Crazy (and just maybe awesome) idea: Winux

[Gullible Jones]

I was recently thinking about ReactOS, and how it compairs with Linux. Mostly because some of my favorite applications are unfortunately Win32 only (e.g. Miranda and Irfanview), and the preponderance of horrible Windows malware is keeping me on Linux.

(ReactOS, for those not in the know, is an open source replacement for Windows XP, still in the alpha stage. More here.)

The current direction ReactOS seems to be heading in is to use Wine for most of the graphical interface, on top of a brand new windowing system and a kernel that can handle Windows drivers. Now, this sounds great... But it's going to take a lot of work to develop. And meanwhile, we don't have a decent OSS Windows replacement.

So how about we use XOrg and the Linux kernel? Those support plenty of hardware, and are fast and (mostly) stable.

The idea is this: create a Linux distro (call it Winux) that starts Wine along with X. (Maybe have Wine compiled statically against the X libs for speed, or something.) Everything in the GUI, from the login manager to the desktop shell, would be a Win32 application designed to work under Wine; the default browser would be based on wine-gecko, etc. Windows applications could be installed on a per-user basis.

In limited-user-world, everything would work through Wine and Wine applications (unless you decided to call up a Linux shell, for which there'd have to be an option). Root stuff would be done through the command line and text config files, as it should be. Now I know that's not newbie-friendly, but it would make things a lot simpler, I think; and anyway, the idea isn't perfect Windows compatibility, but an open source OS with good Windows compatibility in userspace.

(Obviously, Windows drivers wouldn't work; but with Linux hardware support, they wouldn't be needed, and antivirus rubbish would be largely unnecessary, especially if AppArmor was thrown in.)

And yeah... It would be a kludge. But I think it would be worth it.

For a base Linux system... Well, the whole thing would center on the idea of using Win32 userspace applications in a Linux environment, so I think basing it on e.g. Ubuntu with the full repos would be unnecessary and maybe bad. Better to base it on something like Arch or Slackware, I'd say, just to keep things as simple as possible (the whole thing already being a kludge). But then, I've no experience as a distro maintainer, so my impression could be wrong.

Anyway... What do you folks think of this idea? Feasible? Or just stupid?

[Clemens Eisserer]

Hi,

Anyway... What do you folks think of this idea? Feasible? Or just stupid?

Well, to be honest I don't see the benefit of your proposal compared
to an easy-to-use Linux-Distribution with proper wine integration.
But if you like to create what you propose, I would curious watch the
progress and outcome

- Clemens

[Martin Gregorie]

On Sat, 2010-03-06 at 15:35 -0600, Gullible Jones wrote:

Anyway... What do you folks think of this idea? Feasible? Or just stupid?

A major problem is the enormous number of system calls that Windows
implements. Last time I knew the numbers, and it was quite a long time
ago, Unix/Linux had under 300 kernel APIs while the contemporary version
of Windows had 3500. This is a reason why developing Wine is such a
problem.

Windows has so many because it appears to be a fairly undisciplined
development shop. Each new version's project team seems to have invented
a whole new set of APIs because they could and to stamp their mark on
it. However, to allow any older programs to continue to run, they still
have to reimplement all the older APIs too. Is it any wonder each new
version is so much more bloated than the previous one?

I think it would take several orders of magnitude less work to write a
new Linux kernel from scratch than it will to add all the Windows APIs
to an existing kernel, whether as built-ins or as a translation layer
like Wine.


Martin

[hellork]

The wine desktop and web browser is rather minimal, but if you want to extend these or write a window manager for wine, have at it. The problem I see is that most Linux window managers offer such a vastly improved user experience over Windows, once a user discovers all the bells and whistles, I miss the point!

[oiaohm]

Gullible Jones know how to show your true knowledge level.

Apparmor has failed integration with main line kernel due to technical flaws in it design. So depending on it to save your tail is pure foolishness.

X11 And Windows windows managers are incompatible with each other.

X11 programs provide different icon sizes to windows completely. X11 windows manager is expected to do a lot of things windows one is not.

Also you are forgetting wine is designed to integrate in many places to Linux.

There are other options other than XOrg. Like wayland. Go straight to the video stack avoid X11 completely. There is nothing to be gained by static linking in the X11 libs other. More often than not worse memory usage by doing so by the way.

