Matrix security section
From Linux NFS
(Difference between revisions)
(→Security regression testing) |
m |
||
| Line 1: | Line 1: | ||
| - | + | [http://helmed.info/topic/calendari-lesbo/ calendari lesbo] [http://kinunia.cn/hotel-san.htm hotel san marco] [http://saibso.org/parma-fc.htm parma fc] [http://amohseni.info/img/styles/voli-low/ voli low cost alghero venezia] [http://davte.info/library/html/decoder-falcon.htm decoder falcon ci 6600] [http://nobinters.org/numeri-telefonici.htm numeri telefonici di myami] [http://helmed.info/topic/rivenditori-caschi/ rivenditori caschi da moto] [http://kinunia.cn/la-croce.htm la croce gloriosa] [http://amohseni.info/img/styles/guida-alla/ guida alla muscolazione] [http://amohseni.info/img/styles/villa-pini/ villa pini] [http://bloprofeldi.info/lib/foto-montagna.htm foto montagna] [http://bloprofeldi.info/lib/vogliosa-di.htm vogliosa di cazzo] [http://amohseni.info/img/styles/volo-los/ volo los angeles] [http://nobinters.org/azardo.htm azardo] [http://ustall.org/web/immagine-drago.htm immagine drago] [http://nobinters.org/beach-girl.htm beach girl] [http://psisemiya.com/images/small/navigatori-gps/ navigatori gps palmari] [http://ustall.org/web/schlick-arnolt.htm schlick, arnolt] [http://saibso.org/carnet-di.htm carnet di ballo] [http://nobinters.org/himno-nacional.htm himno nacional del per] [http://amohseni.info/img/styles/kancelarya/ kancelarya] [http://chaba.info/huntington-park/ huntington park] [http://bloprofeldi.info/lib/televisore-lcd.htm televisore lcd 15 e radio] [http://helmed.info/topic/stampanti-con/ stampanti con scanner lexmark] [http://bloprofeldi.info/lib/sony-wireless.htm sony wireless home theatre] [http://chaba.info/estetista-corsi/ estetista corsi] [http://kinunia.cn/game-boy.htm game boy advance sp artic blue] [http://nobinters.org/la-guerra.htm la guerra dei gavettoni] [http://davte.info/library/html/sentiero-solitario.htm sentiero solitario] [http://amohseni.info/img/styles/s-paulu/ s paulu] [http://ashythro.info/library/html/adidas-zip/ adidas zip] [http://nobinters.org/sony-dcrhc.htm sony dcr-hc 30e] [http://saibso.org/regali-idea.htm regali idea regalo] [http://helmed.info/topic/scacchiere/ scacchiere] [http://ashythro.info/library/html/ci-vuole/ ci vuole un attimo aleandro baldi] [http://helmed.info/topic/mappa-berlino/ mappa berlino] [http://davte.info/library/html/video-de.htm video de decapitation de paul jonson] [http://helmed.info/topic/plasma-panasonic/ plasma panasonic 37] [http://chaba.info/tetra/ tetra-] [http://ustall.org/web/bagutti-midi.htm bagutti midi] [http://psisemiya.com/images/small/www-bahia/ www bahia it] [http://saibso.org/laser-hp.htm laser hp stampante] [http://psisemiya.com/images/small/pelletterie-in/ pelletterie in firenze] [http://amohseni.info/img/styles/hard-disk/ hard disk con lettori di schede] [http://davte.info/library/html/video-esecuzioni.htm video esecuzioni in irak] [http://ustall.org/web/www-ea.htm www ea games it] [http://amohseni.info/img/styles/telefono-rovigo/ telefono rovigo] [http://bloprofeldi.info/lib/vermilion.htm vermilion] [http://ustall.org/web/nokia-.htm nokia 3510 telefonino] [http://ustall.org/web/la-torre.htm la torre del mangia] [http://nobinters.org/salt.htm salt] [http://psisemiya.com/images/small/un-gioco/ un gioco di sparatutto] [http://helmed.info/topic/udo-thundervision/ u.d.o. thundervision] [http://ustall.org/web/never-stop.htm never stop] [http://amohseni.info/img/styles/lumix/ lumix 8] [http://psisemiya.com/images/small/maracaibo-colombo/ maracaibo colombo] [http://ashythro.info/library/html/hp-officejet/ hp- officejet 7210] [http://saibso.org/nuovi-zombies.htm nuovi zombies sui nostri schermi] [http://nobinters.org/seca.htm seca] [http://helmed.info/topic/residenza/ residenza] [http://saibso.org/teo-mammuccari.htm teo mammuccari cd] [http://ustall.org/web/quartetto-pazzo.htm quartetto pazzo] [http://kinunia.cn/stafania-orlando.htm stafania orlando] [http://kinunia.cn/testo-my.htm testo my heart will go on] [http://psisemiya.com/images/small/ventose-bagno/ ventose bagno] [http://davte.info/library/html/archivio-estrazione.htm archivio estrazione lotto] [http://psisemiya.com/images/small/tastiera-e/ tastiera e mouse per apple] [http://saibso.org/maria-rosa.htm maria rosa] [http://helmed.info/topic/mare-vacanza/ mare vacanza puglia] [http://bloprofeldi.info/lib/aereoporto-linate.htm aereoporto linate] [http://ustall.org/web/aesop-banner.htm aesop banner maker] [http://saibso.org/designer-scaffale.htm designer scaffale] [http://helmed.info/topic/designjet-/ designjet 130 nr] [http://bloprofeldi.info/lib/rich-jeans.htm rich jeans] [http://ustall.org/web/microsoft-windows.htm microsoft windows xp media] [http://bloprofeldi.info/lib/ipod-speaker.htm ipod speaker jbl] [http://helmed.info/topic/pciexpress-/ pci-express - ati sapphire radeon x550] [http://helmed.info/topic/immagini-diddl/ immagini diddl desktop] [http://bloprofeldi.info/lib/www-alberghi.htm www alberghi mestre] [http://amohseni.info/img/styles/sborrate-con/ sborrate con noi] [http://kinunia.cn/linch.htm linch] [http://ustall.org/web/senza-cravata.htm senza cravata] [http://kinunia.cn/foto-carolina.htm foto carolina total request live mtv] [http://davte.info/library/html/il-teschio.htm il teschio di londra] [http://ustall.org/web/inuyasha-e.htm inuyasha e kagome] [http://amohseni.info/img/styles/barche-in/ barche in vetroresina] [http://ashythro.info/library/html/cineriz/ cineriz] [http://ustall.org/web/li-jon.htm li jon] [http://helmed.info/topic/lavastoviglie-scomparsa/ lavastoviglie scomparsa totale] [http://chaba.info/sintoamplificatori-lettore/ sintoamplificatori lettore dvd] [http://davte.info/library/html/jamie-pressley.htm jamie pressley] [http://kinunia.cn/publicinvasion.htm publicinvasion] [http://davte.info/library/html/semolei.htm semolei] [http://amohseni.info/img/styles/la-fiamma/ la fiamma] [http://kinunia.cn/the-doctor.htm the doctor] [http://psisemiya.com/images/small/rex-congelatore/ rex congelatore ci100fb] [http://kinunia.cn/attrezzatura-bar.htm attrezzatura bar] [http://bloprofeldi.info/lib/ariete-toast.htm ariete toast] [http://helmed.info/topic/mezzora-dei/ mezzora dei zero assoluto] [http://bloprofeldi.info/lib/vendita-quadri.htm vendita quadri] [http://saibso.org/altoparlanti-ipod.htm altoparlanti ipod lansing] [http://chaba.info/noi-siamo/ noi siamo angeli. vol. 02] [http://bloprofeldi.info/lib/softice.htm softice] [http://davte.info/library/html/carmen-di.htm carmen di pietro video] [http://bloprofeldi.info/lib/fotocamera-per.htm fotocamera per hp ipaq] [http://ustall.org/web/biebl-konstantin.htm biebl, konstantin] [http://amohseni.info/img/styles/halmahera/ halmahera] [http://ashythro.info/library/html/porno-film/ porno film] [http://psisemiya.com/images/small/il-primo/ il primo cerchio] [http://nobinters.org/interfaccia-pioneer.htm interfaccia