From 1b3be8b0954ab43debb425dc6e9087e8c7f2f15f Mon Sep 17 00:00:00 2001
From:  <>
Date: Mon, 18 Dec 2023 21:30:13 +0000
Subject: [PATCH] Deployed 5556b38 with MkDocs version: 1.5.3

---
 packages/control/index.html |  83 ++++++++++++++++++++++++++++++------
 search/search_index.json    |   2 +-
 sitemap.xml                 |  20 ++++-----
 sitemap.xml.gz              | Bin 306 -> 305 bytes
 4 files changed, 80 insertions(+), 25 deletions(-)

diff --git a/packages/control/index.html b/packages/control/index.html
index 56985d1..652f13f 100644
--- a/packages/control/index.html
+++ b/packages/control/index.html
@@ -503,7 +503,16 @@
     </span>
   </a>
   
-    <nav class="md-nav" aria-label="Usage in Rocky Linux">
+</li>
+        
+          <li class="md-nav__item">
+  <a href="#sub-packages" class="md-nav__link">
+    <span class="md-ellipsis">
+      Sub-packages
+    </span>
+  </a>
+  
+    <nav class="md-nav" aria-label="Sub-packages">
       <ul class="md-nav__list">
         
           <li class="md-nav__item">
@@ -516,9 +525,18 @@
 </li>
         
           <li class="md-nav__item">
-  <a href="#control-shadow" class="md-nav__link">
+  <a href="#control-shadow-utils" class="md-nav__link">
     <span class="md-ellipsis">
-      control-shadow
+      control-shadow-utils
+    </span>
+  </a>
+  
+</li>
+        
+          <li class="md-nav__item">
+  <a href="#control-util-linux" class="md-nav__link">
+    <span class="md-ellipsis">
+      control-util-linux
     </span>
   </a>
   
@@ -527,6 +545,15 @@
       </ul>
     </nav>
   
+</li>
+        
+          <li class="md-nav__item">
+  <a href="#change-log" class="md-nav__link">
+    <span class="md-ellipsis">
+      Change log
+    </span>
+  </a>
+  
 </li>
         
       </ul>
@@ -702,27 +729,55 @@
 <h1 id="extra-package-control">Extra package: control<a class="headerlink" href="#extra-package-control" title="Permanent link">&para;</a></h1>
 <h2 id="el9">EL9<a class="headerlink" href="#el9" title="Permanent link">&para;</a></h2>
 <ul>
-<li>Version <code>0.8.0-2.el9_3.security</code></li>
+<li>Version <code>0.8.0-4.el9_3.security</code></li>
 </ul>
 <h3 id="package-summary">Package summary<a class="headerlink" href="#package-summary" title="Permanent link">&para;</a></h3>
 <p><code>control</code> provides a common interface to register and control (what it calls) system facilities.
 This is intended primarily for facilities that can potentially be dangerous to system security, to let you enable, disable, or configure each facility.
-A typical facility is a SUID/SGID/setcap program or a configuration setting of a service.</p>
+A typical facility is a configuration setting of a service or a SUID/SGID/setcap program, or a closely related group of such settings and/or programs that are managed together.
+We manage permissions on SUID/SGID/setcap programs because those programs pose risk to system security in case of vulnerabilities in them or in library code they use.</p>
 <p><code>control</code> originates in Owl and is actively maintained in ALT Linux.</p>
 <h3 id="usage-in-rocky-linux">Usage in Rocky Linux<a class="headerlink" href="#usage-in-rocky-linux" title="Permanent link">&para;</a></h3>
 <p>While the original <code>control</code> package in Owl and ALT Linux merely provides the common interface mentioned above for other packages to register their facilities with (and many packages in those distros do), it's been adapted in Rocky Linux to provide its own sub-packages with facility specifications and RPM trigger scripts for other packages coming from EL. This way, we can <code>control</code> those facilities and have custom settings persist (be automatically saved and restored) over package upgrades without us having to maintain forks of those other packages.</p>
-<p>Initially, there are 2 sub-packages:</p>
-<h4 id="control">control<a class="headerlink" href="#control" title="Permanent link">&para;</a></h4>
-<p>The main package providing the common interface, but no facilities of its own.
-Please refer to <code>control(8)</code> man page for command-line usage syntax.</p>
-<h4 id="control-shadow">control-shadow<a class="headerlink" href="#control-shadow" title="Permanent link">&para;</a></h4>
-<p>Facility files corresponding to the <code>shadow-utils</code> package. Currently, these allow to <code>control</code> access to 5 privileged programs (3 of them are by default SUID root and 2 <code>cap_setuid=ep</code>, thus posing risk to system security in case of vulnerabilities in them).</p>
-<div class="highlight"><pre><span></span><code># control
-chage           public          (public restricted)
+<p>The available facilities, their current settings, and lists of possible settings can be queried by running the <code>control</code> command without parameters. With all currently available sub-packages installed, its output may be:</p>
+<div class="highlight"><pre><span></span><code>chage           public          (public restricted)
 gpasswd         public          (public wheelonly restricted)
+mount           public          (public wheelonly unprivileged restricted)
 newgidmap       public          (public wheelonly restricted)
 newgrp          public          (public wheelonly restricted)
 newuidmap       public          (public wheelonly restricted)
+write           public          (public restricted)
+</code></pre></div>
+<p>The default settings (typically <code>public</code>) correspond to EL packages' defaults (and are typically the most relaxed security-wise).</p>
+<p>Please refer to <code>control(8)</code> man page for command-line usage syntax.</p>
+<h3 id="sub-packages">Sub-packages<a class="headerlink" href="#sub-packages" title="Permanent link">&para;</a></h3>
+<p>Currently, there are 3 sub-packages:</p>
+<h4 id="control">control<a class="headerlink" href="#control" title="Permanent link">&para;</a></h4>
+<p>The main package providing the common interface, but no facilities of its own.</p>
+<h4 id="control-shadow-utils">control-shadow-utils<a class="headerlink" href="#control-shadow-utils" title="Permanent link">&para;</a></h4>
+<p>Facility specifications corresponding to the <code>shadow-utils</code> package. Currently, these allow to <code>control</code> access to 5 privileged programs - 3 of them (<code>chage</code>, <code>gpasswd</code>, and <code>newgrp</code>) are by default SUID root and 2 (<code>newuidmap</code> and <code>newgidmap</code>) are <code>cap_setuid=ep</code>.</p>
+<h4 id="control-util-linux">control-util-linux<a class="headerlink" href="#control-util-linux" title="Permanent link">&para;</a></h4>
+<p>Facility specifications corresponding to the <code>util-linux</code> and <code>util-linux-core</code> packages. Currently, these allow to <code>control</code> access to 3 privileged programs - 2 of them (<code>mount</code> and <code>umount</code>) are by default SUID root and 1 (<code>write</code>) SGID <code>tty</code>.</p>
+<h3 id="change-log">Change log<a class="headerlink" href="#change-log" title="Permanent link">&para;</a></h3>
+<div class="highlight"><pre><span></span><code>* Mon Dec 18 2023 Solar Designer &lt;solar@openwall.com&gt; 0.8.0-4
+- Add sub-package with facilities and triggers for util-linux
+
+* Mon Dec 18 2023 Solar Designer &lt;solar@openwall.com&gt; 0.8.0-3
+- Rename the shadow sub-package to shadow-utils
+- Rename the source files not to differentiate them by sub-package
+- Add &quot;Requires: shadow-utils&quot; in the shadow-utils sub-package
+
+* Wed Dec 13 2023 Solar Designer &lt;solar@openwall.com&gt; 0.8.0-2
+- In addition to Requires(pre), also use Requires in the sub-package
+- In %%triggerprein_control, pre-check that the facility exists
+- Use (renamed) copies of the trigger macros within this spec file
+
+* Wed Dec 13 2023 Solar Designer &lt;solar@openwall.com&gt; 0.8.0-1
+- Add macros for use in RPM triggers
+- Add sub-package with facilities and triggers for shadow-utils
+
+* Wed Dec  6 2023 Solar Designer &lt;solar@openwall.com&gt; 0.8.0-0
+- Initial packaging for EL based on ALT Linux and Owl packages
 </code></pre></div>
 
 
@@ -744,7 +799,7 @@ newuidmap       public          (public wheelonly restricted)
     <span class="md-icon" title="Last update">
       <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M21 13.1c-.1 0-.3.1-.4.2l-1 1 2.1 2.1 1-1c.2-.2.2-.6 0-.8l-1.3-1.3c-.1-.1-.2-.2-.4-.2m-1.9 1.8-6.1 6V23h2.1l6.1-6.1-2.1-2M12.5 7v5.2l4 2.4-1 1L11 13V7h1.5M11 21.9c-5.1-.5-9-4.8-9-9.9C2 6.5 6.5 2 12 2c5.3 0 9.6 4.1 10 9.3-.3-.1-.6-.2-1-.2s-.7.1-1 .2C19.6 7.2 16.2 4 12 4c-4.4 0-8 3.6-8 8 0 4.1 3.1 7.5 7.1 7.9l-.1.2v1.8Z"/></svg>
     </span>
-    <span class="git-revision-date-localized-plugin git-revision-date-localized-plugin-date">December 14, 2023</span>
+    <span class="git-revision-date-localized-plugin git-revision-date-localized-plugin-date">December 18, 2023</span>
   </span>
 
     
diff --git a/search/search_index.json b/search/search_index.json
