernels will testify.

IMHO, and makes lots of sense to start with 2.4. Namely because it will take a
while before 2.4 will be stable, and auditting takes a while too. If an issue
is found, fixed and can be backported to 2.2, all the better. And when people
start switching to 2.4, it will be much more stable, and they will be able to
switch sooner.

The auditting should keep track of the patches applied to 2.4 - "incremental
audits" should result in less work.

And, if you want to educate developers, you better work on a somewhat recent
code base, because otherwise you'll get the "Duh, we replaced that 10 pre
patches ago, don't bother me right now".

Of course, this is just my opinion and what I'll be doing as time permits.

If someone wants to audit 2.2 additionally, all more power to them!

Start whereever you want to, but start.

Sincerely,
    Lars Marowsky-Brée <lmb@suse.de>
    Development HA

-- 
Perfection is our goal, excellence will be tolerated. -- J. Yahl


Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Tue Jun 13 15:32:33 2000
Received: by humbolt.nl.linux.org id <S92339AbQFMNbb>;
	Tue, 13 Jun 2000 15:31:31 +0200
Received: from herd.plethora.net ([205.166.146.1]:31192 "EHLO
        herd.plethora.net") by humbolt.nl.linux.org with ESMTP
	id <S92328AbQFMNav>; Tue, 13 Jun 2000 15:30:51 +0200
Received: from cu.mol.plethora.net (cu.mol.plethora.net [205.166.146.50])
	by herd.plethora.net (8.9.0/8.9.0) with ESMTP id IAA03230;
	Tue, 13 Jun 2000 08:30:43 -0500 (CDT)
Received: from localhost (dante@localhost)
	by cu.mol.plethora.net (8.9.3/8.9.3/Debian 8.9.3-6) with ESMTP id IAA18710;
	Tue, 13 Jun 2000 08:17:11 -0500
Date:   Tue, 13 Jun 2000 08:17:11 -0500 (CDT)
From:   Daniel Taylor <dante@plethora.net>
X-Sender: dante@cu.mol.plethora.net
To:     david+validemail@kalifornia.com
cc:     kernel-audit@nl.linux.org
Subject: Re: root users, etc....
In-Reply-To: <3945C117.BCF2EBA@kalifornia.com>
Message-ID: <Pine.LNX.4.10.10006130815320.18703-100000@cu.mol.plethora.net>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

Not to mention certain individuals who are simply using it in
their name field.  I thought it was kinda funny myself.

Daniel Taylor                Embedded and custom Linux integration.
dante@plethora.net           (612)747-1609

On Mon, 12 Jun 2000, David Ford wrote:

> Jesse Nelson wrote:
> 
> > agreed!, yeah I know I don't add anything to the subject but this kindda chaps my ass.
> >
> > Previously, Adam wrote:
> > > I really don't care what kernel we start with, I just want to start. I am sick
> > > of this bickering, but I can't help but inject my $0.02 worth. What the hell
> > > are people who don't know enough not to use their root accounts with doing on
> > > this email list. No one should ever check their email with a root account, how
> > > dumb are they?
> 
> 'root' is a text identifier and can be associated with any numerical user id.  you'll
> find some people do this as an amusement to toy with people.
> 
> -d
> 
> --
> "The difference between 'involvement' and 'commitment' is like an
> eggs-and-ham breakfast: the chicken was 'involved' - the pig was
> 'committed'."
> 
> 
> 


Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Tue Jun 13 15:36:23 2000
Received: by humbolt.nl.linux.org id <S92347AbQFMNez>;
	Tue, 13 Jun 2000 15:34:55 +0200
Received: from mail1.radix.net ([207.192.128.31]:14321 "EHLO mail1.radix.net")
	by humbolt.nl.linux.org with ESMTP id <S92352AbQFMNeh>;
	Tue, 13 Jun 2000 15:34:37 +0200
Received: from saltmine.radix.net (saltmine.radix.net [207.192.128.40])
	by mail1.radix.net (8.9.3/8.9.3) with ESMTP id JAA17623;
	Tue, 13 Jun 2000 09:34:35 -0400 (EDT)
Received: (from dlc@localhost)
	by saltmine.radix.net (8.8.7/8.8.7) id JAA18004;
	Tue, 13 Jun 2000 09:34:34 -0400 (EDT)
From:   "David L. Craig" <dlc@Radix.Net>
Message-Id: <200006131334.JAA18004@saltmine.radix.net>
Subject: Reflections On Trusting Trust
In-Reply-To: <m131UI2-0012ihC@localhost> from Greg Alexander at "Jun 12, 2000  8:30: 5 am"
To:     galexand@acm.org (Greg Alexander)
Date:   Tue, 13 Jun 2000 09:34:33 -0400 (EDT)
Cc:     kernel-audit@nl.linux.org (Linux Kernel Auditing Project)
Reply-To: kernel-audit@nl.linux.org (Linux Kernel Auditing Project)
Organization: (currently in between situations)
X-Mailer: ELM [version 2.4ME+ PL48 (25)]
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

> >If we are not also auditing the tools that
> >process this code into objects and
> >executables, we're fooling ourselves about
> >kernel security.
> 
> Are you suggesting that gcc has bugs or that
> kernels are compiled with versions of gcc with
> those trojans richie speculated about?