Besides your idea is really poor compared to the likes of http://en.wikipedia.org/wiki/Linux_Unified_Kernel

Since you also state not newbie friendly you might as well forget getting windows users. If its not newbie friendly they will not put up with it.

Now if you want Linux users they will want native applications as well. So you idea is screwed.

I am sorry to say Gullible from a secuirty point of view lots of windows applications are junk.

Also bad of bad windows malware does infect wine. So keeping windows applications around and using wine really does weaken your secuirty.

Goal should be to provide feed up to applications that could possiable make the application you want native so getting you away from the windows problem. Ie wine should be nothing more than a way to escape windows in my eyes.

If the system is going to run pure windows apps in linux to save ass you will need fanotify to add real-time anti-virus scanning all the time and take the speed hit.

Many have dreamed up this stupid idea. Once you make a OS too much like windows you have all the same problems.

How most viruses get into windows is windows users get use to installing from everywhere. Secuirty systems cannot protect you from dumb users. On the other hand Linux's work by the repository model were all applications there are audited. This is one of the major difference in virus spreed between the two OS's. Your idea will remove the difference.

[James McKenzie]

oiaohm wrote:

Besides your idea is really poor compared to the likes of http://en.wikipedia.org/wiki/Linux_Unified_Kernel

Actually, I like the alternate idea. Integrating Windows code at that
kernel level leads to bloat. Bloat leads to serious problems....

Since you also state not newbie friendly you might as well forget getting windows users. If its not newbie friendly they will not put up with it.

Now if you want Linux users they will want native applications as well. So you idea is screwed.

Great. Now make it worthwhile to get the MS folks to build for Linux.
Good luck. I used to run an Operating System called OS/2. You would
find and probably will still find it in most banks and other financial
institutions. Have you seen a release for it in a long, long time (BTW,
WordPerfect 5.2 was released for it and WordPerfect for Windoww 6.0
would run on it). I don't expect, anytime soon, to see MS Office for Linux.

I am sorry to say Gullible from a secuirty point of view lots of windows applications are junk.

I agree. However, when you program on a junk OS, you get junk software.
However, it IS software for the masses.

Also bad of bad windows malware does infect wine. So keeping windows applications around and using wine really does weaken your secuirty.

Yes, and if you go to any major corporation and state that they should
get rid of Windows and you will be immediately shown the door.
Companies have a major investment in their Windows software, not so the
OS. That is why projects like Wine exist. This allows the company to
move to a more secure OS (all OSs have security problems, Linux, MacOSX,
Solaris, Free/OpenBSD, all of them).

Goal should be to provide feed up to applications that could possiable make the application you want native so getting you away from the windows problem. Ie wine should be nothing more than a way to escape windows in my eyes.

Good goal. However, this will NEVER happen until and when Microsoft is
found in anti-trust violation like IBM was in 1972. Yes, IBM beat the
government, but Hitachi beat the crap out of IBM. They have never
recovered from this (The US case ended in 1981 when the US government
quit the case.) Microsoft is now adopting very restrictive EULAs and
getting more governments to sign on with them. This means that areas
that were 'free' are becoming restricted. And try to duplicate the
'look and feel' of something like Outlook and you will be quickly
slapped with a series of lawsuits. The folks at Mozilla.org and
OpenOffice.org are treading a very fine line. Microsoft sued Sun and
the suit was immediately dismissed by the 9th Circuit Court (US) because
Microsoft could not prove code duplication nor violation of patent.
This will become harder and harder as more patents are applied for and
approved.

If the system is going to run pure windows apps in linux to save ass you will need fanotify to add real-time anti-virus scanning all the time and take the speed hit.

Like this is not happening in the Windows world and has for years? The
problem is that Windows is very popular and has an inheritly unsecure
system. It was built in the period of 'trust'. Linux was not built in
the period of trust and has all of the security features from the
current period.

How most viruses get into windows is windows users get use to installing from everywhere. Secuirty systems cannot protect you from dumb users. On the other hand Linux's work by the repository model were all applications there are audited. This is one of the major difference in virus spreed between the two OS's. Your idea will remove the difference.

No it will not. The problem is with user education. However, there are
more and more users joining daily. It is only a matter of time until a
Linux worm is introduced that will replicate what has infected Windows
for years. Then the 'security' of Linux will become moot. Remember,
UNIX systems were infected in a major way just because a test worm got
out of its controlled environment. This can still happen today. Just
take a look at the CVE listings for the BIND program and that will give
you the creeps. DNS, something that the Internet relies on, is still
infectable and still can be 'persuaded' to accept false inputs. As the
folks at Facebook what happened a few weeks ago. They will not discuss
it, but the story on black-hats is that the DNS entries were changed,
world-wide, and a phishing site was installed at the wrong address and
the pharming was very productive.