index 3cb60d1..ce93e56 100644
--- a/search/search_index.json
+++ b/search/search_index.json
@@ -1 +1 @@
-{"config":{"lang":["en"],"separator":"[\\s\\-]+","pipeline":["stopWordFilter"]},"docs":[{"location":"","title":"SIG/Security Wiki","text":"<p>The Security SIG repositories provide extra security-related packages and security-hardened override packages (replacing those from the main distribution) for Rocky Linux and other Enterprise Linux (EL) distributions.</p>"},{"location":"#responsibilities","title":"Responsibilities","text":"<p>Developing and maintaining various security related packages that are not in upstream EL. Identifying, developing, and maintaining security hardening changes relative to upstream EL packages. Occasionally including/backporting additional security fixes that are not yet in upstream EL packages. Contributing to the respective upstreams where practical.</p>"},{"location":"#repo-installation","title":"Repo Installation","text":""},{"location":"#on-rocky-linux","title":"On Rocky Linux","text":"<pre><code>dnf install rocky-release-security\n</code></pre>"},{"location":"#on-another-compatible-el-distro","title":"On another compatible EL distro","text":"<p>Download the release package containing our repository configuration file and package signing public key. Use the version that corresponds to the major version of your EL distro.</p> <ul> <li>rocky-release-security-9</li> <li>rocky-release-security-8</li> </ul> <p>Verify the package file's SHA-256 digest with <code>sha256sum</code>. The currently expected digests are:</p> <pre><code>0d0cfcb16379b4c374b45a7a4ec86894f5bbdd977103cc5544be0f6fc2581a2a  rocky-release-security-9-3.el9.noarch.rpm\n8dc7912f0ab55dff4cb2b1dc9262c22aa89d911cdb680d33213737597d865006  rocky-release-security-8-3.el8.noarch.rpm\n</code></pre> <p>This isn't as secure as checking the package signature would be if you previously had our package signing public key, but on another distro you probably don't have that yet, so checking the digest against its copy obtained from this separate website is a best-effort measure.</p>"},{"location":"#packages","title":"Packages","text":""},{"location":"#extra-packages-for-el8-and-el9","title":"Extra packages (for EL8 and EL9)","text":"<ul> <li>lkrg (Linux Kernel Runtime Guard)</li> <li>passwdqc (password/passphrase strength checking and policy enforcement)</li> </ul>"},{"location":"#extra-packages-currently-only-for-el9","title":"Extra packages (currently only for EL9)","text":"<ul> <li>control (a common interface to register and control security-relevant system facilities)</li> <li>hardened_malloc (security-focused memory allocator providing the malloc API, and a script to preload it into existing program binaries)</li> </ul>"},{"location":"#override-packages-for-el8-and-el9","title":"Override packages (for EL8 and EL9)","text":"<ul> <li>microcode_ctl (updates Intel CPU microcode to fix CVE-2023-23583)</li> </ul>"},{"location":"#override-packages-currently-only-for-el9","title":"Override packages (currently only for EL9)","text":"<ul> <li>glibc (adds many security-hardening changes originating from Owl and ALT Linux on top of EL package)</li> <li>openssh (fewer shared libraries exposed in sshd processes while otherwise fully matching EL package's functionality)</li> </ul> <p>The changes are described in more detail on the per-package wiki pages linked above, as well as in the package changelogs. More packages/changes are planned, including override packages also for EL8.</p>"},{"location":"#source-code","title":"Source code","text":"<p>Just like for other Rocky Linux SIGs, the source trees for Security SIG packages are maintained in per-package git repositories. Each repository contains branches <code>r8</code> and/or <code>r9</code> corresponding to target EL version.</p>"},{"location":"#contributing","title":"Contributing","text":"<p>If anyone else wants to join this effort - in any capacity including development, maintenance, testing, documentation, user support, spreading the word, or something else - please join the Mattermost channel below and let us know!</p> <p>We also welcome well-reasoned suggestions/feedback/preferences on direction we should take (e.g., only making changes on top of EL's vs. offering newer upstream versions), what else to package, and what other changes to include.</p>"},{"location":"#meetings-communications","title":"Meetings / Communications","text":"<p>We hang out in our Security Mattermost channel.</p>"},{"location":"#members","title":"Members","text":"<p>Some of the people active with setting up this SIG so far:</p> Name Mattermost Name @flawedworld Fredrik Nystr\u00f6m @nscfreny Louis Abel @label Mustafa @mustafa Neil Hanlon @neil Scott Shinn @atomicturtle Solar Designer @solardiz"},{"location":"issues/CVE-2023-23583/","title":"CVE-2023-23583: microcode_ctl","text":""},{"location":"issues/CVE-2023-23583/#title","title":"Title","text":"<p>CVE-2023-23583: microcode_ctl: Intel CPUs: execution of MOVSB instructions with redundant REX prefix leads to unintended system behavior</p>"},{"location":"issues/CVE-2023-23583/#summary","title":"Summary","text":"<p>As described by Intel:</p> <p>Under certain microarchitectural conditions, Intel has identified cases where execution of an instruction (REP MOVSB) encoded with a redundant REX prefix may result in unpredictable system behavior resulting in a system crash/hang, or, in some limited scenarios, may allow escalation of privilege from CPL3 to CPL0.</p> <p>and by Red Hat:</p> <p>A security vulnerability was found in some Intel processors. Execution of REP MOVSB instructions with a redundant REX prefix may result in execution continuing at an incorrect EIP address after a micro-architectural event occurs, potentially allowing privilege escalation, information disclosure and/or a denial of service via local access.</p> <p>as well as in CVE-2023-23583.</p> <p>More detail is available via these links to Intel's website and in the public disclosure by Tavis Ormandy from Google.</p> <p>Public disclosure date: November 14, 2023</p>"},{"location":"issues/CVE-2023-23583/#el9","title":"EL9","text":"<ul> <li>Fixed in version: <code>4:20231114-1.el9_2.security</code> available November 15, 2023</li> </ul>"},{"location":"issues/CVE-2023-23583/#el8","title":"EL8","text":"<ul> <li>Fixed in version <code>4:20230808-2.20231009.1.el8.security</code> available November 19, 2023</li> </ul> <p>Please refer to our override package of microcode_ctl.</p>"},{"location":"issues/CVE-2023-4911/","title":"CVE-2023-4911: glibc","text":""},{"location":"issues/CVE-2023-4911/#title","title":"Title","text":"<p>CVE-2023-4911: glibc: Looney Tunables: buffer overflow in ld.so leading to privilege escalation</p>"},{"location":"issues/CVE-2023-4911/#summary","title":"Summary","text":"<p>As described by Red Hat and in CVE-2023-4911:</p> <p>A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the <code>GLIBC_TUNABLES</code> environment variable. This issue could allow a local attacker to use maliciously crafted <code>GLIBC_TUNABLES</code> environment variables when launching binaries with SUID permission to execute code with elevated privileges.</p> <p>More detail is available in the public disclosure by Qualys, the team who discovered the issue.</p> <p>Public disclosure date: October 3, 2023</p>"},{"location":"issues/CVE-2023-4911/#el9","title":"EL9","text":"<ul> <li>Mitigated in version: <code>2.34-60.el9_2.security.0.2</code> available October 3, 2023</li> <li>Fixed in version: <code>glibc-2.34-60.el9_2.7</code> available October 5, 2023</li> </ul> <p>Besides the upstream fix, we also retained the mitigation in our override package of glibc.</p>"},{"location":"issues/CVE-2023-4911/#el8","title":"EL8","text":"<ul> <li>Fixed in version: <code>glibc-0:2.28-225.el8_8.6</code> available October 5, 2023</li> <li>Errata: RLSA-2023:5455 issued October 7, 2023</li> </ul>"},{"location":"packages/control/","title":"Extra package: control","text":""},{"location":"packages/control/#el9","title":"EL9","text":"<ul> <li>Version <code>0.8.0-2.el9_3.security</code></li> </ul>"},{"location":"packages/control/#package-summary","title":"Package summary","text":"<p><code>control</code> provides a common interface to register and control (what it calls) system facilities. This is intended primarily for facilities that can potentially be dangerous to system security, to let you enable, disable, or configure each facility. A typical facility is a SUID/SGID/setcap program or a configuration setting of a service.</p> <p><code>control</code> originates in Owl and is actively maintained in ALT Linux.