From Fedora Project Wiki
(page creation) |
No edit summary |
||
| Line 17: | Line 17: | ||
** check for compile flags properly added | ** check for compile flags properly added | ||
* check if daemon is run as root | * check if daemon is run as root with ps fax | ||
* check if daemon drop caps | * check if daemon drop caps, with pscap | ||
* security review ( http://people.redhat.com/sgrubb/security/ ) | * security review ( http://people.redhat.com/sgrubb/security/ ) | ||
** tmp usage | ** tmp usage | ||
* check if started by default if network facing | * check if started by default if network facing | ||
Revision as of 14:27, 2 March 2013
List of check for security hardening of a package
- check %global hardened build ( https://fedoraproject.org/wiki/Packaging:Guidelines#Compiler_flags )
- inspect service file ( http://0pointer.de/blog/projects/security.html )
- PrivateTmp
- PrivateNetwork
- block syscall
- block device
- block path ( like /home )
- check if a daemon do not have a selinux policy or not
- inspect rpmlint error about insecure file usage, insecure API
- check of initgroups/setuid/setgroup order
- check for chdir before chroot
- check for compile flags properly added
- check if daemon is run as root with ps fax
- check if daemon drop caps, with pscap
- security review ( http://people.redhat.com/sgrubb/security/ )
- tmp usage
- check if started by default if network facing