Red Hat Enterprise Linux 5 Administration Unleashed

548APPENDIX CPreventing Security Breaches with ExecShieldwrite a virus that waits until the program has written to memory and then overwrites thatpart of the memory. When the program goes to execute the instructions in memory at alater time, the virus has already overwritten it, and the code from the virus is executedinstead. The virus code is executed with whatever permissions the program has. If theprogram is being run as the root user, significant damage can be done to the system orconfidential data stored on the system can be sent to another computer over the networkon the Internet.ExecShield also marks memory locations that store program data as nonexecutable. If avirus or worm manages to overwrite parts of a program’s memory for program data, thecode cannot be executed with ExecShield enabled.Worms and viruses look for common programming errors that allow for exploits such asthe buffer overflow. If an application is not written properly, a buffer overflow operationoverfills the memory buffer, which is a fixed size, until it overwrites the return address forthe memory location so that the worm or virus can execute a different program with allthe privileges of the application that was running in that memory location, includingones running as the root user.Because the worm or virus must fill the buffer before overwriting the return address, thecode to execute is often written to the buffer and then the return address is redirected tothe code in the buffer, which is usually only filled with data. ExecShield works by separatingexecutables and application data so that application data cannot be executed.But what if the exploit points the return address to somewhere other than the buffer itoverflowed to get to the return address? ExecShield combats this with two features:. Ascii Zone. Address Space RandomizationFunctions that use string buffers stop when they reach zero. Ascii Zone tries to place asmany string buffers as possible at memory locations that have a zero in the address sothat an exploit that tries to overflow a string buffer fails. Address Space Randomizationtries to use random memory locations for a program each time it starts so an exploitcannot predict where it is in memory.Determining Status of ExecShieldExecShield is enabled by default in the Red Hat Enterprise Linux kernel. To verify thatExecShield is enabled, execute the following command:cat /proc/sys/kernel/exec-shieldIf it returns the value of 1, ExecShield is enabled. The value of 0 means it is disabled. Youcan also determine the status of ExecShield by executing the following command, butthis command must be run as the root user:sysctl -a | grep exec-shield