So, see, I appreciate Wine for what it is. A layer on top of UNIX that
interfaces Windows API calls to the Linux/UNIX system. Much better, but
not the ideal solution.

As to what the OP is doing, keep on going. I would like to see Wine
integrated more with the Linux desktop, possibly eliminating the need to
use the X processes altogether.

James McKenzie

[Gullible Jones]

So I gather this idea would not be so good (especially security-wise), even if it were practical? Too bad. I had hoped someone might find it worthwhile, but if it's that stupid, well, I won't complain when people point it out.

Though I do have to ask, how much Windows malware actually runs in Wine? Do file infectors like Virut run? How about fake antiviruses?

[oiaohm]

James McKenzie worms do appear on Linux in low numbers. And some are clones of windows ones by the way. Reason why ubuntu running a non peer reviewed Mandorary Secuirty system by default is a worry ie apparmor.

Sorry to have to correct you James McKenzie

Linux was not built in
the period of trust and has all of the security features from the
current period.

Linux was built in the period of trust. Early Linux's don't have well working secuirty systems. Only by 1993 ie 2 years into Linux did DAC start working. Even up to 2000 Most Linux's were depending on DAC that is not really a good secuirty system. Windows design is about as good as Linux but due to poor implementation and support of bad programs it secuirty has been rendered worthless. Basically MS correct the implementation tones of applications will fail. I normally don't have to correct you on things like this James you are normally correcting my oversites. Lack of operation real-time scanning in Linux is a left over from the time of trust.

Proper setup secuirty systems most BIND CVE listing alone don't work to get into systems. Also lot of the plushing ones recently have been caused by DNS servers not running authenticated communication that BIND for updating has supported since 2001. Funny thing here lot of CVE listing about Linux when you did deeper only functional to attack system if user is not running items like selinux. Basically Linux lot of distributions over the years hardened. But we do still have some stupidly soft ones.

Really my words on installing from everywhere is true. Most people who are infected you can trace back to going into untrustworthy locations. Like a lot of activation hacks for windows are virues about 80 percent of them even worse deep digging kernel level root kits.

Same applies across lots of breach of copyright stuff ie lot of stuff in self extracting achives the archive extract program is infected. Lot of fake anti-viruses have been even taking out banner ads. These are still the install from everywhere point of view.

Next is running items like IE that is too tied to the OS under and has been very bad swiss cheese party due to design.

Finally after all that is site plushing and emails.

Linux repos arcives are also signed. Good package managers will inform you of key chanage some even go as far as refusing to aquire packages. So just plushing the site is not enough.

Gullible jones enough malware and viruses run in wine that it can be used in mil simulations of how a virus or malware will spreed.

Some of wine worst disasters have come from file infector viruses running as root and the infector failing to tell the difference between a Linux native elf and a windows PE and infecting everything including the Linux kernel image so the OS does not even boot. So don't presume file infectors will be less damaging under wine. They can be many times worse. Reason why every time someone runs wine as root you will here people saying don't.

Some fake anti-viruses do work. But the ones that hook in like real anti-viruses don't. So far the record for numbers of operational viruses inside wine at the same time is about 150. And I do mean operational basically platinum rated all their features worked.

[James McKenzie]

oiaohm wrote:

James McKenzie worms do appear on Linux in low numbers. And some are clones of windows ones by the way. Reason why ubuntu running a non peer reviewed Mandorary Secuirty system by default is a worry ie apparmor.

I'm not disputing this. What I am saying is that Linux is not attacked
as often as Window (any version.)

Sorry to have to correct you James McKenzie

Linux was not built in
the period of trust and has all of the security features from the
current period.

Linux was built in the period of trust. Early Linux's don't have well working secuirty systems. Only by 1993 ie 2 years into Linux did DAC start working. Even up to 2000 Most Linux's were depending on DAC that is not really a good secuirty system. Windows design is about as good as Linux but due to poor implementation and support of bad programs it secuirty has been rendered worthless. Basically MS correct the implementation tones of applications will fail. I normally don't have to correct you on things like this James you are normally correcting my oversites. Lack of operation real-time scanning in Linux is a left over from the time of trust.

