Changes between Initial Version and Version 1 of Ticket #88


Ignore:
Timestamp:
01/27/09 20:02:23 (16 years ago)
Author:
broder
Comment:

We've disabled local logins for all Athena accounts, so this is no longer a security concern.

Also, grsec is dying, so we need another way to lock down chroots.

Legend:

Unmodified
Added
Removed
Modified

  • Ticket #88

    • Property Priority changed from critical to low
    • Property Type changed from defect to enhancement
    • Property Summary changed from Install grsecurity on debuild.mit.edu to Lock down chroots on debuild.mit.edu

  • Ticket #88 – Description

    initial v1  
    1 We should install a grsecurity kernel on debuild.mit.edu. 
     1We should find a mechanism to lock down chroots on debuild.mit.edu. 
     2 
     3Users need to become root within the build chroots to install packages. Normally, chrooting isn't considered a security mechanism, and so by design it's possible for root to escape from a chroot, meaning that any user who has root within the build chroot can potentially acquire root outside of the chroot. 
     4 
     5This is a blocker for any sort of setup where debuild.mit.edu is open to the community.