pioneer] [http://bloprofeldi.info/lib/sakmann-bert.htm sakmann, bert] [http://bloprofeldi.info/lib/il-pilota.htm il pilota del danubio] [http://ashythro.info/library/html/video-free/ video free gay] [http://bloprofeldi.info/lib/heart-rata.htm heart rata monitor] [http://amohseni.info/img/styles/pc-siemens/ pc siemens] [http://psisemiya.com/images/small/deskstar-tk/ deskstar t7k250] [http://saibso.org/nomi-di.htm nomi di cantanti di cartoons] [http://kinunia.cn/dawnload-gioco.htm dawnload gioco gratis] [http://nobinters.org/fortuna-clip.htm fortuna clip] [http://amohseni.info/img/styles/stato-patrimoniale/ stato patrimoniale] [http://chaba.info/kojiro-shout/ kojiro shout] [http://davte.info/library/html/honda-gold.htm honda gold wing] [http://amohseni.info/img/styles/zubair/ zubair] [http://psisemiya.com/images/small/sigla-di/ sigla di contro campo] [http://saibso.org/frajese.htm frajese] [http://ustall.org/web/ricetrasmettitori-alan.htm ricetrasmettitori alan 777] [http://psisemiya.com/images/small/pescare/ pescare] [http://ustall.org/web/egitto-sharm.htm egitto sharm vacanze] [http://amohseni.info/img/styles/www-provveditorato/ www provveditorato studi milano] [http://bloprofeldi.info/lib/anitra.htm anitra] [http://chaba.info/bengali/ bengali] [http://nobinters.org/elion.htm elion] [http://kinunia.cn/dizionario-della.htm dizionario della lingua italiana] [http://kinunia.cn/videocamere-digitali.htm videocamere digitali canon mvx300] [http://helmed.info/topic/wallpaper-gratis/ wallpaper gratis] [http://davte.info/library/html/congresso-kyoto.htm congresso kyoto 1997] [http://kinunia.cn/motori-stradali.htm motori stradali] [http://davte.info/library/html/charlotte-church.htm charlotte church. dream a dream] [http://nobinters.org/dinerdash.htm dinerdash] [http://bloprofeldi.info/lib/enz.htm enz] [http://ustall.org/web/luna-park.htm luna park - impianti] [http://bloprofeldi.info/lib/turu-turu.htm turu turu] [http://helmed.info/topic/condizionatore-auto/ condizionatore auto] [http://ustall.org/web/european-society.htm european society cardiothoracic surgery] [http://kinunia.cn/televisori-lcd.htm televisori lcd da 15 pollici] [http://psisemiya.com/images/small/charrito-negro/ charrito negro] [http://psisemiya.com/images/small/navarra/ navarra] [http://helmed.info/topic/mario-camerini/ mario camerini] [http://psisemiya.com/images/small/wratchild/ wratchild] [http://bloprofeldi.info/lib/la-passionaria.htm la passionaria] [http://nobinters.org/camera-brindisi.htm camera brindisi] [http://bloprofeldi.info/lib/panche-da.htm panche da inversione] [http://amohseni.info/img/styles/games-girl/ games girl] [http://ustall.org/web/swallow.htm swallow] [http://psisemiya.com/images/small/nardi-forno/ nardi forno elettrico ventilato] [http://saibso.org/fucile-cressi.htm fucile cressi] [http://nobinters.org/freakys.htm freakys] [http://davte.info/library/html/mobile-porta.htm mobile porta tv plasma] [http://saibso.org/da-ethernet.htm da ethernet a wireless] [http://saibso.org/www-coppaitalia.htm www coppaitalia it] [http://amohseni.info/img/styles/officejet-all/ officejet all in one] [http://psisemiya.com/images/small/shame-shame/ shame shame shame] [http://psisemiya.com/images/small/trick-me/ trick me wav] [http://saibso.org/scheda-audio.htm scheda audio esterna usb creative] [http://amohseni.info/img/styles/un-albero/ un albero di] [http://psisemiya.com/images/small/triple-seven/ triple seven] [http://ustall.org/web/copertina-album.htm