I'm thinking in terms of Ken Thompson's address
"Reflections On Trusting Trust" which can be read
at http://www.acm.org/classics/sep95/.  Auditing
code is one thing, but if binaries are created
using subverted binaries, you get a false sense
of security.  This is not the same as doing code
audits of gcc, et al.  I do not consider this
merely an academic concern.  There are powerful
forces that would like to discredit Linux, that
could mount such an attack.

Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Tue Jun 13 16:32:04 2000
Received: by humbolt.nl.linux.org id <S92340AbQFMOal>;
	Tue, 13 Jun 2000 16:30:41 +0200
Received: from mbunix.mitre.org ([129.83.20.100]:34516 "EHLO
        smtpproxy1.mitre.org") by humbolt.nl.linux.org with ESMTP
	id <S92202AbQFMOaX>; Tue, 13 Jun 2000 16:30:23 +0200
Received: from avsrv1.mitre.org (avsrv1.mitre.org [129.83.20.58])
	by smtpproxy1.mitre.org (8.9.3/8.9.3) with ESMTP id KAA11988
	for <kernel-audit@nl.linux.org>; Tue, 13 Jun 2000 10:30:19 -0400 (EDT)
Received: from MAILHUB2 (mailhub2.mitre.org [129.83.221.18])
	by smtpsrv1.mitre.org (8.9.3/8.9.3) with ESMTP id KAA26111
	for <kernel-audit@nl.linux.org>; Tue, 13 Jun 2000 10:29:03 -0400 (EDT)
Received: from tedk.mitre.org (129.83.38.14) by mailhub2.mitre.org with SMTP
        id 3680687; Tue, 13 Jun 2000 10:30:16 EST
Message-ID: <39464579.BA16852D@mitre.org>
Date:   Tue, 13 Jun 2000 10:30:17 -0400
From:   Ted Knupke <tknupke@mitre.org>
Reply-To: tknupke@mitre.org
Organization: The MITRE Corporation
X-Mailer: Mozilla 4.73 [en] (X11; U; Linux 2.3.47 i686)
X-Accept-Language: en
MIME-Version: 1.0
To:     kernel-audit@nl.linux.org
Subject: Re: work together, but separately :)
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

Scott Bowden wrote:

> OK, there has been a lot of discussion/arguing over what kernel we
should
> audit. I have a novel little idea: lets do all of them! The people who
want
> to work on 2.0.x can do so, as can the people who want to work on
2.2.x ,
> ditto with 2.4.x .
>
> However, at the same time, we should work together. For example, if a
> problem is found in the 2.2.x tree that might still have existed in
2.0.x
> and might still exist in 2.2.x , that saves those two groups from
having
> to find it themselves. Its a pretty simple concept.
>
> How about we stop bickering about which kernel to audit, and get
> auditing? Basically, get the general documentation infrastructure
going,
> and then go with it. Enough arguing already!
>
>   - Scott Bowden

I'll second this idea!   It seems like with the 300+ people already on
this
list, there are more than enough people to audit multiple versions.
(And way too many special interests to ever agree on just one version.)

- Ted Knupke




Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Tue Jun 13 16:51:02 2000
Received: by humbolt.nl.linux.org id <S92328AbQFMOtJ>;
	Tue, 13 Jun 2000 16:49:09 +0200
Received: from shafik-1.dsl.speakeasy.net ([216.254.73.173]:7947 "EHLO
        shafik.net") by humbolt.nl.linux.org with ESMTP id <S92341AbQFMOsg>;
	Tue, 13 Jun 2000 16:48:36 +0200
Received: from localhost (shafik@localhost)
	by shafik.net (8.9.3/8.9.3) with ESMTP id KAA23102
	for <kernel-audit@nl.linux.org>; Tue, 13 Jun 2000 10:44:49 -0400
Date:   Tue, 13 Jun 2000 14:44:49 +0000 (/etc/localtime)
From:   <shafik@shafik.net>
To:     kernel-audit@nl.linux.org
Subject: Re: work together, but separately :)
In-Reply-To: <39464579.BA16852D@mitre.org>
Message-ID: <Pine.LNX.4.10.10006131440440.23077-100000@shafik.net>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

	I really have to agree, maybe we should split into lists
supporting each version of the kernel that people want to work on and one
main list where we just talk about auditing process, tools and
documentation. It would probably go a long way in reducing the mailing
list traffic. 