</p>"},{"location":"packages/control/#usage-in-rocky-linux","title":"Usage in Rocky Linux","text":"<p>While the original <code>control</code> package in Owl and ALT Linux merely provides the common interface mentioned above for other packages to register their facilities with (and many packages in those distros do), it's been adapted in Rocky Linux to provide its own sub-packages with facility specifications and RPM trigger scripts for other packages coming from EL. This way, we can <code>control</code> those facilities and have custom settings persist (be automatically saved and restored) over package upgrades without us having to maintain forks of those other packages.</p> <p>Initially, there are 2 sub-packages:</p>"},{"location":"packages/control/#control","title":"control","text":"<p>The main package providing the common interface, but no facilities of its own. Please refer to <code>control(8)</code> man page for command-line usage syntax.</p>"},{"location":"packages/control/#control-shadow","title":"control-shadow","text":"<p>Facility files corresponding to the <code>shadow-utils</code> package. Currently, these allow to <code>control</code> access to 5 privileged programs (3 of them are by default SUID root and 2 <code>cap_setuid=ep</code>, thus posing risk to system security in case of vulnerabilities in them).</p> <pre><code># control\nchage           public          (public restricted)\ngpasswd         public          (public wheelonly restricted)\nnewgidmap       public          (public wheelonly restricted)\nnewgrp          public          (public wheelonly restricted)\nnewuidmap       public          (public wheelonly restricted)\n</code></pre>"},{"location":"packages/glibc/","title":"Override package: glibc","text":""},{"location":"packages/glibc/#el9","title":"EL9","text":"<ul> <li>Version <code>2.34-83.7.el9_3.security.0.3</code></li> <li>Based on <code>2.34-83.el9.7</code></li> </ul>"},{"location":"packages/glibc/#changes-summary","title":"Changes summary","text":"<ul> <li>Distrust and/or unset many more environment variables used by current and previous glibc versions when running SUID/SGID/setcap (Owl via ALT Linux)</li> <li>When <code>syslog(3)</code>/<code>vsyslog(3)</code> is called by a SUID/SGID/setcap program without a preceding call to <code>openlog(3)</code>, don't blindly trust <code>__progname</code> for the syslog ident (Owl via ALT Linux)</li> <li>In <code>syslog(3)/vsyslog(3)</code> use <code>asctime_r(3)+localtime_r(3)</code> instead of <code>strftime_r()</code> so that month names don't depend on current locale settings (Owl via ALT Linux)</li> <li>In <code>asprintf(3)/vasprintf(3)</code> reset the pointer to NULL on error, like BSDs do, so that the caller wouldn't access memory over an uninitialized or stale pointer (ALT Linux)</li> <li>In <code>fread(3)/fwrite(3)</code> check for potential integer overflow (ALT Linux)</li> <li>In <code>tmpfile(3)</code> use the <code>TMPDIR</code> environment variable (when not running SUID/SGID/setcap) (ALT Linux)</li> </ul>"},{"location":"packages/glibc/#known-effective-vulnerability-mitigations-and-fixes","title":"Known-effective vulnerability mitigations and fixes","text":"<p><code>2.34-60.el9_2.security.0.2</code> included mitigations sufficient to avoid security exposure of CVE-2023-4911 and a backport of upstream glibc fix of CVE-2023-4527 that was not yet in upstream EL. In the update to <code>2.34-60.7.el9_2.security.0.3</code> and beyond, we retained the mitigations while rebasing on upstream EL's package with upstream fixes for these vulnerabilities (and more).</p> <p>In general, inclusion of additional security fixes will be \"reverted\" if and when those get included in upstream EL packages that we rebase our changes on.</p>"},{"location":"packages/glibc/#change-log","title":"Change log","text":"<pre><code>* Wed Nov 22 2023 Solar Designer &lt;solar@openwall.com&gt; - 2.34-83.7.el9.security.0.3\n- Rebase on 2.34-83.7, drop \"our\" CVE-2023-4527 patch in favor of RH's\n  (a similar rebase was made on Oct 6 in 2.34-60.7.el9.security.0.3 for 9.2)\n\n[... upstream changes ...]\n\n* Fri Oct  6 2023 Solar Designer &lt;solar@openwall.com&gt; - 2.34-60.7.el9.security.0.3\n- Rebase on 2.34-60.7, drop \"our\" CVE-2023-4527 patch in favor of RH's\n\n[... upstream changes ...]\n\n* Mon Oct  2 2023 Solar Designer &lt;solar@openwall.com&gt; - 2.34-60.el9.security.0.2\n- Add glibc-owl-alt-sanitize-env.patch stitched from several ALT Linux commits\n  as none of their revisions matched this package's set of backports as-is\n- Add glibc-upstream-no-aaaa-CVE-2023-4527.patch based on upstream commit\n  bd77dd7e73e3530203be1c52c8a29d08270cb25d fixing\n  CVE-2023-4527: Stack read overflow with large TCP responses in no-aaaa mode\n\n* Tue Sep 26 2023 Solar Designer &lt;solar@openwall.com&gt; - 2.34-60.el9.security.0.1\n- Revise the texinfo documentation edit of glibc-2.34-alt-asprintf.patch via\n  glibc-2.34-rocky-asprintf.patch\n\n* Sat Sep 23 2023 Solar Designer &lt;solar@openwall.com&gt; - 2.34-60.el9.security.0.0\n- Add some of the patches from ALT Linux as of when they were at 2.34:\n  https://git.altlinux.org/gears/g/glibc.git\n  git show 5fa32fb0f8509f4b2b1105d71b45966dfbadc099 &gt; glibc-2.34-alt-tmpfile.patch\n  git show f97e5d60a6a4c9cb64e3b9ee6f5113969cf07d87 &gt; glibc-2.34-alt-asprintf.patch\n  git show cd45d0f74560325cc48aedb9f56881270ab3dfab &gt; glibc-2.34-alt-libio-bound.patch\n  git show 436eb1017c04aee3a553c2868d00a4b046e5e394 &gt; glibc-2.34-owl-alt-syslog-ident.patch\n  git show 03a86c234873723c26b7e387c498c1332c223968 &gt; glibc-2.34-mjt-owl-alt-syslog-timestamp.patch\n</code></pre>"},{"location":"packages/hardened_malloc/","title":"Extra package: hardened_malloc","text":""},{"location":"packages/hardened_malloc/#el9","title":"EL9","text":"<ul> <li>Version <code>hardened_malloc-12-3.el9_2.security</code></li> <li>Based on upstream version <code>12</code></li> <li>No plans to support older Rocky Linux versions due to glibc being too old</li> </ul>"},{"location":"packages/hardened_malloc/#package-summary","title":"Package summary","text":"<p>This package ships the \"normal\" and \"light\" configurations of the GrapheneOS hardened_malloc project. The official README.md in the upstream project documents security properties and explains the differences between the regular and light variants.</p>"},{"location":"packages/hardened_malloc/#usage-in-rocky-linux","title":"Usage in Rocky Linux","text":"<p>It is strongly reccomended to read all documentation here before deploying this package on your infrastructure.</p> <p>In order to support the large amount of mappings caused by guard slabs and large allocation guard regions, the <code>vm.max_map_count</code> sysctl is increased as part of package installation to <code>1048576</code> in <code>/etc/sysctl.d/hardened_malloc.conf</code>. You'll need to run <code>sysctl -p /etc/sysctl.d/hardened_malloc.conf</code> for this change to take effect without a reboot. Incidentally, Fedora 39 made the same change, so it's not an exotic configuration.</p> <p>The package ships 2 builds of <code>hardened_malloc</code>, the regular variant, which is located at <code>/usr/lib64/libhardened_malloc.so</code> and can be preloaded using the <code>hardened_malloc_preload.sh</code> script, and the light variant, which is located at <code>/usr/lib64/libhardened_malloc-light.so</code> and can be preloaded using the <code>hardened_malloc_light_preload.sh</code> script. The preload scripts add the relevant library to <code>LD_PRELOAD</code> and then load the desired binary, as shown in the following example: <code>hardened_malloc_preload.sh cat /proc/self/maps</code>.</p> <p>Users may choose to set an OS-wide <code>LD_PRELOAD</code> with <code>hardened_malloc</code>. This can be done by adding the desired library, for example, <code>/usr/lib64/libhardened_malloc.so</code>, into your <code>/etc/ld.so.preload</code>. Be aware that for applications where <code>AT_SECURE</code> is set, this approach will not work.</p> <p>It is suggested that if you wish to deploy <code>hardened_malloc</code> systemwide, that you deploy it in your <code>LD_PRELOAD</code> with the normal variant globally, and then for applications which are performance sensitive, or which fail with the normal variant, try them individually with the light variant using the preload script or by setting <code>LD_PRELOAD</code> within a systemd service namespace. If that does not resolve your issue, try disabling <code>hardened_malloc</code> by running the program in its own systemd service namespace.</p>"},{"location":"packages/hardened_malloc/#bugs-uncovered-by-hardened_malloc","title":"Bugs uncovered by hardened_malloc","text":"<p>As with all infrastructure changes, ensure you test in your staging environment extensively before deploying into production. Many packages and projects suffer from memory corruption bugs, which when running under glibc are not encountered during operation, but which <code>hardened_malloc</code> uncovers. Some applications may crash during usage, completely break, or break when running with certain configurations. Bugs in packages are typically a result of upstream project bugs, and should be reported there. In some cases these bugs are fixed in later versions in the upstream project, in which case the bug is an issue with Rocky Linux, and should be reported to Rocky Linux and its upstream distribution, so that the patch may be included.