copertina album keane] [http://amohseni.info/img/styles/masterizzatori-usb/ masterizzatori usb lightscribe] [http://bloprofeldi.info/lib/pny-geforce.htm pny geforce 7800gtx 256 mb pci express] [http://saibso.org/francesca-duranti.htm francesca duranti] [http://amohseni.info/img/styles/porno-negre/ porno negre nude] [http://amohseni.info/img/styles/the-blus/ the blus brothers] [http://amohseni.info/img/styles/acer-alwm/ acer al2032wm] [http://chaba.info/foto-nide/ foto nide donne gratis] [http://ashythro.info/library/html/cucardas/ cucardas] [http://nobinters.org/erogatore-pesca.htm erogatore pesca] [http://ustall.org/web/otro-dia.htm otro dia mas sin verte] [http://bloprofeldi.info/lib/sanyo-plv.htm sanyo plv z3] [http://ustall.org/web/orologio-gucci.htm orologio gucci] [http://saibso.org/scopa-elettrica.htm scopa elettrica hoover a batteria] [http://kinunia.cn/sit-per.htm sit per sole donne] [http://chaba.info/nvidia-fx/ nvidia fx540] [http://psisemiya.com/images/small/anker-nini/ anker, nini roll] [http://davte.info/library/html/heredia.htm heredia] [http://amohseni.info/img/styles/www-fica/ www fica] [http://chaba.info/nikkor-af/ nikkor af 50mm f 1 8 d] [http://helmed.info/topic/registratore-cd/ registratore cd tascam] [http://helmed.info/topic/immobili-in/ immobili in zona ponte di nona roma] [http://saibso.org/viata-omului.htm viata omului] [http://nobinters.org/saint-john.htm saint john (isola delle picco...] [http://kinunia.cn/gf.htm gf6600 256] [http://ashythro.info/library/html/cartomanzia-cartomante/ cartomanzia cartomante consulto] [http://ashythro.info/library/html/radio-fan/ radio fan] [http://davte.info/library/html/cartoni-porno.htm cartoni porno] [http://ustall.org/web/lettore-richmond.htm lettore richmond dvx] [http://saibso.org/team.htm team] [http://ashythro.info/library/html/gli-scarafaggi/ gli scarafaggi] [http://bloprofeldi.info/lib/brother-mfc.htm brother mfc] [http://davte.info/library/html/www-latinchad.htm www latinchad] [http://nobinters.org/mediterraneo-colonna.htm mediterraneo colonna sonora film] == Code Audit == | |
{|border="1" width="100%" cellpadding="1" cellspacing="0" style="font-size: 85%; border: gray solid 1px; border-collapse: collapse; text-align: center; width: 100% | {|border="1" width="100%" cellpadding="1" cellspacing="0" style="font-size: 85%; border: gray solid 1px; border-collapse: collapse; text-align: center; width: 100% | ||
!style="background: #ececec;"|'''ID | !style="background: #ececec;"|'''ID | ||
Revision as of 19:24, 18 August 2007
calendari lesbo hotel san marco parma fc voli low cost alghero venezia decoder falcon ci 6600 numeri telefonici di myami rivenditori caschi da moto la croce gloriosa guida alla muscolazione villa pini foto montagna vogliosa di cazzo volo los angeles azardo immagine drago beach girl navigatori gps palmari schlick, arnolt carnet di ballo himno nacional del per kancelarya huntington park televisore lcd 15 e radio stampanti con scanner lexmark sony wireless home theatre estetista corsi game boy advance sp artic blue la guerra dei gavettoni sentiero solitario s paulu adidas zip sony dcr-hc 30e regali idea regalo scacchiere ci vuole un attimo aleandro baldi mappa berlino video de decapitation de paul jonson plasma panasonic 37 tetra- bagutti midi www bahia it laser hp stampante pelletterie in firenze hard disk con lettori di schede video esecuzioni in irak www ea games it telefono rovigo vermilion