Re: linux-distros list membership application - CloudLinux

[Igor Seletskiy <i () cloudlinux com>]

> On Sun, Jul 02, 2017 at 05:29:25PM +0300, Igor Seletskiy wrote:
> > We typically have to patch local privilege escalations in kernel asap as
> > our customers are easily rooted using this type of vulnerabilities
> (anyone
> > can buy website or hack old wordpress instance & run any code).
>
> This may be a reason for you to harden your distro's userland against
> local privilege escalations as well, such as by adopting the
> owl-alt-sanitize-env glibc hardening patch maintained by ALT Linux:
>
> http://git.altlinux.org/gears/g/..git?p=glibc.git;a=commitdiff;h=496059f2

Thank you, we will analyze it / test how well it works with 3rd party
software.

> and getting rid of most or all world-accessible SUID programs, which is
> do-able like we have demonstrated with Owl.  This shouldn't be
> unreasonably hard to implement and maintain in a fork of RHEL, although
> obviously you'll end up with more packages (including some core ones)
> that would no longer be mere rebuilds of RHEL's.
All the web applications, end users ssh sessions and cron jobs are executed
in
namespaced / chrooted environment with no SUID files accessible already.
We cannot completely get rid of SUID scripts as they are used by 3rd party
software (like cPanel/Plesk) that is used on most of customer's servers.
It is not perfect, but the best we were able to do so far.


Thank you for the advise,
Igor.