Re: A question about Knark and modules

[Christian Jaeger <christian.jaeger@sl.ethz.ch>]

Hello

Do you know about LIDS (www.lids.org)? It also gives the ability to 
play with CAP's, but seems much more sophisticated.

I've just subscribed to this list. Has LIDS been discussed here before?

I'm interested in using it, but am not sure how to use it best. In 
fact I currently think it's best suited for just making sure tools 
like tripwire can operate safely (so it's helping intrusion 
detection, hence it's name (linux intrusion detection system) is very 
correct), rather than effectively inhibiting a breakin. But even for 
this purpose it seems you have to secure almost every file in your 
system with ACL's (which is not very comfortable). Maybe this idea 
from mine is working well: install some special binaries to which you 
grant many permissions. One is an 'apt-get update/upgrade' wrapper 
(so automatic security updates work), another one might be a shell 
wrapper allowing system administrators to work on /etc, and so on. I 
think I'll ask this on the lids list later if that's the better place 
for such discussions.

Christian.

At 3:00 Uhr +0200 17.6.2001, Ethan Benson wrote:
> lcap CAP_SYS_MODULE CAP_SYS_RAWIO