Automated Response
Programming Guidelines
This program should only run with a privileged effective uid when performing an operation that requires privilege and should run with the nonprivileged ids uid as the effective uid at all other times, a method called “privilege bracketing”. See the setresuid (2) manpage for how to toggle the effective uid.
•Solution C
Write a single, privileged setuid C executable program which merely forks and execs an unprivileged shell script that both processes the alert string and performs privileged operations. See “Solution C” on page 193.
The privileged C program must hard code the full path name of the unprivileged script (i.e., it should not execute the path name of a program specified through one of its program arguments, as this would allow the execution of an arbitrary program with privilege).
Solution A is the most secure solution because it implements clear separation of privilege. Solution B is as secure as Solution A if the privilege bracketing is done correctly. Although not as secure as Solutions A and B, Solution C is the easiest to implement and is not subject to the vulnerability of privileged setuid shell scripts.
Code Examples
The following code examples for solutions A, B, and C demonstrate how to terminate a process that you do not own.
NOTE | The pathnames below are suggested places to store the files. For security reasons, they |
| are not delivered as part of the HIDS software. |
|
|
Solution A
/opt/ids/response/scriptA.sh
A
/opt/ids/response/misc
A directory with mode 500 and owned by ids:ids.
/opt/ids/response/misc/privA
A
Code for scriptA.sh
#!/usr/bin/sh
##Sample
##Stop a process which has performed an intrusive activity. RESPONSE_BASE=$IDS_BASE/response
RECIPIENT=”root”
#Setting the umask to a “sane” value umask 077
#If we have a file modification alert if [ $1 = “2” ]
Appendix B | 191 |