</p> Package name Latest version tested Normal variant Light variant php php-8.0.30-1.el9_2.x86_64 Broken Broken php php-8.1.14-1.module+el9.2.0+15232+36037ab0.x86_64 Broken Broken sssd sssd-2.8.2-3.el9_2.x86_64 Broken Broken"},{"location":"packages/hardened_malloc/#potential-for-issues-with-edr","title":"Potential for issues with EDR","text":"<p>By nature of relying on <code>LD_PRELOAD</code>, if you have EDR software on your server, it may falsely send alerts when using <code>hardened_malloc</code>. If it doesn't, your EDR is probably terrible or misconfigured.</p>"},{"location":"packages/hardened_malloc/#change-log","title":"Change log","text":"<pre><code>* Tue Nov 14 2023 Solar Designer &lt;solar@openwall.com&gt; 12-3\n- Package hardened_malloc_light_preload.sh\n- Disable arm64 building for now (fix didn't work)\n\n* Wed Nov  8 2023 flawedworld &lt;flawedworld@flawed.world&gt; 12-2\n- Set CONFIG_NATIVE to false\n- Mark libraries as executable (change to 755 permissions)\n- Add hardened_malloc_light_preload.sh\n- Fix arm64 building\n\n* Sat Oct 28 2023 flawedworld &lt;flawedworld@flawed.world&gt; 12-1\n- Initial packaging for hardened_malloc version 12, co-authored-by\n  Scott Shinn (atomicturtle) and Solar Designer\n</code></pre>"},{"location":"packages/lkrg/","title":"Extra package: lkrg","text":""},{"location":"packages/lkrg/#el9","title":"EL9","text":"<ul> <li>Version <code>0.9.7-4.el9_3.security</code></li> <li>Based on upstream version <code>0.9.7</code></li> </ul>"},{"location":"packages/lkrg/#el8","title":"EL8","text":"<ul> <li>Version <code>0.9.7-4.el8_9.security</code></li> <li>Based on upstream version <code>0.9.7</code></li> </ul>"},{"location":"packages/lkrg/#package-summary","title":"Package summary","text":"<p>LKRG, or Linux Kernel Runtime Guard, is a kernel module that performs runtime integrity checking of the Linux kernel and detection of security vulnerability exploits against the kernel.</p> <p>More information is available on the LKRG homepage and in the documentation files included in the package.</p>"},{"location":"packages/lkrg/#usage-in-rocky-linux","title":"Usage in Rocky Linux","text":"<p>Due to EL's kABI stability and the <code>weak-modules</code> mechanism, which this package uses, the same binary package of LKRG works across different kernel revisions/builds within the same EL minor release (e.g., 9.3). Once there's a new minor release (e.g., 9.3 is upgraded to 9.4), we'll provide a new build of LKRG accordingly.</p> <p>Installing the package does not automatically start LKRG nor enable it to start on system bootup. To start LKRG please use:</p> <pre><code>systemctl start lkrg\n</code></pre> <p>To enable LKRG on bootup please use:</p> <pre><code>systemctl enable lkrg\n</code></pre>"},{"location":"packages/lkrg/#testing-and-recovery","title":"Testing and recovery","text":"<p>Although the current package passed our own testing (on 9.3 and 8.9), we recommend that you only enable LKRG to start on system bootup after you've tested it for a while to ensure its compatibility with your system. If you nevertheless run into a boot time issue with LKRG later, you can disable it with the <code>nolkrg</code> kernel command-line option.</p>"},{"location":"packages/lkrg/#change-log","title":"Change log","text":"<p>The 0.9.7-4 source package was originally built for (and tested on) 9.2 and 8.8, then rebuilt without source level changes for 9.3 and 8.9 (and re-tested on those versions).</p> <pre><code>* Wed Nov 08 2023 Solar Designer &lt;solar@openwall.com&gt; 0.9.7-4\n- Add a couple of upstream patches, most notably to fix kINT false positives on\nEL 8.8.\n\n* Tue Oct 24 2023 Solar Designer &lt;solar@openwall.com&gt; 0.9.7-3\n- Use weak-modules if available so that on RHEL and its rebuilds the same LKRG\n  package build works across different kABI-compatible kernel revisions/builds\n- Drop 32-bit x86 from ExclusiveArch since recent RHEL lacks such kernel-devel\n\n* Thu Sep 14 2023 Solar Designer &lt;solar@openwall.com&gt; 0.9.7-2\n- Use kernel build directory corresponding to the kernel-devel package, not to\nthe currently running kernel\n- \"BuildRequires: kernel\" for the /lib/modules/* directory\n- \"BuildRequires: elfutils-libelf-devel\" to support CONFIG_UNWINDER_ORC=y\n\n* Thu Sep 14 2023 Solar Designer &lt;solar@openwall.com&gt; 0.9.7-1\n- Wrote this rough RPM spec file for Red Hat'ish distros, seems to work fine on\nRHEL 7, 8, 9 rebuilds, but is only reliable when there's exactly one\nkernel-devel package installed at build time and it exactly matches the target\nkernel version.\n</code></pre>"},{"location":"packages/microcode_ctl/","title":"Override package: microcode_ctl","text":""},{"location":"packages/microcode_ctl/#el9","title":"EL9","text":"<ul> <li>Version <code>4:20231114-1.el9_2.security</code></li> <li>Based on <code>4:20230808-2.el9</code></li> </ul> <p>This is our custom revision of a post-9.2 EL9 package. We use Intel's latest released microcode.</p>"},{"location":"packages/microcode_ctl/#el8","title":"EL8","text":"<ul> <li>Version <code>4:20230808-2.20231009.1.el8.security</code></li> <li>Based on <code>4:20230808-2.20231009.1.el8</code></li> </ul> <p>This is a rebuild of the 8.9 package as-is to make it available for 8.8. It uses Intel's fixed microcode revision that was provided to distros privately in preparation for the coordinated disclosure.</p>"},{"location":"packages/microcode_ctl/#changes-summary","title":"Changes summary","text":"<p>For EL9:</p> <ul> <li>Update Intel CPU microcode to fix CVE-2023-23583, temporarily dropping most documentation patches</li> </ul>"},{"location":"packages/microcode_ctl/#change-log","title":"Change log","text":"<p>For EL9:</p> <pre><code>* Tue Nov 14 2023 Solar Designer &lt;solar@openwall.com&gt; - 4:20231114-1\n- Update Intel CPU microcode to microcode-20231114 (fixes CVE-2023-23583),\n  temporarily dropping most documentation patches\n</code></pre>"},{"location":"packages/openssh/","title":"Override package: openssh","text":""},{"location":"packages/openssh/#el9","title":"EL9","text":"<ul> <li>Version <code>8.7p1-34.el9_3.security.0.1</code></li> <li>Based on <code>8.7p1-34.el9</code></li> </ul>"},{"location":"packages/openssh/#changes-summary","title":"Changes summary","text":"<ul> <li>Instead of linking against <code>libsystemd</code>, load it dynamically in a temporary child process to avoid polluting actual <code>sshd</code>'s address space with that library and its many dependencies (shortens <code>ldd sshd</code> output from 28 to 20 lines)</li> </ul>"},{"location":"packages/openssh/#change-log","title":"Change log","text":"<pre><code>* Wed Nov 22 2023 Solar Designer &lt;solar@openwall.com&gt; 8.7p1-34.el9_3.security.0.1\n- Rebase 8.7p1-30.el9.security.0.2 on 8.7p1-34\n\n* Sat Oct 07 2023 Solar Designer &lt;solar@openwall.com&gt; 8.7p1-30.el9.security.0.2\n- Load libsystemd.so.0, not libsystemd.so, as the latter is only provided by\n  systemd-devel\n\n* Mon Aug 28 2023 Solar Designer &lt;solar@openwall.com&gt; 8.7p1-30.el9.security.0.1\n- Instead of linking against libsystemd, load it dynamically in a temporary\n  child process to avoid polluting actual sshd's address space with that\n  library and its many dependencies (shortens \"ldd sshd\" from 28 to 20 lines)\n</code></pre>"},{"location":"packages/passwdqc/","title":"Extra package: passwdqc","text":""},{"location":"packages/passwdqc/#el9","title":"EL9","text":"<ul> <li>Version <code>2.0.3-2.el9_2.security</code></li> <li>Based on upstream version <code>2.0.3-2</code> as packaged in Fedora</li> </ul>"},{"location":"packages/passwdqc/#el8","title":"EL8","text":"<ul> <li>Version <code>2.0.3-2.el8.security</code></li> <li>Based on upstream version <code>2.0.3-2</code> as packaged in Fedora</li> </ul>"},{"location":"packages/passwdqc/#package-summary","title":"Package summary","text":"<p><code>passwdqc</code> is a password/passphrase strength checking and policy enforcement toolset, including a PAM module (<code>pam_passwdqc</code>), command-line programs (<code>pwqcheck</code>, <code>pwqfilter</code>, and <code>pwqgen</code>), and a library (<code>libpasswdqc</code>).</p> <p>More information is available on the passwdqc homepage and in the documentation files (man pages and a README) included in the sub-packages below.</p>"},{"location":"packages/passwdqc/#usage-in-rocky-linux","title":"Usage in Rocky Linux","text":"<p>There are 5 sub-packages:</p>"},{"location":"packages/passwdqc/#pam_passwdqc","title":"pam_passwdqc","text":"<p><code>pam_passwdqc</code> is a PAM module that is normally invoked on password changes by programs such as <code>passwd(1)</code>. It is capable of checking password or passphrase strength, enforcing a policy, and offering randomly-generated passphrases, with all of these features being optional and easily (re-)configurable.