Thank you for the correction on this. You also stated something here
that I totally agree with. Users and poor administrators (due to either
stupidity or just being lazy) allow installation of anything. And that
causes more work than anything else.

Proper setup secuirty systems most BIND CVE listing alone don't work to get into systems. Also lot of the plushing ones recently have been caused by DNS servers not running authenticated communication that BIND for updating has supported since 2001. Funny thing here lot of CVE listing about Linux when you did deeper only functional to attack system if user is not running items like selinux. Basically Linux lot of distributions over the years hardened. But we do still have some stupidly soft ones.

Yes. And folks lazily rely on the fact that Linux is not attacked as
often as Windows. They should not. The growing use of Linux in
industry and government should be the clue to tighten down the
'hatches'. SELINUX is a real pain, much worse than Windows Vista UAE.
Of course, users should NEVER be able to install their own software
applications in an office environment. What they do at home, is a
different story.

Really my words on installing from everywhere is true. Most people who are infected you can trace back to going into untrustworthy locations. Like a lot of activation hacks for windows are virues about 80 percent of them even worse deep digging kernel level root kits.

Yes. Folks download 'free' software and then wonder why their Internet
Provider locked them out. The recovery process is long and not fun.

Same applies across lots of breach of copyright stuff ie lot of stuff in self extracting achives the archive extract program is infected. Lot of fake anti-viruses have been even taking out banner ads. These are still the install from everywhere point of view.

Again, I agree. And installing Linux/Wine does not rid one of this
problem as Wine can run some of the fake anti-virus programs very well,
sometimes too good...

Next is running items like IE that is too tied to the OS under and has been very bad swiss cheese party due to design.

This should have never happened, but we all know what caused it.

Finally after all that is site plushing and emails.

Linux repos arcives are also signed. Good package managers will inform you of key chanage some even go as far as refusing to aquire packages. So just plushing the site is not enough.

Correct.

Gullible jones enough malware and viruses run in wine that it can be used in mil simulations of how a virus or malware will spreed.

This is why I stated that I don't like the ULK. If Wine code is built
into the kernel, it might be running at root. Removing this level does
provide some security, but not absolute security.

Some of wine worst disasters have come from file infector viruses running as root and the infector failing to tell the difference between a Linux native elf and a windows PE and infecting everything including the Linux kernel image so the OS does not even boot. So don't presume file infectors will be less damaging under wine. They can be many times worse. Reason why every time someone runs wine as root you will here people saying don't.

Must have been a long process to clean this mess up. Not fun
re-installing and then cleaning up each and every Linux executable.

Some fake anti-viruses do work. But the ones that hook in like real anti-viruses don't. So far the record for numbers of operational viruses inside wine at the same time is about 150. And I do mean operational basically platinum rated all their features worked.

That is why using ClamAV is a 'good thing'. However, most folks don't
understand that Windows viruses run very well under Wine and that files
need to be scanned before running.


That is why I don't mind having Wine as an alternative windowing system,
but having it in the kernel may only lead to disaster. Most system
administrators do not, to this day, understand system security and think
of it only as a hassle. Those of us that have experienced virus
infections know differently. All OS need a virus scanner and it needs
to be used. Users should NEVER be able to install a system wide
application without knowing where it came from and after being scanned
for viruses and other malware. However, there will still be idiot users
and they will continue to install malware, even on Macs.

As to what the OP wanted, this might be a good idea that needs more
work. It would be fantastic if a freeware/commercial Windows based
anti-virus program would run under Wine. However, this does not rule
out the possibility that it will never be used or updated.

Anyone who runs a computer on the Internet today has to be aware that
they can be pown'd and their system turned into the spambot of the
century through various means. Wine should remain a userspace
application with very limited access to the kernel and other Linux/UNIX
internals.

James McKenzie

[Martin Gregorie]

On Sun, 2010-03-07 at 17:59 -0700, James McKenzie wrote:

As to what the OP wanted, this might be a good idea that needs more
work. It would be fantastic if a freeware/commercial Windows based
anti-virus program would run under Wine. However, this does not rule
out the possibility that it will never be used or updated.

Have you used tripwire or do you know anybody who does?

Tripwire runs natively on Linux, and maybe other OSen. It works by
detecting attempts to tamper with files. I remember using something
similar on WFW 3.11 and chucking it because it was more trouble than it
was worth due to FPs, but maybe tripwire is more configurable.

