kernel module for chmod restrictions while in securelevel one or higher

[Selphie Keller]

Kernel module for chmod restrictions while in securelevel one or higher:
http://gist.github.com/501800 (fbsd 8.x)

Was looking at the new recent sendfile/mbuf exploit and it was using a
shellcode that calls chmod syscall to make a setuid/setgid binary. However
was thinking of ways to block the creation of suid/sgid binaries if the
machine is in a securelevel, beyond the normal things like nosuid/noexec
mount flags for /tmp.

So came up with this quick module to handle it, but the concept of
restricting the creation of suid/sgid binaries while in securelevel seems
like a good idea to be part of the base. 

 

-Estella Mystagic