Exclusive binary files

[Max Laier]

On Saturday 01 September 2007, Klaus Schneider wrote:
> Hi.
>
> Well, anybody know a way to make the FreeBSD run just binaries that I
> have compiled?
>
> For example:
> A hacker get a access to a shell into my server, and then it put a
> exploit code, but on the machine don't have a compiler, then he tries
> to put the compiled exploit... supose that I can't mount the users
> partition in "noexec" mode...
>
> Anybode knows a solution for these?

IIRC csjp@ had some code to do this inside the MAC framework.  Storing 
hashes in extended attributes and only allowing execution of signed 
executables ... 
http://perforce.freebsd.org/fileLogView.cgi?FSPC=//depot/projects/trustedbsd/mac/sys/security/mac%5fchkexec/mac%5fchkexec.c ... 
not sure what became of it, though.

-- 
/"\  Best regards,                      | mlaier at freebsd.org
\ /  Max Laier                          | ICQ #67774661
 X   http://pf4freebsd.love2party.net/  | mlaier at EFnet
/ \  ASCII Ribbon Campaign              | Against HTML Mail and News
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 187 bytes
Desc: This is a digitally signed message part.
Url : http://lists.freebsd.org/pipermail/freebsd-hackers/attachments/20070902/acfd4650/attachment.pgp