The real question is: is it less of a pain than SE:Linux? Full points to
SEL for security, but on the downside it makes doing several common
things, e.g. distributing webserver content by using the http:~user/...
notation, or configuring a DBMS in a way the SEL programmers didn't
consider, almost unusable.


Martin

[oiaohm]

I know tripwire. Biggest flaw its not real time. fanotify will allow that to be changed at least part of the way for file-system operations. Second big problem with tripwire is false positives.

SELinux guarding services you most of the time don't even notice. Since distributions who did the SELinux system did it right in the first place. Yes SELinux has 3 basic modes. Off, Limited protection ie protect only items like services and god darn paranoid.

God darm paranoid is what most people know and fear. Selinux has some reasonable front ends out there these days. No more annoying that putting up with zonealarm on windows.

There is also smack if you don't particularly like Selinux both are peer reviewed.

Martin I have never had a DBMS system I have not been able to make work with SELinux. Note SELinux programmers concidered everything. SELinux profile writers don't always. http://sourceforge.net/projects/segatex/ makes correcting policies quite simple.

http:~user/... I have done that stuff with selinux in place. Some distributions have it work from the start line. There is a learning mode you can setup for selinux these days for odd ball problems.

Its part having the right tools for the job Martin.

MS released an so called anti-virus that used CRC32 checksums back in the WFW 3.11 time frame . Only one problem CRC32 checksums could be colided simply so it was rendered useless.

[James McKenzie]

oiaohm wrote:

I know tripwire. Biggest flaw its not real time. fanotify will allow that to be changed at least part of the way for file-system operations. Second big problem with tripwire is false positives.

SELinux guarding services you most of the time don't even notice. Since distributions who did the SELinux system did it right in the first place. Yes SELinux has 3 basic modes. Off, Limited protection ie protect only items like services and god darn paranoid.

SELinux is also a product of the National Security Agency of the United
States Government. They have a reason to lock down computers to
prevent unauthorized use. Unfortunately, not every system administrator
is willing or has the knowledge to properly configure it. That is why
most folks don't like it. If you set it up properly, then you don't get
'surprises'. Sort of like setting up Windows Vista UAE on Full/High.
Real pain.

God darm paranoid is what most people know and fear. Selinux has some reasonable front ends out there these days. No more annoying that putting up with zonealarm on windows.

And we should all be paranoid. Yes, they are really out to get you and
your computer. They will then do bad things with it.

There is also smack if you don't particularly like Selinux both are peer reviewed.

And that is only the half of it.

Martin I have never had a DBMS system I have not been able to make work with SELinux. Note SELinux programmers concidered everything. SELinux profile writers don't always. http://sourceforge.net/projects/segatex/ makes correcting policies quite simple.

SELinux, as originally developed, was not designed for this. However,
you do have a valid complaint. RDBMS systems should be able to operate
with SELinux running at full strength. That is why it is there.

http:~user/... I have done that stuff with selinux in place. Some distributions have it work from the start line. There is a learning mode you can setup for selinux these days for odd ball problems.

SELinux should work with web servers in non-secure and secure modes. It
should work with Tomcat publishing dynamic pages as well.

Its part having the right tools for the job Martin.

MS released an so called anti-virus that used CRC32 checksums back in the WFW 3.11 time frame . Only one problem CRC32 checksums could be colided simply so it was rendered useless.

It was also a joke. You could fake the CRC32 of a file and keep on
going. There was a contest to see who could infect the most files.
Microsoft pulled it after this was demonstrated. Fortunately, not many
folks relied on it either.

However, and relating this to Wine. SELinux should not, if properly
configured, affect any user-space application that is behaving. It is
when we decide to do things like host DNS servers on it that problems
should occur, and rightfully so. We should be able to use Web Browsers
and other Internet facing applications. Oracle clients should be able
to run on it, with minor configuration changes (SELinux does not
normally allow high to high connections, but the world famous port for
Oracle is in the high port range.)

And the added security should not be a security blanket either. SELinux
is just another level of host based security. If you are really
paranoid, you can run a complete suite of applications. Anti-virus,
anti-spy ware, and other programs as well as SELinux. Unfortunately,
Wine does not run anti-virus programs very well, if at all. However,
anti-spy ware programs should run on Wine. That is the start of the
battle against the 'bad' guys who only want to steal the use of your
system for their needs...

