Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Why is the:

http://www.openbsd.org/cgi-bin/man.cgi?query=systrace&sektion=4

Systrace marked as insecure?

Can someone explain the "why"?

share|improve this question

2 Answers 2

up vote 2 down vote accepted

This was based on a paper presented at the USENIX conference entitled "“Exploiting Concurrency Vulnerabilities in System Call Wrappers"

According to the author in a blog post:

The key insight here is that the historic assumption of “atomicity” of system calls is falacious, and that on both uniprocessor and multiprocessing systems, it is trivial to construct a race between system call wrappers and malicious user processes to bypass protections. I demonstrated sample exploit code against the Sysjail policy on Systrace, and IDwrappers on GSWTK, but the paper includes a more extensive discussion including vulnerabilities in sudo’s Systrace monitor mode."

Even though it may be trivial to bypass the system call wrapping, I'm not sure whether other protections (for example on directories, files, URLs, etc.) that are wrapped are also affected. I'm also not sure how much damage these malicious processes can do if they are forced to have race conditions with the system calls. Maybe someone who understands this better can clarify it.

share|improve this answer
    
USENIX WOOT07, Exploiting Concurrency Vulnerabilities in System Call Wrappers, and the Evil Genius –  gasko peter Oct 12 '12 at 4:58
    
August 6th, 2007 at 20:33 UTC by Robert N. M. Watson –  gasko peter Oct 12 '12 at 5:00

I did not find anything on that page that describes Systrace as insecure.

Systrace was the result of groundbreaking research, described here:

Later research reported vulnerabilities in system call monitoring tools (including Systrace):

I do not know the status of those vulnerabilities. I don't know whether Systrace has been patched to defend against those attacks.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.