</p> <p>Merely installing this sub-package does not yet configure the system to use the PAM module. To do so, please edit PAM configuration files e.g. like shown here.</p>"},{"location":"packages/passwdqc/#passwdqc-utils","title":"passwdqc-utils","text":"<p><code>pwqcheck</code> and <code>pwqgen</code> are standalone password/passphrase strength checking and random passphrase generator programs, respectively, which are usable from scripts.</p> <p>The <code>pwqfilter</code> program searches, creates, or updates binary passphrase filter files, which can also be used with <code>pwqcheck</code> and <code>pam_passwdqc</code>. This can be used for checking of user-provided passwords against existing data breaches, which is recommended in the current NIST guidance, specifically in publication 800-63B sections 5.1.1.2 and A.3. Paid pre-generated filter files are available from Openwall at the project homepage above, but with this tool you can also generate your own.</p>"},{"location":"packages/passwdqc/#libpasswdqc","title":"libpasswdqc","text":"<p><code>libpasswdqc</code> is the underlying library, which may also be used from third-party programs.</p>"},{"location":"packages/passwdqc/#libpasswdqc-devel","title":"libpasswdqc-devel","text":"<p>This package contains development files needed for building passwdqc-aware applications, as well as documentation (man pages) for developing such applications.</p>"},{"location":"packages/passwdqc/#passwdqc","title":"passwdqc","text":"<p><code>passwdqc</code> is a meta sub-package that installs (via dependencies) the actual sub-packages above, except for <code>libpasswdqc-devel</code>.</p>"}]}
\ No newline at end of file
+{"config":{"lang":["en"],"separator":"[\\s\\-]+","pipeline":["stopWordFilter"]},"docs":[{"location":"","title":"SIG/Security Wiki","text":"<p>The Security SIG repositories provide extra security-related packages and security-hardened override packages (replacing those from the main distribution) for Rocky Linux and other Enterprise Linux (EL) distributions.</p>"},{"location":"#responsibilities","title":"Responsibilities","text":"<p>Developing and maintaining various security related packages that are not in upstream EL. Identifying, developing, and maintaining security hardening changes relative to upstream EL packages. Occasionally including/backporting additional security fixes that are not yet in upstream EL packages. Contributing to the respective upstreams where practical.</p>"},{"location":"#repo-installation","title":"Repo Installation","text":""},{"location":"#on-rocky-linux","title":"On Rocky Linux","text":"<pre><code>dnf install rocky-release-security\n</code></pre>"},{"location":"#on-another-compatible-el-distro","title":"On another compatible EL distro","text":"<p>Download the release package containing our repository configuration file and package signing public key. Use the version that corresponds to the major version of your EL distro.</p> <ul> <li>rocky-release-security-9</li> <li>rocky-release-security-8</li> </ul> <p>Verify the package file's SHA-256 digest with <code>sha256sum</code>. The currently expected digests are:</p> <pre><code>0d0cfcb16379b4c374b45a7a4ec86894f5bbdd977103cc5544be0f6fc2581a2a  rocky-release-security-9-3.el9.noarch.rpm\n8dc7912f0ab55dff4cb2b1dc9262c22aa89d911cdb680d33213737597d865006  rocky-release-security-8-3.el8.noarch.rpm\n</code></pre> <p>This isn't as secure as checking the package signature would be if you previously had our package signing public key, but on another distro you probably don't have that yet, so checking the digest against its copy obtained from this separate website is a best-effort measure.</p>"},{"location":"#packages","title":"Packages","text":""},{"location":"#extra-packages-for-el8-and-el9","title":"Extra packages (for EL8 and EL9)","text":"<ul> <li>lkrg (Linux Kernel Runtime Guard)</li> <li>passwdqc (password/passphrase strength checking and policy enforcement)</li> </ul>"},{"location":"#extra-packages-currently-only-for-el9","title":"Extra packages (currently only for EL9)","text":"<ul> <li>control (a common interface to register and control security-relevant system facilities)</li> <li>hardened_malloc (security-focused memory allocator providing the malloc API, and a script to preload it into existing program binaries)</li> </ul>"},{"location":"#override-packages-for-el8-and-el9","title":"Override packages (for EL8 and EL9)","text":"<ul> <li>microcode_ctl (updates Intel CPU microcode to fix CVE-2023-23583)</li> </ul>"},{"location":"#override-packages-currently-only-for-el9","title":"Override packages (currently only for EL9)","text":"<ul> <li>glibc (adds many security-hardening changes originating from Owl and ALT Linux on top of EL package)</li> <li>openssh (fewer shared libraries exposed in sshd processes while otherwise fully matching EL package's functionality)</li> </ul> <p>The changes are described in more detail on the per-package wiki pages linked above, as well as in the package changelogs. More packages/changes are planned, including override packages also for EL8.</p>"},{"location":"#source-code","title":"Source code","text":"<p>Just like for other Rocky Linux SIGs, the source trees for Security SIG packages are maintained in per-package git repositories. Each repository contains branches <code>r8</code> and/or <code>r9</code> corresponding to target EL version.</p>"},{"location":"#contributing","title":"Contributing","text":"<p>If anyone else wants to join this effort - in any capacity including development, maintenance, testing, documentation, user support, spreading the word, or something else - please join the Mattermost channel below and let us know!</p> <p>We also welcome well-reasoned suggestions/feedback/preferences on direction we should take (e.g., only making changes on top of EL's vs. offering newer upstream versions), what else to package, and what other changes to include.</p>"},{"location":"#meetings-communications","title":"Meetings / Communications","text":"<p>We hang out in our Security Mattermost channel.</p>"},{"location":"#members","title":"Members","text":"<p>Some of the people active with setting up this SIG so far:</p> Name Mattermost Name @flawedworld Fredrik Nystr\u00f6m @nscfreny Louis Abel @label Mustafa @mustafa Neil Hanlon @neil Scott Shinn @atomicturtle Solar Designer @solardiz"},{"location":"issues/CVE-2023-23583/","title":"CVE-2023-23583: microcode_ctl","text":""},{"location":"issues/CVE-2023-23583/#title","title":"Title","text":"<p>CVE-2023-23583: microcode_ctl: Intel CPUs: execution of MOVSB instructions with redundant REX prefix leads to unintended system behavior</p>"},{"location":"issues/CVE-2023-23583/#summary","title":"Summary","text":"<p>As described by Intel:</p> <p>Under certain microarchitectural conditions, Intel has identified cases where execution of an instruction (REP MOVSB) encoded with a redundant REX prefix may result in unpredictable system behavior resulting in a system crash/hang, or, in some limited scenarios, may allow escalation of privilege from CPL3 to CPL0.</p> <p>and by Red Hat:</p> <p>A security vulnerability was found in some Intel processors. Execution of REP MOVSB instructions with a redundant REX prefix may result in execution continuing at an incorrect EIP address after a micro-architectural event occurs, potentially allowing privilege escalation, information disclosure and/or a denial of service via local access.</p> <p>as well as in CVE-2023-23583.</p> <p>More detail is available via these links to Intel's website and in the public disclosure by Tavis Ormandy from Google.</p> <p>Public disclosure date: November 14, 2023</p>"},{"location":"issues/CVE-2023-23583/#el9","title":"EL9","text":"<ul> <li>Fixed in version: <code>4:20231114-1.el9_2.security</code> available November 15, 2023</li> </ul>"},{"location":"issues/CVE-2023-23583/#el8","title":"EL8","text":"<ul> <li>Fixed in version <code>4:20230808-2.20231009.1.el8.security</code> available November 19, 2023</li> </ul> <p>Please refer to our override package of microcode_ctl.</p>"},{"location":"issues/CVE-2023-4911/","title":"CVE-2023-4911: glibc","text":""},{"location":"issues/CVE-2023-4911/#title","title":"Title","text":"<p>CVE-2023-4911: glibc: Looney Tunables: buffer overflow in ld.so leading to privilege escalation</p>"},{"location":"issues/CVE-2023-4911/#summary","title":"Summary","text":"<p>As described by Red Hat and in CVE-2023-4911:</p> <p>A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the <code>GLIBC_TUNABLES</code> environment variable. This issue could allow a local attacker to use maliciously crafted <code>GLIBC_TUNABLES</code> environment variables when launching binaries with SUID permission to execute code with elevated privileges.</p> <p>More detail is available in the public disclosure by Qualys, the team who discovered the issue.