PS when I say versions I mean 2.2.x, 2.4.x, etc...

On Tue, 13 Jun 2000, Ted Knupke wrote:

> I'll second this idea!   It seems like with the 300+ people already on
> this
> list, there are more than enough people to audit multiple versions.
> (And way too many special interests to ever agree on just one version.)

==========================================================================
--"the more you know and understand the more you must know and understand
   .. knowledge is an unsatiable hunger .. which makes life easier and at
   the same time harder .... knowledge is a paradox w/ no resolution just
   a boundless function of human nature .... knowledge is a trap which we
   embrace and which we run away from .... and in the end the only escape
   is death .... or maybe not "<grin>--
==========================================================================
                     -Unite for Java! - http://www.javalobby.org-
                     -This message transmitted on 100% recycled electrons-
                     -Save the whales, Feed the hungry, Free the mallocs-


Two cats on a roof,
Which one falls off first?
The one with the smaller mew.


Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Tue Jun 13 17:10:42 2000
Received: by humbolt.nl.linux.org id <S92343AbQFMPJg>;
	Tue, 13 Jun 2000 17:09:36 +0200
Received: from tburg.net ([209.47.196.35]:37901 "HELO beast.tburg.net")
	by humbolt.nl.linux.org with SMTP id <S92204AbQFMPJM>;
	Tue, 13 Jun 2000 17:09:12 +0200
Received: (qmail 11278 invoked by uid 1000); 13 Jun 2000 15:09:10 -0000
Date:   Tue, 13 Jun 2000 11:09:10 -0400
From:   Shawn Kohlsmith <asmodeus@beast.tburg.net>
To:     kernel-audit@nl.linux.org
Subject: Re: suggestion
Message-ID: <20000613110910.D11124@beast.tburg.net>
References: <FFDEEF271A0DD311AE63009027454391B3A5BE@zsdat03.vipnet.hr>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
X-Mailer: Mutt 1.0us
In-Reply-To: <FFDEEF271A0DD311AE63009027454391B3A5BE@zsdat03.vipnet.hr>; from r.dejanovic@vipnet.hr on Tue, Jun 13, 2000 at 09:48:18AM +0200
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

On Tue, Jun 13, 2000 at 09:48:18AM +0200, Radoslav Dejanovic wrote:

<snip>
> To cut a long story short - business is one of areas that could benefit
> greatly if the right kernel is audited. 

 Its not as if we'll audit one kernel version and then disband.
Eventually all of the kernel versions will be audited, and as more and
more of the kernel changes have been audited, it will be both easier and
faster to do other versions.

.Shawn



Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Tue Jun 13 17:18:59 2000
Received: by humbolt.nl.linux.org id <S92346AbQFMPRU>;
	Tue, 13 Jun 2000 17:17:20 +0200
Received: from Huntington-Beach.blue-labs.org ([208.179.0.198]:11880 "EHLO
        Huntington-Beach.Blue-Labs.org") by humbolt.nl.linux.org with ESMTP
	id <S92351AbQFMPQr>; Tue, 13 Jun 2000 17:16:47 +0200
Received: from kalifornia.com (david@Huntington-Beach.Blue-Labs.org [208.179.0.198])
	by Huntington-Beach.Blue-Labs.org (8.9.3/8.9.0) with ESMTP id IAA13200
	for <kernel-audit@nl.linux.org>; Tue, 13 Jun 2000 08:16:43 -0700
Message-ID: <39454711.EACF9EA0@kalifornia.com>
Date:   Mon, 12 Jun 2000 13:24:49 -0700
From:   David Ford <david@kalifornia.com>
Reply-To: david+validemail@kalifornia.com
Organization: Talon Technology, Intl.
X-Mailer: Mozilla 4.73 [en] (X11; U; Linux 2.4.0-test1 i686)
X-Accept-Language: en
MIME-Version: 1.0
To:     kernel-audit@nl.linux.org
Subject: Re: suggestion
References: <200006121313.PAA31449@octopus.phy.bg.ac.yu> <3944E9EC.nailDT11POZM@ed.ed>
Content-Type: multipart/mixed;
 boundary="------------BDC380821B35E292AA49577A"
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

This is a multi-part message in MIME format.
--------------BDC380821B35E292AA49577A
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit

root wrote:

> > I  completely  disagree... People  wo  are  concerned with  security  are
> > constantly
> > following and installing the new kernel versions.
>
>  Arguable. You probably have read this somewhere, right?