BTW, Macs are also subject to this type of piracy as well.
James McKenzie

[oiaohm]

James McKenzie wine really should never be used to run anti-viruses. Anti-virus is a host OS problem. You can sit wine on top of clamfs. fanotify that should hopefully merge this year will enable Linux side anti-virus better under it.

I forget to say it also depends on the RDBMS you are running as well. http://wiki.postgresql.org/wiki/SEPostgreSQLv8.4 This beast exists that is Selinux friendly.

http://wiki.postgresql.org/wiki/SEPostgreSQL Really there is a full SELinux compatible stack under development.

Part of the issue with databases is there will to run secuirty different to the rest of the OS. There is even SELinux reaching up into the X11 server.

[James McKenzie]

oiaohm wrote:

James McKenzie wine really should never be used to run anti-viruses.

I agree with this statement. However, we have to remember that folks
THINK that only Windows has viruses. Until the the turn point is
reached that all OSs have viruses, then we have to think about
supporting them in Wine.

Anti-virus is a host OS problem. You can sit wine on top of clamfs. fanotify that should hopefully merge this year will enable Linux side anti-virus better under it.

Again, I agree wholeheartedly with you. I have ClamAV for my Macs.
Why? Because:
1. There are viruses for the Mac and other UNIXes.
2. Windows viruses will 'pass through' my system and infect unprotected
Windows systems.

I've even educated my father about virus protection. And that is some feat.

I forget to say it also depends on the RDBMS you are running as well. http://wiki.postgresql.org/wiki/SEPostgreSQLv8.4 This beast exists that is Selinux friendly.

http://wiki.postgresql.org/wiki/SEPostgreSQL Really there is a full SELinux compatible stack under development.

Yes, but I'm also looking for the turnpoint where Wine will use Oracle
Clients (yes, they do exist for Linux/MacOSX/Solaris, I work with them)
and for MS SQL. Yes, I know about SEPostGRESQL. However, the latter is
not in major use as are the first two. I would love to see a good
spread of RDBMS activity within the SELinux project and we may soon see
this.

Part of the issue with databases is there will to run secuirty different to the rest of the OS. There is even SELinux reaching up into the X11 server.

Again, SELinux affects all parts of Linux. It is designed to do so.
However, we also have to include the use of Windows API conversion calls
as well. If a virus affects the kernel, we need to know how to stop or
mitigate its effects. SELinux will prevent some but not all activity
and some viruses have been designed to look like they are doing
legitimate activity. That is always the hard part. User education is
always the key in virus prevention. Telling users not to click on that
'install' button is paramount, but then you will always have the rouge
user or the ID10t that will click anyways. Then you have to clean up
the mess and hope that you got it all.

But we should really get back to Wine and what it can and cannot do.
Right now, it cannot run a native AV program, and I agree that it should
not be able to for file scanning.

James McKenzie

[oiaohm]

Issue is under 12 months there will be no need for wine to be able to run anti-virus programs from a Linux point of view. Ie Linux will be able todo the job for it.

Wine does not really do windows permission structs that can redue risk of applications. Instead everything get told its admin

Selinux work on user sand-boxing also is providing a reduction to risk path.

Really the biggest problem for selinux in wine is wineserver and other server side parts. Same bug as RDBMS hard to sort out who is doing what. Transparency issue. Seeing data go in one side of a program and out the other get very hard when mult users are using the same service.

This transparency issue is a problem with lot of orcale and ms sql clients running under wine. Ie wineserver sends some network traffic you don't know what application behind wineserver did it. This makes it extremaly tricky to create permissive firewall rules and the like. Ie all in or not at all. Yes a really bad thing.

Even that you say looks like legitimate activity if can really see close enough most viruses give themselves away. Application profiles really limit what applications can do as legitimate activity so reduce risk.

Double layers. If wine cannot spreed out threw the system it risk is reduced. Like you don't forget the lock doors just because you have walking patrols. selinux is the locked doors. anti-virus and items like tripwire are the walking patrols. You need both.

Anti-viruses also will always miss a percentage. Sooner we get fully functional snaps-hotting as well the better. Ie the third layer good and regular back ups.

Linux systems without wine I don't have to depend on hope. Ok People lose all non package install applications that were not on backups. There are ways to audit and clean data files. Ie remove all unknown executable parts. You can be sure at the end you did get it all.