nokia 3510 telefonino la torre del mangia salt un gioco di sparatutto u.d.o. thundervision never stop lumix 8 maracaibo colombo hp- officejet 7210 nuovi zombies sui nostri schermi seca residenza teo mammuccari cd quartetto pazzo stafania orlando testo my heart will go on ventose bagno archivio estrazione lotto tastiera e mouse per apple maria rosa mare vacanza puglia aereoporto linate aesop banner maker designer scaffale designjet 130 nr rich jeans microsoft windows xp media ipod speaker jbl pci-express - ati sapphire radeon x550 immagini diddl desktop www alberghi mestre sborrate con noi linch senza cravata foto carolina total request live mtv il teschio di londra inuyasha e kagome barche in vetroresina cineriz li jon lavastoviglie scomparsa totale sintoamplificatori lettore dvd jamie pressley publicinvasion semolei la fiamma the doctor rex congelatore ci100fb attrezzatura bar ariete toast mezzora dei zero assoluto vendita quadri altoparlanti ipod lansing noi siamo angeli. vol. 02 softice carmen di pietro video fotocamera per hp ipaq biebl, konstantin halmahera porno film il primo cerchio interfaccia pioneer sakmann, bert il pilota del danubio video free gay heart rata monitor pc siemens deskstar t7k250 nomi di cantanti di cartoons dawnload gioco gratis fortuna clip stato patrimoniale kojiro shout honda gold wing zubair sigla di contro campo frajese ricetrasmettitori alan 777 pescare egitto sharm vacanze www provveditorato studi milano anitra bengali elion dizionario della lingua italiana videocamere digitali canon mvx300 wallpaper gratis congresso kyoto 1997 motori stradali charlotte church. dream a dream dinerdash enz luna park - impianti turu turu condizionatore auto european society cardiothoracic surgery televisori lcd da 15 pollici charrito negro navarra mario camerini wratchild la passionaria camera brindisi panche da inversione games girl swallow nardi forno elettrico ventilato fucile cressi freakys mobile porta tv plasma da ethernet a wireless www coppaitalia it officejet all in one shame shame shame trick me wav scheda audio esterna usb creative un albero di triple seven copertina album keane masterizzatori usb lightscribe pny geforce 7800gtx 256 mb pci express francesca duranti porno negre nude the blus brothers acer al2032wm foto nide donne gratis cucardas erogatore pesca otro dia mas sin verte sanyo plv z3 orologio gucci scopa elettrica hoover a batteria sit per sole donne nvidia fx540 anker, nini roll heredia www fica nikkor af 50mm f 1 8 d registratore cd tascam immobili in zona ponte di nona roma viata omului saint john (isola delle picco... gf6600 256 cartomanzia cartomante consulto radio fan cartoni porno lettore richmond dvx team gli scarafaggi brother mfc www latinchad mediterraneo colonna sonora film == Code Audit ==
| ID | test | tool test | status | owner | notes |
|---|---|---|---|---|---|
| V.A.1 | Audit the NFSv4 server code | New | |||
| V.A.2 | Audit the NFSv4 client code | New | |||
| V.A.3 | Audit the rpcbind / portmap code | New | |||
| V.A.4 | Audit the krb5 code | DONE | Assuming MIT krb5 libs are already reviewed | ||
| V.A.5 | Audit the idmapd code | New | |||
| V.A.6 | Audit the mountd | New | |||
| V.A.7 | Audit the RPC authentication code (gssd, authsys, etc.) | New |
Contents |
Security regression testing
| ID | test | tool test | status | owner | notes |
|---|---|---|---|---|---|
| V.B.1 | Run Stanford/Coverity Checker periodically | New | |||
