Stephanie: OpenBSD hardening -- New version for OpenBSD 3.1
-----------------------------------------------------------
Stephanie is a series of kernel and userland patches, and userland 
interfaces the respective kernel patches, that add another layer of 
security to OpenBSD.

After seeing the relatively good feedback on Stephanie for OpenBSD 2.8, 
2.9, and 3.0, I decided to take the next version one step ahead and add 
some features.

The current features of Stephanie are:

	* Trusted Path Execution
	* Basic privacy patches -- untrusted users can get information 
	  from /dev/kmem only about processes they own
	* ld.so environment stripping -- untrusted users get their ld 
	  environment variables stripped (LD_LIBRARY_PATH and LD_PRELOAD)
	* Restricted symlinks -- a la OpenWall (openwall.com)
	* Binary integrity verification -- Verification of the MD5 
	  checksum of binaries in realtime (to prevent trojan horses, etc.)
	* Realtime logging of execve() calls to track executed files

The trusted path execution patches mean that untrusted users can no longer 
download an exploit, compile, and run it on your system. The trusted path 
patches nuke the 'running' part: Only programs in root-owned directories 
where the writing permission is NOT set for group and other can be run.

The basic privacy patches prevent from users seeing information about 
processes they don't own. This means that programs like 'ps' and 'w' won't 
show information about processes the user running them doesn't own, unless 
of course he's in the trust list. Note that the privacy changes to not 
apply to programs such as 'netstat' etc.

The ld.so environment stripping patch prevent from 'ld' loading
environment variables that can potentially contain malicious content.

Restricted symlinks -- look at openwall.com for details.

Binary integrity verification is a new feature. It's something that should 
have been in the 3.0 version, but it came out that it had to wait for the 
3.1 release. What it does is verify the MD5 checksums of binaries you run 
against an in-kernel database of checksums loaded during bootstrap. Read 
more about its design and operation in DESIGN.k5 and README.k5.

The last feature, execve() logging, is a little bonus. This is something I 
noticed was kinda needed by a lot of people, so I thought why not just add 
it to Stephanie. It's very flexible and fast, so execution time don't 
degrade too much if you're using it.

The keyword for the new Stephanie package is 'flexability': You can choose 
which options to install (or not) via a small set of kernel options. 
General options are:

	* TPE: Trusted Path Execution
	* K5: Binary integrity verification
	* SNEEK: execve() logging
	* PRIVACY: The privacy patch
	* SYMLINKS: Restricted symbolic links
	* LDSTRIP: ld.so environment variables stripping

Please notice that ld.so stripping requires changes to the userland 
ld (/usr/src/gnu/usr.bin/ld/rtld/) aswell.

Stephanie's new design also makes the trust list global rather than 
storing it in the TPE sources, making it possible to have the privacy 
patches (for example) using the trust list without installing the TPE 
patches, and vice versa. Having the ACL global also means that you add ACL 
capability to any part of the kernel. Just '#include <sys/kern_acl.h>' and 
the basic macro line is 'if (!TRUSTED_USER(uid))'. You need to tweak a 
little the kernel config files (sys/conf/files) to include the ACL 
sources, etc.. -- But if you're doing kernel development you'll figure it 
out real quick.

The binary verification feature has sub-options -- you can read more 
about them, in README.k5.

Most features have userland agents to control their operation. Please read 
the manuals for the ones you are going to use prior to using them. :)

All of the code in this distribution of Stephanie falls under the license 
terms described in 'LICENSE' (if you didn't get it with the source, grab 
it from http://innu.org/~brian/Stephanie/Stephanie-3.1/doc/LICENSE) except 
for kern_acl.c which is based on kern_tpe.c by route, hence retains the
original license.

Shoutz go to shegget, S`, _eci, doe, jaf.

For updated information about Stephanie, please visit 
http://www.PacketFactory.net/Projects/Stephanie

My homepage is http://innu.org/~brian -- If the official site ever goes 
down, you can find there the current version, updates, etc.

-- br1an <brian (at) innu.org> (May 2002)
