[rsbac] Urgent Security Bugfix 1.2.4-2

[Amon Ott]

 RSBAC Security Bugfix v1.2.4-2 has been released! Urgency is high for 
2.4 kernels - please apply ASAP, if you run v1.2.4 on 2.4.29! A 
similar bugfix for v1.2.3 on 2.4 kernels will follow ASAP.

2. General/Kernels 2.4.29 and 2.6.10: Missing RSBAC interceptions for 
sys_sysctl

    * Urgency: High (2.4.29) / Low (2.6.10).
    * What you see: Processes with sufficient Linux rights can read 
(2.4 and 2.6) and write (2.4) sysctl settings through sys_sysctl.
    * What is wrong: The syscall sys_sysctl is not intercepted, 
although the proc interface at /proc/sys/ is.
    * Implications: Under 2.4 kernel, encapsulated daemons running as 
root or with additional Linux capabilities can change important 
system settings. Specially kernel.modprobe controls, which binary is 
run by the kernel with root rights when trying to access a not 
existing device. Under 2.4 and 2.6 kernels, these system settings can 
be read without control.
    * Credits: Thanks to Brad Sprengler for hinting at sys_sysctl.
    * RSBAC versions affected: All versions up to 1.2.4.
    * What you should do: Apply the bugfix for kernel 2.4 (MD5 / GnuPG 
Cert) or 2.6 (MD5 / GnuPG Cert) to get the bug corrected, recompile 
the kernel and the admin tools, reinstall and reboot. Adjust RC and 
ACL model settings to allow GET_STATUS_DATA on target SCD other where 
appropiate.

Amon.
-- 
http://www.rsbac.org - GnuPG: 2048g/5DEAAA30 2002-10-22
-------------- nächster Teil --------------
Ein Dateianhang mit Binärdaten wurde abgetrennt...
Dateiname   : rsbac-bugfix-v1.2.4-2-2.4.diff
Dateityp    : text/x-diff
Dateigröße  : 11224 bytes
Beschreibung: nicht verfügbar
URL         : http://www.rsbac.org/pipermail/rsbac/attachments/20050223/651d4536/rsbac-bugfix-v1.2.4-2-2.4.bin
-------------- nächster Teil --------------
Ein Dateianhang mit Binärdaten wurde abgetrennt...
Dateiname   : rsbac-bugfix-v1.2.4-2-2.6.diff
Dateityp    : text/x-diff
Dateigröße  : 6916 bytes
Beschreibung: nicht verfügbar
URL         : http://www.rsbac.org/pipermail/rsbac/attachments/20050223/651d4536/rsbac-bugfix-v1.2.4-2-2.6.bin
-------------- nächster Teil --------------
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.5 (GNU/Linux)

iD8DBQBCHHW6q9yn6h5RTo8RAoSfAJ9FNESQAIrdJ2fcX/wbp82m9po+mgCggmQW
YxQ6S+WMHoDmOBYWYWUEAVA=
=tCDT
-----END PGP SIGNATURE-----
-------------- nächster Teil --------------
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.5 (GNU/Linux)

iD8DBQBCHHW6q9yn6h5RTo8RAhbxAJ9ongV+v+8zsgiOqhih6nRvHs0YWACeInYQ
GZLukEiJqxlknsAIkhYep3E=
=pAXS
-----END PGP SIGNATURE-----
-------------- nächster Teil --------------
a3d94ab6c667ff8f3e02a69f39ef8d5c  rsbac-bugfix-v1.2.4-2-2.4.diff
-------------- nächster Teil --------------
c2bc0f57f6e8824687c171f741f00510  rsbac-bugfix-v1.2.4-2-2.6.diff