danwalsh ([info]danwalsh) wrote,
@ 2008-04-05 11:18:00
Previous Entry  Add to memories!  Tell a Friend!  Next Entry
Dear Oracle,
I would advise you that it is never a good idea to advise your customers to turn off a fundamental security software component of the operating system, so that your broken code can run.

http://download.oracle.com/docs/cd/B28359_01/relnotes.111/b32001/toc.htm

You have written PHP scripts that require the use of executable memory, a chief mechanism for crackers to attack systems.  In order to have your PHP to work, you advise your customers to turn off SELinux enforcing mode, I guess this is better then tell customers to just shut it off all together.

If you investigated this at all you had two other options. 

1.  Fix your code,  Read SELinux Memory Protection Tests ,  Uli has some good suggestions on how this can be done.
2.  You could ship a policy package, which your customers could download to turn off the memory checking for apache while your coders fix their bugs, then only apache would be vulnerable, not the entire system.  BTW You could generate the policy package by executing

# grep http /var/log/audit/audit.log | audit2allow -M oraclebufferoverflowallow

This will generate the oraclebufferoverflowallow.pp package.  Which you can then ask your customers to download and install

semodule -i oraclebufferoverflowallow.pp

When you fix your bugs, they can execute

semodule -r oraclebufferoverflowallow

Your friend,

Dan



(Post a new comment)

Dear Red Hat,
[info]jds2001
2008-04-05 04:27 pm UTC (link)
Please take your own advice:

http://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.1.0/html/Installation_Guide/s1-requirements-software.html

(admittedly, based on busted Oracle software, but still....)

Your friend,
Jon

(Reply to this) (Thread)

Re: Dear Red Hat,
(Anonymous)
2008-04-05 10:23 pm UTC (link)
Perhaps because RHN Satellite use Oracle :
http://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.1.0/html/Installation_Guide/s1-requirements-database.html

Please Red Hat, use PostgreSQL (or any free database software).

(Reply to this) (Parent)

to report a bug to Oracle? forget it
(Anonymous)
2008-04-06 02:58 pm UTC (link)
To report a bug to oracle is the biggest headache. We will never do that. We have had enough with perl (5.8.X) module DBD::ORACLE and ora10g on HPUX.

(Reply to this) (Thread)

Re: to report a bug to Oracle? forget it
(Anonymous)
2008-04-06 03:03 pm UTC (link)
Dan, Great job, fun reading your blog and learning too. Thanks a lot.

(Reply to this) (Parent)


[info]smystery
2008-07-27 02:53 pm UTC (link)
this is good for my knowledge thanks for link : SELinux Memory Protection Tests

Regards
Smystery



______________________________________________________________________________

Possibly related posts:
- bricosoft computer and software
-
seo freedom
-
seo challenge
-
books for the richer and professional

(Reply to this)


Create an Account
Forgot your login or password?
Login w/ OpenID
English • Español • Deutsch • Русский…