</p> <p>Public disclosure date: October 3, 2023</p>"},{"location":"issues/CVE-2023-4911/#el9","title":"EL9","text":"<ul> <li>Mitigated in version: <code>2.34-60.el9_2.security.0.2</code> available October 3, 2023</li> <li>Fixed in version: <code>glibc-2.34-60.el9_2.7</code> available October 5, 2023</li> </ul> <p>Besides the upstream fix, we also retained the mitigation in our override package of glibc.</p>"},{"location":"issues/CVE-2023-4911/#el8","title":"EL8","text":"<ul> <li>Fixed in version: <code>glibc-0:2.28-225.el8_8.6</code> available October 5, 2023</li> <li>Errata: RLSA-2023:5455 issued October 7, 2023</li> </ul>"},{"location":"packages/control/","title":"Extra package: control","text":""},{"location":"packages/control/#el9","title":"EL9","text":"<ul> <li>Version <code>0.8.0-4.el9_3.security</code></li> </ul>"},{"location":"packages/control/#package-summary","title":"Package summary","text":"<p><code>control</code> provides a common interface to register and control (what it calls) system facilities. This is intended primarily for facilities that can potentially be dangerous to system security, to let you enable, disable, or configure each facility. A typical facility is a configuration setting of a service or a SUID/SGID/setcap program, or a closely related group of such settings and/or programs that are managed together. We manage permissions on SUID/SGID/setcap programs because those programs pose risk to system security in case of vulnerabilities in them or in library code they use.</p> <p><code>control</code> originates in Owl and is actively maintained in ALT Linux.</p>"},{"location":"packages/control/#usage-in-rocky-linux","title":"Usage in Rocky Linux","text":"<p>While the original <code>control</code> package in Owl and ALT Linux merely provides the common interface mentioned above for other packages to register their facilities with (and many packages in those distros do), it's been adapted in Rocky Linux to provide its own sub-packages with facility specifications and RPM trigger scripts for other packages coming from EL. This way, we can <code>control</code> those facilities and have custom settings persist (be automatically saved and restored) over package upgrades without us having to maintain forks of those other packages.</p> <p>The available facilities, their current settings, and lists of possible settings can be queried by running the <code>control</code> command without parameters. With all currently available sub-packages installed, its output may be:</p> <pre><code>chage           public          (public restricted)\ngpasswd         public          (public wheelonly restricted)\nmount           public          (public wheelonly unprivileged restricted)\nnewgidmap       public          (public wheelonly restricted)\nnewgrp          public          (public wheelonly restricted)\nnewuidmap       public          (public wheelonly restricted)\nwrite           public          (public restricted)\n</code></pre> <p>The default settings (typically <code>public</code>) correspond to EL packages' defaults (and are typically the most relaxed security-wise).</p> <p>Please refer to <code>control(8)</code> man page for command-line usage syntax.</p>"},{"location":"packages/control/#sub-packages","title":"Sub-packages","text":"<p>Currently, there are 3 sub-packages:</p>"},{"location":"packages/control/#control","title":"control","text":"<p>The main package providing the common interface, but no facilities of its own.</p>"},{"location":"packages/control/#control-shadow-utils","title":"control-shadow-utils","text":"<p>Facility specifications corresponding to the <code>shadow-utils</code> package. Currently, these allow to <code>control</code> access to 5 privileged programs - 3 of them (<code>chage</code>, <code>gpasswd</code>, and <code>newgrp</code>) are by default SUID root and 2 (<code>newuidmap</code> and <code>newgidmap</code>) are <code>cap_setuid=ep</code>.</p>"},{"location":"packages/control/#control-util-linux","title":"control-util-linux","text":"<p>Facility specifications corresponding to the <code>util-linux</code> and <code>util-linux-core</code> packages. Currently, these allow to <code>control</code> access to 3 privileged programs - 2 of them (<code>mount</code> and <code>umount</code>) are by default SUID root and 1 (<code>write</code>) SGID <code>tty</code>.</p>"},{"location":"packages/control/#change-log","title":"Change log","text":"<pre><code>* Mon Dec 18 2023 Solar Designer &lt;solar@openwall.com&gt; 0.8.0-4\n- Add sub-package with facilities and triggers for util-linux\n\n* Mon Dec 18 2023 Solar Designer &lt;solar@openwall.com&gt; 0.8.0-3\n- Rename the shadow sub-package to shadow-utils\n- Rename the source files not to differentiate them by sub-package\n- Add \"Requires: shadow-utils\" in the shadow-utils sub-package\n\n* Wed Dec 13 2023 Solar Designer &lt;solar@openwall.com&gt; 0.8.0-2\n- In addition to Requires(pre), also use Requires in the sub-package\n- In %%triggerprein_control, pre-check that the facility exists\n- Use (renamed) copies of the trigger macros within this spec file\n\n* Wed Dec 13 2023 Solar Designer &lt;solar@openwall.com&gt; 0.8.0-1\n- Add macros for use in RPM triggers\n- Add sub-package with facilities and triggers for shadow-utils\n\n* Wed Dec  6 2023 Solar Designer &lt;solar@openwall.com&gt; 0.8.0-0\n- Initial packaging for EL based on ALT Linux and Owl packages\n</code></pre>"},{"location":"packages/glibc/","title":"Override package: glibc","text":""},{"location":"packages/glibc/#el9","title":"EL9","text":"<ul> <li>Version <code>2.34-83.7.el9_3.security.0.3</code></li> <li>Based on <code>2.34-83.el9.7</code></li> </ul>"},{"location":"packages/glibc/#changes-summary","title":"Changes summary","text":"<ul> <li>Distrust and/or unset many more environment variables used by current and previous glibc versions when running SUID/SGID/setcap (Owl via ALT Linux)</li> <li>When <code>syslog(3)</code>/<code>vsyslog(3)</code> is called by a SUID/SGID/setcap program without a preceding call to <code>openlog(3)</code>, don't blindly trust <code>__progname</code> for the syslog ident (Owl via ALT Linux)</li> <li>In <code>syslog(3)/vsyslog(3)</code> use <code>asctime_r(3)+localtime_r(3)</code> instead of <code>strftime_r()</code> so that month names don't depend on current locale settings (Owl via ALT Linux)</li> <li>In <code>asprintf(3)/vasprintf(3)</code> reset the pointer to NULL on error, like BSDs do, so that the caller wouldn't access memory over an uninitialized or stale pointer (ALT Linux)</li> <li>In <code>fread(3)/fwrite(3)</code> check for potential integer overflow (ALT Linux)</li> <li>In <code>tmpfile(3)</code> use the <code>TMPDIR</code> environment variable (when not running SUID/SGID/setcap) (ALT Linux)</li> </ul>"},{"location":"packages/glibc/#known-effective-vulnerability-mitigations-and-fixes","title":"Known-effective vulnerability mitigations and fixes","text":"<p><code>2.34-60.el9_2.security.0.2</code> included mitigations sufficient to avoid security exposure of CVE-2023-4911 and a backport of upstream glibc fix of CVE-2023-4527 that was not yet in upstream EL. In the update to <code>2.34-60.7.el9_2.security.0.3</code> and beyond, we retained the mitigations while rebasing on upstream EL's package with upstream fixes for these vulnerabilities (and more).</p> <p>In general, inclusion of additional security fixes will be \"reverted\" if and when those get included in upstream EL packages that we rebase our changes on.</p>"},{"location":"packages/glibc/#change-log","title":"Change log","text":"<pre><code>* Wed Nov 22 2023 Solar Designer &lt;solar@openwall.com&gt; - 2.34-83.7.el9.security.0.3\n- Rebase on 2.34-83.7, drop \"our\" CVE-2023-4527 patch in favor of RH's\n  (a similar rebase was made on Oct 6 in 2.34-60.7.el9.security.0.3 for 9.2)\n\n[... upstream changes ...]\n\n* Fri Oct  6 2023 Solar Designer &lt;solar@openwall.com&gt; - 2.34-60.7.el9.security.0.3\n- Rebase on 2.34-60.7, drop \"our\" CVE-2023-4527 patch in favor of RH's\n\n[... upstream changes ...]