|
|
| (78 intermediate revisions by 14 users not shown) |
| Line 1: |
Line 1: |
| {{Admon/warning | Document is Final | The contents of this beat have been sent for translation for the GA version of the Release Notes. Any additional changes to this beat will not appear until after the release of Fedora 12. If you have zero-day changes, be sure to post a bug. }} | | {{header|docs}}{{Docs_beat_open}} |
| | | [[Category:Docs Project]] |
| == Security ==
| | [[Category:Draft documentation]] |
| | | [[Category:Documentation beats]] |
| This section highlights various security items from Fedora.
| |
| | |
| === Lower Process Capabilities ===
| |
| | |
| Daemons running as root have been reviewed and patched to run with lower process capabilities. This reduces the desirability of using these daemons for privilege escalation. Additionally, the shadow file permissions have been changed to 000 and several directories in $PATH have been set to 555 in order to prevent daemons without DAC_OVERRIDE from being able to access the shadow file or write to the $PATH directories.
| |
| | |
| When someone attacks a system, they normally can't do much unless they can escalate privileges. What this feature will do is reduce the number of attack targets that can be used to escalate privileges. If root processes do not have all capabilities, they will be harder to use to subvert the system.
| |
| | |
| But if some does successfully attack a root process, can steps be taken to render it hard to take advantage of? The answer is yes. Processes with the root uid can still damage a system. This is because they can write to nearly any file and of course read the /etc/shadow file. But if we harden the system so that root requires the DAC_OVERRIDE capability, then only a limited number of processes can damage the system. This won't affect any admin abilities because they always get full privileges which includes DAC_OVERRIDE.
| |
| | |
| A hardened system would have permissions like: 555 /bin, 555 /lib, 000 /etc/shadow and so on. The current scope is to cover the directories in $PATH variable, library dirs, /boot, and /root. This scheme does not affect selinux in any way and complements it since capabilities are DAC controls and they have first vote on allowing an access.
| |
