FileBuzz: Software Download
Find shareware, freeware downloads from thousands of software titles

Program Name: Openwall Linux kernel

License Type: Freeware

Date Released: September 11, 2013

Openwall Linux kernel vpatch Instant Download

Openwall Linux kernel Desciption:

A collection of security-related features for the Linux kernel


Openwall Linux kernel patch is a collection of security-related features for the Linux kernel, all configurable via the new 'Security options' configuration section. In addition to the new features, some versions of the patch contain various security fixes.The number of such fixes changes from version to version, as some are becoming obsolete (such as because of the same problem getting fixed with a new kernel release), while other security issues are discovered.Non-executable user stack area.Most buffer overflow exploits are based on overwriting a function's return address on the stack to point to some arbitrary code, which is also put onto the stack. If the stack area is non-executable, buffer overflow vulnerabilities become harder to exploit.Another way to exploit a buffer overflow is to point the return address to a function in libc, usually system(). This patch also changes the default address that shared libraries are mmap()'ed at to make it always contain a zero byte. This makes it impossible to specify any more data (parameters to the function, or more copies of the return address when filling with a pattern), -- in many exploits that have to do with ASCIIZ strings.However, note that this patch is by no means a complete solution, it just adds an extra layer of security. Many buffer overflow vulnerabilities will remain exploitable a more complicated way, and some will even remain unaffected by the patch. The reason for using such a patch is to protect against some of the buffer overflow vulnerabilities that are yet unknown.Also, note that some buffer overflows can be used for denial of service attacks (usually in non-respawning daemons and network clients). A patch like this cannot do anything against that.It is important that you fix vulnerabilities as soon as they become known, even if you're using the patch. The same applies to other features of the patch (discussed below) and their corresponding vulnerabilities.Restricted links in /tmp.I've also added a link-in-+t restriction, originally for Linux 2.0 only, by Andrew Tridgell. I've updated it to prevent from using a hard link in an attack instead, by not allowing regular users to create hard links to files they don't own, unless they could read and write the file (due to group permissions). This is usually the desired behavior anyway, since otherwise users couldn't remove such links they've just created in a +t directory (unfortunately, this is still possible for group-writable files) and because of disk quotas.Unfortunately, this may break existing applications.Restricted FIFOs in /tmp.In addition to restricting links, you might also want to restrict writes into untrusted FIFOs (named pipes), to make data spoofing attacks harder. Enabling this option disallows writing into FIFOs not owned by the user in +t directories, unless the owner is the same as that of the directory or the FIFO is opened without the O_CREAT flag.Restricted /proc.This was originally a patch by route that only changed the permissions on some directories in /proc, so you had to be root to access them. Then there were similar patches by others. I found them all quite unusable for my purposes, on a system where I wanted several admins to be able to see all the processes, etc, without having to su root (or use sudo) each time. So I had to create my own patch that I include here.This option restricts the permissions on /proc so that non-root users can see their own processes only, and nothing about active network connections, unless they're in a special group. This group's id is specified via the gid= mount option, and is 0 by default. (Note: if you're using identd, you will need to edit the inetd.conf line to run identd as this special group.) Also, this disables dmesg(8) for the users. You might want to use this on an ISP shell server where privacy is an issue. Note that these extra restrictions can be trivially bypassed with physical access (without having to reboot).When using this part of the patch, most programs (ps, top, who) work as desired -- they only show the processes of this user (unless root or in the special group, or running with the relevant capabilities on 2.2+), and don't complain they can't access others. However, there's a known problem with w(1) in recent versions of procps, so you should apply the included patch to procps if this applies to you.

License: Freeware | Price: $0.00 | Size: 41 KB | Downloads (107)

Platform: Linux

Related Software
New Reviews
New Downloads Top Downloads Top Search

New Downloads

PhotoPad Photo Editor Free
BuzzBundle Enterprise
Network LookOut Administrator Pro
ISO Workshop
Joyoshare Video Converter for Windows
Joyoshare Video Converter for Mac
DVDFab Ripper Suite
Joyoshare Media Cutter for Mac
AllMyNotes Organizer Deluxe Edition
Easy Duplicate File Finder for Mac
Miraplacid Publisher
C-Organizer Lite
SEO PowerSuite
Joyoshare Screen Recorder for Windows
Joyoshare Screen Recorder for Mac
Bandicut Video Cutter
Joyoshare Media Cutter for Windows
Easy Duplicate File Finder
Webcam Simulator
DVDFab Copy Suite
VyprVPN for Windows
WinX MediaTrans
StarCode Network Plus POS and Inventory
Joyoshare HEIC Converter for Windows

Top Downloads

Opera Mini
Turbo C++
Abyss Web Server X1
TaskMerlin Project Management Software
Macrorit Disk Partition Expert Server Edition
Foxit Advanced PDF Editor
Kids Online Browser
Rapid PHP Editor
Cleanup and Update Tool for Cisco CUCM
Open-School Community Edition
Count Code
Daniel Drubin Access Control Suite
simplitec simplisafe
Multi-Process Killer Portable
SCEA Part 2 & 3 Exam EPractize Labs Enterprise
Silva 2.1a2
Agama Web Menus
aXmag Free
Flash Player Pro
Red Call Recorder
Syston Data Recovery Free
Photo! 3D Album

Top Search

Pire Linux Kernel
Pure Linux Kernel
Linux Kernel Bin Editor
Linux Kernel
Make Demo Programs For Linux Kernel
Linux Kernel Jobs
Mobile Linux Kernel
Dvb T Linux Kernel
Linux Data Kernel
Run Nucleus Kernel Linux On Live Cd
Music Catalog Linux
Anti Filter Proxy Iran For Linux
Linux Mib Browser
Iso Buster Linux
Back Dvd Recovery For Linux
Linux Intercom System
Dwg View In Linux
C Program Files In Linux
Joining Jpg Linux
Visual Source Safe For Linux
Linux Phone Video Browser
Linux Fedora Players
Linux Windows Like File Manager
Linux Hard Drive Hex Edit
Linux Avi Converter For Mobile