★ wanayoo — archive 1999 http://icewalkers.com/doclib/howtos/Secure-Programs-HOWTO/index.htmlNouvelle recherche | Portail wanayoo
Name:   Pass:    
Subscribe to IceWalkers Free NewsLetter




















Geeknews.org - Be a Geek.
see all



Year 2000 most disappointing thing was:

Y2K Bug
NASDAQ
Delayed Linux Kernel 2.4
Butterfly ballots
Pentium IV
Nothing. That was a great year!

  View results
  Previous polls
 
 Search Howtos: Match: Sort by:



Linux HOWTOs  |  HOWTOs Index



Secure Programming for Linux and Unix HOWTO

Secure Programming for Linux and Unix HOWTO

David A. Wheeler

Copyright © 1999, 2000 by David A. Wheeler

This paper provides a set of design and implementation guidelines for writing secure programs for Linux and Unix systems. Such programs include application programs used as viewers of remote data, web applications (including CGI scripts), network servers, and setuid/setgid programs. Specific guidelines for C, C++, Java, Perl, Python, TCL, and Ada95 are included.

Table of Contents
1. Introduction
2. Background
2.1. History of Unix, Linux, and Open Source Software
2.2. Security Principles
2.3. Types of Secure Programs
2.4. Paranoia is a Virtue
2.5. Why Did I Write This Document?
2.6. Sources of Design and Implementation Guidelines
2.7. Document Conventions
3. Summary of Linux and Unix Security Features
3.1. Processes
3.2. Files
3.3. System V IPC
3.4. Sockets and Network Connections
3.5. Signals
3.6. Quotas and Limits
3.7. Dynamically Linked Libraries
3.8. Audit
3.9. PAM
4. Validate All Input
4.1. Command line
4.2. Environment Variables
4.3. File Descriptors
4.4. File Contents
4.5. Web-Based Applications (Especially CGI Scripts)
4.6. Other Inputs
4.7. Human Language (Locale) Selection
4.8. Character Encoding
4.9. Limit Valid Input Time and Load Level
5. Avoid Buffer Overflow
5.1. Dangers in C/C++
5.2. Library Solutions in C/C++
5.3. Compilation Solutions in C/C++
5.4. Other Languages
6. Structure Program Internals and Approach
6.1. Secure the Interface
6.2. Minimize Privileges
6.3. Avoid Creating Setuid/Setgid Scripts
6.4. Configure Safely and Use Safe Defaults
6.5. Fail Safe
6.6. Avoid Race Conditions
6.7. Trust Only Trustworthy Channels
6.8. Use Internal Consistency-Checking Code
6.9. Self-limit Resources
7. Carefully Call Out to Other Resources
7.1. Limit Call-outs to Valid Values
7.2. Check All System Call Returns
8. Send Information Back Judiciously
8.1. Minimize Feedback
8.2. Handle Full/Unresponsive Output
8.3. Control Data Formatting
9. Language-Specific Issues
9.1. C/C++
9.2. Perl
9.3. Python
9.4. Shell Scripting Languages (sh and csh Derivatives)
9.5. Ada
9.6. Java
9.7. TCL
10. Special Topics
10.1. Passwords
10.2. Random Numbers
10.3. Specially Protect Secrets (Passwords and Keys) in User Memory
10.4. Cryptographic Algorithms and Protocols
10.5. PAM
10.6. Tools
10.7. Miscellaneous
11. Conclusion
12. Bibliography
A. History
B. Acknowledgements
C. About the Documentation License
D. GNU Free Documentation License
E. Endorsements
F. About the Author
  Next
  Introduction


HOWTOs Index

 
  
 
 
 


MySQL 3.23.33
FOX 0.99.157
Linux Kernel 2.2 pre-patch 2.2.19-10
mnoGoSearch 3.1.10
X-Chat 1.6.4
fetchmail 5.6.5
Window Maker 0.64.0
sysstat 3.2.5



Mutt 1.3.15
GnomeICU 0.95.3
OSS 3.9.4c
pavuk 0.9pl28d
YIFF 2.12.3
Cronos II 0.1.1
phpComic 1.0.1g
Astaro Security Linux 1.792
Getleft 0.10.0
libglade 0.16
GQview 0.9.5
Mandrake Update Robot 0.7
gdm 2.0.98
GTK+ Object Builder 1.0.6
Linberto 1.0.4
Knetfilter 2.0.4
FilterProxy 0.27