I can't count how many times I have been safe from an exploit becuase I had
the most current version of BIND, of wu.ftpd, of sendmail, etc.  I think the
best one was the libc resolver.  I always recommend to my clients that they
stay moderately current with their accessible sites.  IIRC, stats gathering
sites such as netcraft show 2.2 kernels as the more predominant Linux kernel.
The most predominant Apache is close to current.  The most predominant wu.ftpd
is close to current.

One of the side effects of keeping up with security patches is that you're
keeping up with current revisioning.


> > People who are still
> > running 2.0.x or any not latest version of kernel and who are lazy to
> > upgrade won't bother to use our patches anyway...
>
>  Absolutely wrong. I'm running 2.0.38, and it's enough for me. I don't want
> new features of  2.2.x or 2.4.x series,  but I want to have  the kernel I'm
> running reviewed.
>  As to patch applicability.... This depends on the patch.

Do keep in mind that patches are also sometimes hard to backport.  The 2.2+
kernels aren't just new features, there are hundreds and hundres of bugs fixed
in them.  Some of this 'review' has already happened by the myriad of
developers who also may have a sense of security.  Believe me, for all the
patches that go into each new revision, there are generally several eyes that
go over them and there is almost always discussion about them.

I work with -every- patch revision that comes out, and I am well aware of the
code flux.  Because of that, I am also aware of bugs that get identified in
the process.  To discount the code flux as 'features' would be foolish.  Most
changes are bug fixes.

If you are running 2.0, then your kernel code has already been touched by
thousands of hands over and over through the years as we've reached 2.4.  My
argument to this is the duplication of effort.  Granted, our list is growing,
but if we start with 2.0, we will -always- be several years behind the current
code.  Being an audit group, our nature is that of a follower but ideally we
should be a close distance behind the lead.

-d

--
"The difference between 'involvement' and 'commitment' is like an
eggs-and-ham breakfast: the chicken was 'involved' - the pig was
'committed'."



--------------BDC380821B35E292AA49577A
Content-Type: text/x-vcard; charset=us-ascii;
 name="david.vcf"
Content-Transfer-Encoding: 7bit
Content-Description: Card for David Ford
Content-Disposition: attachment;
 filename="david.vcf"

begin:vcard 
n:Ford;David
x-mozilla-html:TRUE
org:<img src="http://www.kalifornia.com/images/paradise.jpg">
adr:;;;;;;
version:2.1
email;internet:david@kalifornia.com
title:Blue Labs Developer
x-mozilla-cpt:;28256
fn:David Ford
end:vcard

--------------BDC380821B35E292AA49577A--




Kernel-audit:  discussion list for security and the linux kernel
Archive:       http://mail.nl.linux.org/kernel-audit/

From owner-kernel-audit@nl.linux.org Tue Jun 13 17:21:39 2000
Received: by humbolt.nl.linux.org id <S92349AbQFMPRp>;
	Tue, 13 Jun 2000 17:17:45 +0200
Received: from Huntington-Beach.blue-labs.org ([208.179.0.198]:13416 "EHLO
        Huntington-Beach.Blue-Labs.org") by humbolt.nl.linux.org with ESMTP
	id <S92348AbQFMPRA>; Tue, 13 Jun 2000 17:17:00 +0200
Received: from kalifornia.com (david@Huntington-Beach.Blue-Labs.org [208.179.0.198])
	by Huntington-Beach.Blue-Labs.org (8.9.3/8.9.0) with ESMTP id IAA13210
	for <kernel-audit@nl.linux.org>; Tue, 13 Jun 2000 08:16:52 -0700
Message-ID: <39454FB7.A6A50B35@kalifornia.com>
Date:   Mon, 12 Jun 2000 14:01:43 -0700
From:   David Ford <david@kalifornia.com>
Reply-To: david+validemail@kalifornia.com
Organization: Talon Technology, Intl.
X-Mailer: Mozilla 4.73 [en] (X11; U; Linux 2.4.0-test1 i686)
X-Accept-Language: en
MIME-Version: 1.0
To:     kernel-audit@nl.linux.org
Subject: Re: suggestion
References: <Pine.LNX.4.21.0006121421260.22013-100000@duckman.distro.conectiva>
Content-Type: multipart/mixed;
 boundary="------------47643C467017BEC681F26E17"
Sender: owner-kernel-audit@nl.linux.org
Precedence: bulk
Return-Path: <owner-kernel-audit@nl.linux.org>
X-Orcpt: rfc822;kernel-audit-list

This is a multi-part message in MIME format.
--------------47643C467017BEC681F26E17
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit

Rik van Riel wrote:

> No. The people who cannot code and do not know what they
> are talking about should stop trying to "guide" the people
> who do know what they are talking about.

I think that is well and pointedly said.  An audit team isn't a garden
for fresh young people learning how to write code.  This is not