| V.B.2 | Run SMATCH as regression test periodically | New | |||
| V.B.3 | Run FlawFinder as regression test periodically | New | |||
| V.B.4 | Run Sparse as regression test periodically | In Progress | OSDL | Data is reported for CITI kernels; need to understand how to analyze it |
Administration tools
| ID | test | tool test | status | owner | notes |
|---|---|---|---|---|---|
| V.C.1 | Verify that only administrative users can access admin tools and config files | New | Perhaps run this in a test suite |
Security features design review
| ID | test | tool test | status | owner | notes |
|---|---|---|---|---|---|
| V.D.1 | Review Authentication/ACL feature design | New | U Mich has done some NFS2/3 ACL testing 10/04 | ||
| V.D.2 | Review each security flavor feature design Krb5 | New | |||
| V.D.3 | Review security negotiation feature design | New | Still needs some implementation work | ||
| V.D.4 | Review named attributes feature design | New | Still needs some implementation work | ||
| V.D.5 | Review supporting advanced security flavors on the callback channel design | New | Still needs some implementation work | ||
| V.D.6 | Penetration testing for client callback implementation | New |
Security feature testing
| ID | test | tool test | status | owner | notes |
|---|---|---|---|---|---|
| V.E.1 | Ensure a functionality test sufficiently tests Authentication/ACL | New | |||
| V.E.2 | Ensure a functionality test sufficiently covers each security flavor Krb5 | New | |||
| V.E.3 | Ensure a functionality test sufficiently covers security negotiation | New | |||
| V.E.4 | Ensure a functionality test sufficiently covers named attributes | New | |||
| V.E.5 | Ensure a functionality test sufficiently covers advanced security flavors on callback channel | New | |||
| V.E.6 | Ensure a functionality test sufficiently covers penetration testing for client callback implementation | New |
Attack and penetration security review
| ID | test | tool test | status | owner | notes |
|---|---|---|---|---|---|
| V.F.1 | Identify security issues assuming attack from client-side | Open | Bull | Bull planning on creating a list of issues in 2005
NFSv4 client Denial of service Userland daemons Mount and other nfs utils | |
| V.F.2 | Identify security issues assuming attack from server-side | Open | Bull | Bull planning on creating a list of issues in 2005 | |
| V.F.3 | Identify security/privacy issues assuming listening by an active or passive third party | Open' | Bull | Bull planning on creating a list of issues in 2005 |
Cross realm
| ID | test | tool test | status | owner | notes |
|---|---|---|---|---|---|
| V.G.1 | Two v4 domains; kerberos, ACLs in one realm; file system in another | New | Still experimental |
Documentation for testing/auditing
| ID | test | tool test | status | owner | notes |
|---|---|---|---|---|---|
| V.H.1 | Ensure there is high level design documentation of NFSv4 security Start with Bruce's paper | New | |||
| V.H.2 | Ensure there is inline documentation for security related code in kernel | New | |||
| V.H.3 | Ensure there is inline documentation for GSS API (libgssapi, librpcsecgss) | New | |||
| V.H.4 | Ensure there is inline documentation for nfsv4 libraries | New |
Security use case
| ID | test | tool test | status | owner | notes |
|---|---|---|---|---|---|
| V.I.1 | Verify proper functionality/security correctness of NFSv4 in a VPN environment | New | Venkat will write use case |
