Re: CVE-2015-3243 rsyslog: some log files are created world-readable

[Nick Boyce <nick.boyce () gmail com>]

[hopefully non-OT post of possibly questionable value, coming as it
does from a relatively Un*x-naive refugee from the land of mainframes
[1]]

On 18 June 2015 at 18:56, Kurt Seifried <kseifried () redhat com> wrote:
> So /var/log/cron is world readable in RHEL7
> which means the complete command line is
> logged (so --password=, hostnames, etc.).
>
> In line with this I have made the following
> proposed change for Fedora (and by
> extensions Red Hat products):
[...]
> All configuration files (e.g. files in /etc/) and all
> log files (e.g. files in /var/log/) must not be set
> world-readable unless there is a functional
> reason to do so.

Basically +million ...
I've always been faintly horrified by how much of the Un*x system
configuration detail is readable by just about any user of the system,
though I accept that my opinion is compromised by my industrial
upbringing, and also that security-through-obscurity is, um .....

I queried this situation a long time ago for Debian [2] (locking down
hosts.allow caused problems), and asked similar questions of the
manufacturer's tech support personnel for both Digital Unix and HPUX -
 but in the fluffy world of Un*x, where by default the user was
considered non-adversarial (and in the case of workstations was
usually the owner of the system anyway), nobody was very interested.

Authorisation tokens are not the only relevant sensitive content -
this list knows that all kinds of data can be useful to an attacker,
but Back In The Day paranoia levels were low.

I'd really like to see this situation revisited (perhaps now is a
better moment), but clearly the codebase would need a lot of scrutiny
for potential consequent problems.

[1] No, not IBM mainframes - proper mainframes :-)
https://en.wikipedia.org/wiki/ICL_VME
Here, mandatory access control pervaded the whole system, and user
accounts were only ever given any access to a resource if they
absolutely needed it. This operating system actually achieved Common
Criteria certification (in the early '90s).

[2] https://lists.debian.org/debian-security/2002/08/msg00356.html

Cheers,
Nick