Steps to verify cleanliness of code on Unix boxes

Thread View: comp.security.misc

1 messages

[T] Back to Threads [V] Tree View [G] Group Articles

1 total messages Started by Larry W. Virden Wed, 27 Jan 1993 13:54

#981

Author: Larry W. Virden
Date: Wed, 27 Jan 1993 13:54

21 lines
1560 bytes

Anyone have some steps to take to look at a program to see if it accidentally
or intentionally takes actions which could be considered dangerous?  For
instance, on many micros, there are programs which will scan for certain
operations and warn the user of a possible danger.

I think that such a tool that could be run on a set of code would
be very useful.  What types of things do you look for when you are
examining a new piece of code?  For instance, the following might
be some things to particular examine - none are necessary 'evil' but
are conditions which have the possibility for accidents or abuse.

1.	Does it require root or other specialized privleges?
2.	Does it attempt to send email to off site addresses?
3.	Does it attempt to perform chmod's or chown's on files that it
	does not create?
4.	Does it attempt to delete files that it does not create?
-- 
Larry W. Virden                 UUCP: osu-cis!chemabs!lvirden
Same Mbox: BITNET: lvirden@cas  INET: lvirden@cas.org
Personal: 674 Falls Place,   Reynoldsburg, OH 43068-1614

Thread Navigation

This is a paginated view of messages in the thread with full content displayed inline.

Messages are displayed in chronological order, with the original post highlighted in green.

Use pagination controls to navigate through all messages in large threads.

Back to All Threads