Comments on: lockdown and the di-semi-default route

By: Ilya

Ilya — Mon, 01 Oct 2007 14:47:32 +0000

Regarding finding the route through which the VPN is reached, you should probably check what “ip route get 1.2.3.4″ does and do the same. It might work just as you do, by manually evaluating the routing rules in userspace, but perhaps it does something smarter, taking the more-complex routing options into account.

By: M Welinder

M Welinder — Mon, 01 Oct 2007 13:26:36 +0000

If you want to isolate a process, you also need to make
sure it cannot attach as a debugger to any process
outside the jail.

By: blah

blah — Mon, 01 Oct 2007 12:15:21 +0000

desrt: Also, on systems like Debian you can set the metric for each interface explicitly by using the “metric” stanza in /etc/network/interfaces.

And there is this nifty tool called “ifmetric” which modifies all current routes on a specific interface to a certain value.

By: blah

blah — Mon, 01 Oct 2007 12:13:25 +0000

desrt: On Linux routing metrics can be negative!

By: Stef Walter

Stef Walter — Mon, 01 Oct 2007 05:52:45 +0000

di-semi-default route I never thought of that. Learned something handy today.

By: desrt

desrt — Mon, 01 Oct 2007 00:32:08 +0000

blah: the problem with using route metrics is that in almost every case ever the default route already has metric 0 :(

By: blah

blah — Mon, 01 Oct 2007 00:27:45 +0000

Dude, that routing stuff you are suggesting is pure crack!

Use route metrics for this! That way you may have multiple default routes, and can specify which one is the higher priority one. It’s easy-to-use and actually invinted for cases like this one.

By: blah

blah — Mon, 01 Oct 2007 00:24:13 +0000

You might also want to set setrlimit(RLIMIT_FSIZE) to 0. That way, a process can no longer create any files on disk anymore.

Also, consider setting RLIMIT_NOFILE to your highest fd+1. That way, the process may not create any further file descriptors.

Just paranoia, though.

By: Matthew W. S. Bell

Matthew W. S. Bell — Sun, 30 Sep 2007 23:31:14 +0000

This feels like badness to me

By: desrt

desrt — Sun, 30 Sep 2007 21:51:11 +0000

craig: i didn’t consider this problem.

i think the only reasonable thing to do here is to query the route table to see what route will match the ip of the vpn server. if it is the default route, then add another rule — if not, then do nothing.

thanks for the note. i was so excited about the other part that i didn’t give this part due consideration. i now have something to think about :)