\n\n* Mon Oct  2 2023 Solar Designer &lt;solar@openwall.com&gt; - 2.34-60.el9.security.0.2\n- Add glibc-owl-alt-sanitize-env.patch stitched from several ALT Linux commits\n  as none of their revisions matched this package's set of backports as-is\n- Add glibc-upstream-no-aaaa-CVE-2023-4527.patch based on upstream commit\n  bd77dd7e73e3530203be1c52c8a29d08270cb25d fixing\n  CVE-2023-4527: Stack read overflow with large TCP responses in no-aaaa mode\n\n* Tue Sep 26 2023 Solar Designer &lt;solar@openwall.com&gt; - 2.34-60.el9.security.0.1\n- Revise the texinfo documentation edit of glibc-2.34-alt-asprintf.patch via\n  glibc-2.34-rocky-asprintf.patch\n\n* Sat Sep 23 2023 Solar Designer &lt;solar@openwall.com&gt; - 2.34-60.el9.security.0.0\n- Add some of the patches from ALT Linux as of when they were at 2.34:\n  https://git.altlinux.org/gears/g/glibc.git\n  git show 5fa32fb0f8509f4b2b1105d71b45966dfbadc099 &gt; glibc-2.34-alt-tmpfile.patch\n  git show f97e5d60a6a4c9cb64e3b9ee6f5113969cf07d87 &gt; glibc-2.34-alt-asprintf.patch\n  git show cd45d0f74560325cc48aedb9f56881270ab3dfab &gt; glibc-2.34-alt-libio-bound.patch\n  git show 436eb1017c04aee3a553c2868d00a4b046e5e394 &gt; glibc-2.34-owl-alt-syslog-ident.patch\n  git show 03a86c234873723c26b7e387c498c1332c223968 &gt; glibc-2.34-mjt-owl-alt-syslog-timestamp.patch\n</code></pre>"},{"location":"packages/hardened_malloc/","title":"Extra package: hardened_malloc","text":""},{"location":"packages/hardened_malloc/#el9","title":"EL9","text":"<ul> <li>Version <code>hardened_malloc-12-3.el9_2.security</code></li> <li>Based on upstream version <code>12</code></li> <li>No plans to support older Rocky Linux versions due to glibc being too old</li> </ul>"},{"location":"packages/hardened_malloc/#package-summary","title":"Package summary","text":"<p>This package ships the \"normal\" and \"light\" configurations of the GrapheneOS hardened_malloc project. The official README.md in the upstream project documents security properties and explains the differences between the regular and light variants.</p>"},{"location":"packages/hardened_malloc/#usage-in-rocky-linux","title":"Usage in Rocky Linux","text":"<p>It is strongly reccomended to read all documentation here before deploying this package on your infrastructure.</p> <p>In order to support the large amount of mappings caused by guard slabs and large allocation guard regions, the <code>vm.max_map_count</code> sysctl is increased as part of package installation to <code>1048576</code> in <code>/etc/sysctl.d/hardened_malloc.conf</code>. You'll need to run <code>sysctl -p /etc/sysctl.d/hardened_malloc.conf</code> for this change to take effect without a reboot. Incidentally, Fedora 39 made the same change, so it's not an exotic configuration.</p> <p>The package ships 2 builds of <code>hardened_malloc</code>, the regular variant, which is located at <code>/usr/lib64/libhardened_malloc.so</code> and can be preloaded using the <code>hardened_malloc_preload.sh</code> script, and the light variant, which is located at <code>/usr/lib64/libhardened_malloc-light.so</code> and can be preloaded using the <code>hardened_malloc_light_preload.sh</code> script. The preload scripts add the relevant library to <code>LD_PRELOAD</code> and then load the desired binary, as shown in the following example: <code>hardened_malloc_preload.sh cat /proc/self/maps</code>.</p> <p>Users may choose to set an OS-wide <code>LD_PRELOAD</code> with <code>hardened_malloc</code>. This can be done by adding the desired library, for example, <code>/usr/lib64/libhardened_malloc.so</code>, into your <code>/etc/ld.so.preload</code>. Be aware that for applications where <code>AT_SECURE</code> is set, this approach will not work.</p> <p>It is suggested that if you wish to deploy <code>hardened_malloc</code> systemwide, that you deploy it in your <code>LD_PRELOAD</code> with the normal variant globally, and then for applications which are performance sensitive, or which fail with the normal variant, try them individually with the light variant using the preload script or by setting <code>LD_PRELOAD</code> within a systemd service namespace. If that does not resolve your issue, try disabling <code>hardened_malloc</code> by running the program in its own systemd service namespace.</p>"},{"location":"packages/hardened_malloc/#bugs-uncovered-by-hardened_malloc","title":"Bugs uncovered by hardened_malloc","text":"<p>As with all infrastructure changes, ensure you test in your staging environment extensively before deploying into production. Many packages and projects suffer from memory corruption bugs, which when running under glibc are not encountered during operation, but which <code>hardened_malloc</code> uncovers. Some applications may crash during usage, completely break, or break when running with certain configurations. Bugs in packages are typically a result of upstream project bugs, and should be reported there. In some cases these bugs are fixed in later versions in the upstream project, in which case the bug is an issue with Rocky Linux, and should be reported to Rocky Linux and its upstream distribution, so that the patch may be included.</p> Package name Latest version tested Normal variant Light variant php php-8.0.30-1.el9_2.x86_64 Broken Broken php php-8.1.14-1.module+el9.2.0+15232+36037ab0.x86_64 Broken Broken sssd sssd-2.8.2-3.el9_2.x86_64 Broken Broken"},{"location":"packages/hardened_malloc/#potential-for-issues-with-edr","title":"Potential for issues with EDR","text":"<p>By nature of relying on <code>LD_PRELOAD</code>, if you have EDR software on your server, it may falsely send alerts when using <code>hardened_malloc</code>. If it doesn't, your EDR is probably terrible or misconfigured.</p>"},{"location":"packages/hardened_malloc/#change-log","title":"Change log","text":"<pre><code>* Tue Nov 14 2023 Solar Designer &lt;solar@openwall.com&gt; 12-3\n- Package hardened_malloc_light_preload.sh\n- Disable arm64 building for now (fix didn't work)\n\n* Wed Nov  8 2023 flawedworld &lt;flawedworld@flawed.world&gt; 12-2\n- Set CONFIG_NATIVE to false\n- Mark libraries as executable (change to 755 permissions)\n- Add hardened_malloc_light_preload.sh\n- Fix arm64 building\n\n* Sat Oct 28 2023 flawedworld &lt;flawedworld@flawed.world&gt; 12-1\n- Initial packaging for hardened_malloc version 12, co-authored-by\n  Scott Shinn (atomicturtle) and Solar Designer\n</code></pre>"},{"location":"packages/lkrg/","title":"Extra package: lkrg","text":""},{"location":"packages/lkrg/#el9","title":"EL9","text":"<ul> <li>Version <code>0.9.7-4.el9_3.security</code></li> <li>Based on upstream version <code>0.9.7</code></li> </ul>"},{"location":"packages/lkrg/#el8","title":"EL8","text":"<ul> <li>Version <code>0.9.7-4.el8_9.security</code></li> <li>Based on upstream version <code>0.9.7</code></li> </ul>"},{"location":"packages/lkrg/#package-summary","title":"Package summary","text":"<p>LKRG, or Linux Kernel Runtime Guard, is a kernel module that performs runtime integrity checking of the Linux kernel and detection of security vulnerability exploits against the kernel.</p> <p>More information is available on the LKRG homepage and in the documentation files included in the package.</p>"},{"location":"packages/lkrg/#usage-in-rocky-linux","title":"Usage in Rocky Linux","text":"<p>Due to EL's kABI stability and the <code>weak-modules</code> mechanism, which this package uses, the same binary package of LKRG works across different kernel revisions/builds within the same EL minor release (e.g., 9.3). Once there's a new minor release (e.g., 9.3 is upgraded to 9.4), we'll provide a new build of LKRG accordingly.</p> <p>Installing the package does not automatically start LKRG nor enable it to start on system bootup. To start LKRG please use:</p> <pre><code>systemctl start lkrg\n</code></pre> <p>To enable LKRG on bootup please use:</p> <pre><code>systemctl enable lkrg\n</code></pre>"},{"location":"packages/lkrg/#testing-and-recovery","title":"Testing and recovery","text":"<p>Although the current package passed our own testing (on 9.3 and 8.9), we recommend that you only enable LKRG to start on system bootup after you've tested it for a while to ensure its compatibility with your system. If you nevertheless run into a boot time issue with LKRG later, you can disable it with the <code>nolkrg</code> kernel command-line option.</p>"},{"location":"packages/lkrg/#change-log","title":"Change log","text":"<p>The 0.9.7-4 source package was originally built for (and tested on) 9.2 and 8.8, then rebuilt without source level changes for 9.3 and 8.9 (and re-tested on those versions).</p> <pre><code>* Wed Nov 08 2023 Solar Designer &lt;solar@openwall.com&gt; 0.9.7-4\n- Add a couple of upstream patches, most notably to fix kINT false positives on\nEL 8.8.\n\n* Tue Oct 24 2023 Solar Designer &lt;solar@openwall.com&gt; 0.9.7-3\n- Use weak-modules if available so that on RHEL and its rebuilds the same LKRG\n  package build works across different kABI-compatible kernel revisions/builds\n- Drop 32-bit x86 from ExclusiveArch since recent RHEL lacks such kernel-devel\n\n* Thu Sep 14 2023 Solar Designer &lt;solar@openwall.com&gt; 0.9.7-2\n- Use kernel build directory corresponding to the kernel-devel package, not to\nthe currently running kernel\n- \"BuildRequires: kernel\" for the /lib/modules/* directory\n- \"BuildRequires: elfutils-libelf-devel\" to support CONFIG_UNWINDER_ORC=y\n\n* Thu Sep 14 2023 Solar Designer &lt;solar@openwall.com&gt; 0.9.7-1\n- Wrote this rough RPM spec file for Red Hat'ish distros, seems to work fine on\nRHEL 7, 8, 9 rebuilds, but is only reliable when there's exactly one\nkernel-devel package installed at build time and it exactly matches the target\nkernel version.