Ubuntu Wiki

Jaunty

Hardened Compiler Flags

• Continue building more of the archive with the new CompilerFlags, as originally detailed in the HardeningWrapper documentation.

Blueprints

• https://blueprints.launchpad.net/ubuntu/+spec/jaunty-security-defaults

  • SHA512 Status: done

  • SYN-flood protection Status: done

  • Dovecot AppArmor profile Status: delayed -- need to integrate postfix too

  • dhclient AppArmor profile Status: done

  • Squid AppArmor profile Status: delayed -- needs more investigation

  • dhcpd AppArmor profile Status: done

  • firefox template AppArmor profile Status: started

  • ufw installer integration (debconf/preseeding only) Status: done (needs 0.27 for everything, but 0.26-0ubuntu1 has enable with common services)

• https://blueprints.launchpad.net/ubuntu/+spec/use-pae-when-possible

  • have installer choose -server when hardware is PAE-capable (perhaps rename -server kernel to something that doesn't seem strange to desktop users).
  • related bugs:

    • https://launchpad.net/bugs/75157

    • https://launchpad.net/bugs/151942

  • Status: implementing via drop of i386 -server in J+1

• https://blueprints.launchpad.net/ubuntu/+spec/64bit-pie-by-default

  • Status: delayed

Documentation

• The Security Team FAQ needs to be filled with answers to the various questions Ubuntu gets about security.

• The Security Team KnowledgeBase need more to be written. Many ideas have already been listed there.

Investigations

Several ideas for possible work come from investigating existing the installed set of packages.

• setuid: which programs are setuid and what may be needed to improve them.

• possibly other good ideas from brainstorm see : http://brainstorm.ubuntu.com/security/

Unscheduled Wishlist Items

This area can be used to list ideas for future security work, or link to bugs that describe "Wishlist" issues.

• get default Private home directory set up, even if ecryptfs not in use:

  • https://launchpad.net/bugs/353231

• switch (with backward compat) to filesystem capabilities:

  • http://marc.info/?l=linux-security-module&m=123852689416478&w=2

• find origin of random "screen does not lock" bugs:

  • https://bugs.launchpad.net/bugs/283315 (KDE)

  • https://bugs.launchpad.net/bugs/291712 (KDE)

  • https://bugs.launchpad.net/bugs/296085 (KDE)

  • https://bugs.launchpad.net/bugs/326721 (KDE)

  • https://bugs.launchpad.net/bugs/317995 (Gnome)

  • https://bugs.launchpad.net/bugs/344803 (Gnome)

  • https://bugs.launchpad.net/bugs/338057 (Gnome)

  • https://bugs.launchpad.net/bugs/345026 (Gnome)

  • https://bugs.launchpad.net/bugs/353460 (Gnome)

  • https://bugs.launchpad.net/bugs/349427 (XFCE)

  • https://bugs.launchpad.net/bugs/316907 (LXDE)

• block execution of things lacking execute bit:

  • .desktop

  • .exe

  • .jar

• investigate soft nx patch (last remaining execshield feature not in mainline yet)

  • http://cvs.fedora.redhat.com/viewcvs/devel/kernel/linux-2.6-execshield.patch?root=extras&view=log

• non-exec stack bugs (there are still some programs that have executable stack regions). doing this is only useful when either softnx or PAE-nx are used on 32bit, since 64bit already defaults to a non-exec stack.

  • https://bugs.launchpad.net/ubuntu/+bugs?field.tag=execstack

  • "readelf -l $BIN" shows GNU_STACK with "E".

  • Gentoo write-up of what to do: http://www.gentoo.org/proj/en/hardened/gnu-stack.xml

  • Get Fedora patches upstream where they belong

    • http://cvs.fedoraproject.org/viewcvs/devel/bogl/bogl-0.1.18-noexecstack.patch?view=markup

    • http://cvs.fedoraproject.org/viewcvs/devel/gdk-pixbuf/gtk+-2.2.2-noexecstack.patch?view=markup

    • http://cvs.fedoraproject.org/viewcvs/devel/libdv/libdv-0.104-no-exec-stack.patch?view=markup

    • http://cvs.fedoraproject.org/viewcvs/devel/lightning/lightning-1.2-execstack.patch?view=markup

    • http://cvs.fedoraproject.org/viewcvs/devel/net-tools/net-tools-1.60-execshield.patch?view=markup

    • http://cvs.fedoraproject.org/viewcvs/devel/net-tools/netplug-1.2.9-execshield.patch?view=markup

    • http://cvs.fedoraproject.org/viewcvs/devel/ocaml/ocaml-3.11-dev12-no-executable-stack.patch?view=markup

    • http://cvs.fedoraproject.org/viewcvs/devel/qimageblitz/qimageblitz-0.0.4-noexecstack.patch?view=markup

    • http://cvs.fedoraproject.org/viewcvs/devel/zip/exec-shield.patch?view=markup

    • http://cvs.fedoraproject.org/viewcvs/devel/mlton/mlton-20070826-no-execmem.patch?view=markup

• more profiles added to apparmor-profiles
• look into chrooted-packages (as in apt-get install apache-chroot). Special attention on virtual hosting, updating and adding packages and modules. Another option would be to develop an apparmor profile and/or selinux policy.
• Modify debsecan package to grab CVE reports from USN

• Extract useful /Grsecurity patches for the kernel.

• Modify apt-listbugs package to check package CVE's from USN.
• Improved use of cryptography integrated well with Ubuntu
  • Encrypted swap by default on all installations
  • eCryptfs + SELinux/AppArmor integration, to protect encrypted data from root
• Sweeping, static analysis of all of main (then universe)

  • something like bogosec (http://bogosec.sourceforge.net/) to provide numeric source code quality metrics, track over time, use for code review

• Security Certification / Documentation
  • IBM presentation on work it did certifying RHEL/SLES, stresses open sourced efforts:

    • http://download.boulder.ibm.com/ibmdl/pub/software/dw/library/os-ltc-standards/LWE-Boston-06.pdf

    • http://www-128.ibm.com/developerworks/linux/library/os-ltc-security/

  • RHEL High Level Design document, rewrite for Ubuntu?

    • http://download.boulder.ibm.com/ibmdl/pub/software/dw/library/os-ltc-security/RHEL-4-HL-V2.13.pdf

• Implement more useful SAK that does not kill a running X server/session (Secure Attention Key: http://kernel.ubuntu.com/git?p=ubuntu/ubuntu-hardy.git;a=blob;f=Documentation/SAK.txt;hb=HEAD). The current SAK implementation closes everything that has /dev/console open, including entire tty7 (graphical display), while the Windows implementation is more useful because there is an option to require Ctrl-Alt-Del prior to entering any log on password (initial log on, re-log on after returning from screensaver, etc.).

Not Interested

• hardened default config (Bastille-like). Check the compatibility of debian-bastille. Status: reviewed. what can be done in a default install is already being done

CategorySecurityTeam