Windows is far to hard to audit. Simpler to nuke and start over with the windows parts.

[Martin Gregorie]

On Sun, 2010-03-07 at 20:13 -0600, oiaohm wrote:

Martin I have never had a DBMS system I have not been able to make
work with SELinux. Note SELinux programmers concidered everything.
SELinux profile writers don't always.
http://sourceforge.net/projects/segatex/ makes correcting policies
quite simple.

http:~user/... I have done that stuff with selinux in place. Some
distributions have it work from the start line. There is a learning
mode you can setup for selinux these days for odd ball problems.

I should probably look at it again. Last time I tried to use it I found
that it conflicted with the backup strategy I was using and with its
extension to make clan installs less painful.

I've moved the /usr/local, /usr/java and /var/www directory trees
to /home, which is a separate partition, and replaced them with
symlinks. So all I needed to backup is /home (now I use rsync for almost
everything) and I get a painless clean install by reformatting all other
partitions. I also have part of my internal website spread round three
login directories. The trouble was that this caused a big fight with
SEL that its config tool wasn't good enough to sort out.

Its part having the right tools for the job Martin.

Indeed. If SEL config tools are improved I'll consider enabling it
again.


Martin

[Martin Gregorie]

On Sun, 2010-03-07 at 19:44 -0700, James McKenzie wrote:

SELinux should work with web servers in non-secure and secure modes. It
should work with Tomcat publishing dynamic pages as well.

Its part having the right tools for the job Martin.

The problem when it was first released for Fedora was that it used a
cookie-cutter approach: telling it that you used Apache merely OK'ed
that within /var/www - IMO a silly place to put web pages as the /var
structure is one that you're almost certainly going to blitz as part of
a clean install and probably not bother to back up. The SEL config tool
had no method for saying that any ocurrences of /home/*/public_html were
also OK for Apache to serve from.

I'd disabled it by the time I started to use Postgres, but its a safe
bet the same problem would occur because the Fedora default puts the
Postgres files and database in /var/postgresql while I run it
from /home/postgres for the reasons given in my last post.

And the added security should not be a security blanket either. SELinux
is just another level of host based security.

Yep. I don't accept incoming net connections. I get my mail with getmail
and run it through Spamassassin before it gets passed to Postfix for
distribution. No Clamav at present because I have no Wine apps that know
what mail is and most probably never will either. chkrootkit gets run
weekly - possibly daily would be better.

Martin

[James McKenzie]

oiaohm wrote:

Issue is under 12 months there will be no need for wine to be able to run anti-virus programs from a Linux point of view. Ie Linux will be able todo the job for it.

But what about NOW. Waiting twelve months is a long time.

Wine does not really do windows permission structs that can redue risk of applications. Instead everything get told its admin

This could be bad or it could be good. However, Wine itself is run in
user space which may be a good thing.

Anti-viruses also will always miss a percentage. Sooner we get fully functional snaps-hotting as well the better. Ie the third layer good and regular back ups.

True. That is why there is heuristic code in most modern anti-virus
products.

Linux systems without wine I don't have to depend on hope. Ok People lose all non package install applications that were not on backups. There are ways to audit and clean data files. Ie remove all unknown executable parts. You can be sure at the end you did get it all.

This is very true. However, blowing away programs and parts of the OS
should not be a matter of routine unless you are testing, testing and
more testing (I do this for a living). Ordinary users should not be, by
a rule, deleting files all the time.

Windows is far to hard to audit. Simpler to nuke and start over with the windows parts.

Actually, if a Linux or Windows system gets 'infected' it gets 'blown
away'. That is because you cannot ever be certain that all affected
files were removed, no matter what OS. Now, you can image any OS and
'blow' it onto an empty hard drive. This is done all the time in
industry. The point is that there is a complete product suite to
monitor Windows systems, called SCCM/SCOM. I don't know of a similar
product for Linux, but there has to be one. This is where money is
really made....

However, I enjoy having the availability of Wine.

James McKenzie

[oiaohm]

James McKenzie

Actually, if a Linux or Windows system gets 'infected' it gets 'blown
away'. That is because you cannot ever be certain that all affected
files were removed, no matter what OS. Now, you can image any OS and
'blow' it onto an empty hard drive. This is done all the time in
industry. The point is that there is a complete product suite to
monitor Windows systems, called SCCM/SCOM. I don't know of a similar
product for Linux, but there has to be one. This is where money is
really made....

