How not to run a CA

Re:How not to run a CA by technion on Friday March 02, 2018 @04:10AM (#16500118)

Whilst I do wish I could cleanse a web application of actually supporting system(), we have system() in Perl, Ruby, Python, and modules for Node. I've seen people bagging PHP and that really isn't fair.

Shower thought: Allow me to globally disable system() in for language x. Aside from the obvious case of just banning these insane system calls, you're protected against surprise vectors in parsers.

Edit: You would presumably mitigate pipe open vulnerabilities too

[ Parent | on HN ]

Re:How not to run a CA by tetha on Friday March 02, 2018 @09:08AM (#16501419)

You can do so with SELinux btw. You can remove the right for a program to run the exec syscall.

It's just sad that there is no really good tutorial how to write your own SELinux modules for your own applications. It's easier than it seems and allows some really powerful security measures.

[ Parent | on HN ]

Re:How not to run a CA by hultner on Friday March 02, 2018 @06:24PM (#16506689)

Maybe you could write one? I bet that it would be really appreciated.

[ Parent | on HN ]

Re:How not to run a CA by eequah9L on Friday March 02, 2018 @05:05AM (#16500320)

I suspect that these languages just end up deferring to the system() library function in libc. LD_PRELOAD or other linker trick would then let you override it with a do-nothing or complain-loudly replacement.

[ Parent | on HN ]

Re:How not to run a CA by __david__ on Friday March 02, 2018 @12:33PM (#16503711)

All of those languages have an option to pass in arguments as an array and bypass the shell completely. PHP does not. It's much safer with no shell (though not perfect).

[ Parent | on HN ]