\n</code></pre>"},{"location":"packages/microcode_ctl/","title":"Override package: microcode_ctl","text":""},{"location":"packages/microcode_ctl/#el9","title":"EL9","text":"<ul> <li>Version <code>4:20231114-1.el9_2.security</code></li> <li>Based on <code>4:20230808-2.el9</code></li> </ul> <p>This is our custom revision of a post-9.2 EL9 package. We use Intel's latest released microcode.</p>"},{"location":"packages/microcode_ctl/#el8","title":"EL8","text":"<ul> <li>Version <code>4:20230808-2.20231009.1.el8.security</code></li> <li>Based on <code>4:20230808-2.20231009.1.el8</code></li> </ul> <p>This is a rebuild of the 8.9 package as-is to make it available for 8.8. It uses Intel's fixed microcode revision that was provided to distros privately in preparation for the coordinated disclosure.</p>"},{"location":"packages/microcode_ctl/#changes-summary","title":"Changes summary","text":"<p>For EL9:</p> <ul> <li>Update Intel CPU microcode to fix CVE-2023-23583, temporarily dropping most documentation patches</li> </ul>"},{"location":"packages/microcode_ctl/#change-log","title":"Change log","text":"<p>For EL9:</p> <pre><code>* Tue Nov 14 2023 Solar Designer &lt;solar@openwall.com&gt; - 4:20231114-1\n- Update Intel CPU microcode to microcode-20231114 (fixes CVE-2023-23583),\n  temporarily dropping most documentation patches\n</code></pre>"},{"location":"packages/openssh/","title":"Override package: openssh","text":""},{"location":"packages/openssh/#el9","title":"EL9","text":"<ul> <li>Version <code>8.7p1-34.el9_3.security.0.1</code></li> <li>Based on <code>8.7p1-34.el9</code></li> </ul>"},{"location":"packages/openssh/#changes-summary","title":"Changes summary","text":"<ul> <li>Instead of linking against <code>libsystemd</code>, load it dynamically in a temporary child process to avoid polluting actual <code>sshd</code>'s address space with that library and its many dependencies (shortens <code>ldd sshd</code> output from 28 to 20 lines)</li> </ul>"},{"location":"packages/openssh/#change-log","title":"Change log","text":"<pre><code>* Wed Nov 22 2023 Solar Designer &lt;solar@openwall.com&gt; 8.7p1-34.el9_3.security.0.1\n- Rebase 8.7p1-30.el9.security.0.2 on 8.7p1-34\n\n* Sat Oct 07 2023 Solar Designer &lt;solar@openwall.com&gt; 8.7p1-30.el9.security.0.2\n- Load libsystemd.so.0, not libsystemd.so, as the latter is only provided by\n  systemd-devel\n\n* Mon Aug 28 2023 Solar Designer &lt;solar@openwall.com&gt; 8.7p1-30.el9.security.0.1\n- Instead of linking against libsystemd, load it dynamically in a temporary\n  child process to avoid polluting actual sshd's address space with that\n  library and its many dependencies (shortens \"ldd sshd\" from 28 to 20 lines)\n</code></pre>"},{"location":"packages/passwdqc/","title":"Extra package: passwdqc","text":""},{"location":"packages/passwdqc/#el9","title":"EL9","text":"<ul> <li>Version <code>2.0.3-2.el9_2.security</code></li> <li>Based on upstream version <code>2.0.3-2</code> as packaged in Fedora</li> </ul>"},{"location":"packages/passwdqc/#el8","title":"EL8","text":"<ul> <li>Version <code>2.0.3-2.el8.security</code></li> <li>Based on upstream version <code>2.0.3-2</code> as packaged in Fedora</li> </ul>"},{"location":"packages/passwdqc/#package-summary","title":"Package summary","text":"<p><code>passwdqc</code> is a password/passphrase strength checking and policy enforcement toolset, including a PAM module (<code>pam_passwdqc</code>), command-line programs (<code>pwqcheck</code>, <code>pwqfilter</code>, and <code>pwqgen</code>), and a library (<code>libpasswdqc</code>).</p> <p>More information is available on the passwdqc homepage and in the documentation files (man pages and a README) included in the sub-packages below.</p>"},{"location":"packages/passwdqc/#usage-in-rocky-linux","title":"Usage in Rocky Linux","text":"<p>There are 5 sub-packages:</p>"},{"location":"packages/passwdqc/#pam_passwdqc","title":"pam_passwdqc","text":"<p><code>pam_passwdqc</code> is a PAM module that is normally invoked on password changes by programs such as <code>passwd(1)</code>. It is capable of checking password or passphrase strength, enforcing a policy, and offering randomly-generated passphrases, with all of these features being optional and easily (re-)configurable.</p> <p>Merely installing this sub-package does not yet configure the system to use the PAM module. To do so, please edit PAM configuration files e.g. like shown here.</p>"},{"location":"packages/passwdqc/#passwdqc-utils","title":"passwdqc-utils","text":"<p><code>pwqcheck</code> and <code>pwqgen</code> are standalone password/passphrase strength checking and random passphrase generator programs, respectively, which are usable from scripts.</p> <p>The <code>pwqfilter</code> program searches, creates, or updates binary passphrase filter files, which can also be used with <code>pwqcheck</code> and <code>pam_passwdqc</code>. This can be used for checking of user-provided passwords against existing data breaches, which is recommended in the current NIST guidance, specifically in publication 800-63B sections 5.1.1.2 and A.3. Paid pre-generated filter files are available from Openwall at the project homepage above, but with this tool you can also generate your own.</p>"},{"location":"packages/passwdqc/#libpasswdqc","title":"libpasswdqc","text":"<p><code>libpasswdqc</code> is the underlying library, which may also be used from third-party programs.</p>"},{"location":"packages/passwdqc/#libpasswdqc-devel","title":"libpasswdqc-devel","text":"<p>This package contains development files needed for building passwdqc-aware applications, as well as documentation (man pages) for developing such applications.</p>"},{"location":"packages/passwdqc/#passwdqc","title":"passwdqc","text":"<p><code>passwdqc</code> is a meta sub-package that installs (via dependencies) the actual sub-packages above, except for <code>libpasswdqc-devel</code>.</p>"}]}
\ No newline at end of file
diff --git a/sitemap.xml b/sitemap.xml
index b6e4fdc..f5e143c 100644
--- a/sitemap.xml
+++ b/sitemap.xml
@@ -2,52 +2,52 @@
 <urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">
     <url>
          <loc>https://sig-security.rocky.page/</loc>
-         <lastmod>2023-12-14</lastmod>
+         <lastmod>2023-12-18</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://sig-security.rocky.page/issues/CVE-2023-23583/</loc>
-         <lastmod>2023-12-14</lastmod>
+         <lastmod>2023-12-18</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://sig-security.rocky.page/issues/CVE-2023-4911/</loc>
-         <lastmod>2023-12-14</lastmod>
+         <lastmod>2023-12-18</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://sig-security.rocky.page/packages/control/</loc>
-         <lastmod>2023-12-14</lastmod>
+         <lastmod>2023-12-18</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://sig-security.rocky.page/packages/glibc/</loc>
-         <lastmod>2023-12-14</lastmod>
+         <lastmod>2023-12-18</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://sig-security.rocky.page/packages/hardened_malloc/</loc>
-         <lastmod>2023-12-14</lastmod>
+         <lastmod>2023-12-18</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://sig-security.rocky.page/packages/lkrg/</loc>
-         <lastmod>2023-12-14</lastmod>
+         <lastmod>2023-12-18</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://sig-security.rocky.page/packages/microcode_ctl/</loc>
-         <lastmod>2023-12-14</lastmod>
+         <lastmod>2023-12-18</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://sig-security.rocky.page/packages/openssh/</loc>
-         <lastmod>2023-12-14</lastmod>
+         <lastmod>2023-12-18</lastmod>
          <changefreq>daily</changefreq>
     </url>
     <url>
          <loc>https://sig-security.rocky.page/packages/passwdqc/</loc>
-         <lastmod>2023-12-14</lastmod>
+         <lastmod>2023-12-18</lastmod>
          <changefreq>daily</changefreq>
     </url>
 </urlset>
\ No newline at end of file
diff --git a/sitemap.xml.gz b/sitemap.xml.gz
index a8f3f259ac70e90c8343424a54ebda18289b407c..bad118b96f22bcbad7870657239a449cdbae2a3d 100644
GIT binary patch
literal 305
zcmV-10nYv(iwFqixqxK?|8r?{Wo=<_E_iKh0M(VTZi6rohW9)LVh0CkB~pPiRP7VA
zT_e}N7z<+)pDE?-Ye-Zvcc{WGXaD-|*EgK(>iFI1=nEVwYw9>l_i+S<TcM1s<M+4M
zq>PVrR}D@h_$ZhS)^X!~|3t_*jwvb+9qTc*P7>rzxFETSWS<^lx{E^10oT(~mA0JD
zDHvi<$pnE9PWdTymbX*dGYO<3vui!X(05kQe4iIdmM2*mEH`as;|((s&JHeAFr}x8
ztduJa`NjDQm_i%?$@9lcvY_O}V_9qm_u-Ib_e<L|-iD5ZTjQP88z7Zheew-(Hp~ey
zAWj|AVQ>S)x(%<&{bP2D2iXcZaleIywLKWbW&@->Lmb8BA9i(V;g6#~EwAsB69)hQ
Dol1=g

literal 306
zcmV-20nPp&iwFqNfqP{F|8r?{Wo=<_E_iKh0M(UEZi6roh4(oHVvo&FDkT+=Mb)05
z?KX1lDOecW@t9I>Uqhmbbr)5b&Dc+Gp1#G%E>GXRioU?1G`fm2lEx8eZiLiL6~Dc{
zB!~D^@5;d`1Rn*n#wu>Tw~v&L<490?=$S=gTtkt!;ezxg(v%$IdKZP71Fol~N@aLG
zr(lRd*(3;jaMDl28Qx9AvIb~LXV-d&q3?~T^E5A#EKjn1u-vqjjkioU@af=E3ntZ6
z(v@<hp}#nP0h5RWAbom&P8O8BcsLZ>!QCIT?0#u2<6Y=TxzXMkwE@yb$q&8(&Xzd=
z8pOG0DhzIbSaso5xqr-F@*o=lXYRMKu*QN$Y&Sq^8R94||FEk|3x8bw1MQ@ho)ZTE
E05QRnApigX