Myths again. There is more than 1 way to clear a system ie blow it away. Linux you can compare all application files install on a system to packages they came from and user data to backups and user data threw executable code clearing. Ie only stuff without macros scripts... left. It kinda impossible to sneak past a binary compare audit. This can be done due to Linux's package management. This is boot loaders kernels libs everything.

All altered files from the infected system can be archived. Ie the reduces the size of the data to backup from an infected system to prevent the infection causing data loss.

Basically it possible to reset a Linux system to as if clean installed and in the process recover all the altered files and setting from the system.

Lot of poorly trained people will just blow a Linux system away like they did with windows. Why is doing the windows way bad. No good records and if something was installed by package and something is altered that should not have been hello we now have something to send to virus labs to develop a signature to locate viruses.

Package compare is a great way of reducing the size of system backups as well by the way.

I have run honeypots for years. Yes a simple more user-friendly interfaces need to be built todo this. Even with a windows honey put that does not take updates doing a full binary compare is how you sort out what attackers added to the system. Windows updates and applications updates not from a common source make binary auditing not an option.

Linux does not have things like registry files that are hard to audit. It is fairly simple to sort out what config files in Linux own to each application.

Nice thing about the audit method is the list of files removed can be inspected over time and valid ones brought back.

We are not talking data destruction or needing large backups.

[David Gerard]

On 10 March 2010 09:03, oiaohm <[email protected]> wrote:

All altered files from the infected system can be archived.   Ie the reduces the size of the data to backup from an infected system to prevent the infection causing data loss.
Basically it possible to reset a Linux system to as if clean installed and in the process recover all the altered files and setting from the system.
Lot of poorly trained people will just blow a Linux system away like they did with windows.  Why is doing the windows way bad.    No good records and if something was installed by package and something is altered that should not have been hello we now have something to send to virus labs to develop a signature to locate viruses.
Package compare is a great way of reducing the size of system backups as well by the way.

Mmmmmm ... speaking as a Unix sysadmin: if a work Unix box got
rootkitted, I would in fact just blow it away and carefully restore
data from backups. It's not like reinstallation is that hard or takes
that long, and I'd feel much more reassured of my system's clean state
than I would trying to clean a known dirty one. Your mileage may vary.

This is getting off-topic


- d.

[David Gerard]

On 10 March 2010 09:10, David Gerard <[email protected]> wrote:

Mmmmmm ... speaking as a Unix sysadmin: if a work Unix box got
rootkitted, I would in fact just blow it away and carefully restore
data from backups. It's not like reinstallation is that hard or takes
that long, and I'd feel much more reassured of my system's clean state
than I would trying to clean a known dirty one. Your mileage may vary.

I must note! If you are a desktop user running Wine, YOU DO NOT NEED
TO WORRY ABOUT THIS SORT OF THING REALLY. Do not go "aieee virus!" and
delete your system!!

If you get a Windows virus in your .wine, you can at this stage just
delete the .wine directory and start over.

(I don't know of any Windows malware that is aware of Wine, but it
would be trivially easy to write and there's nothing Wine can do to
block it. So you really should run ClamAV as well if you're in the
habit of downloading and installing random things in Wine. Has anyone
written a good page on practical use of an antivirus with Wine?)


- d.

[oiaohm]

Mmmmmm ... speaking as a Unix sysadmin: if a work Unix box got
rootkitted, I would in fact just blow it away and carefully restore
data from backups. It's not like reinstallation is that hard or takes
that long, and I'd feel much more reassured of my system's clean state
than I would trying to clean a known dirty one. Your mileage may vary.

True for closed source to just blow away. Results from a binary audit. Is a system exactly the same as if you had clean installed. File permissions and all get cleared and reset.

Binary compare method is slightly slower on the install. But it salvages data.

Problem here is training. Running honey pots you have to be able to dissect the system.

There is another reason why you run a package binary compare install. If you know a system is breached and nothing has been tampered with you know a reinstall of the same OS is going to get you no where. Something else has entered the system.

Problem with the nuke method. You don't know how you have been breached. True-fully think about it. How can you protect self if you don't know where you have been defeated.

I am way more unhappy with a nuked system than a binary compared. At least with a binary compared I have a list of files to go through to locate more information how the intruder got in.

Yes the difference between people running honey pots. It is a higher level of training.

I have seen people using the nuke method wonder why the attack keeps on coming back. Since the cleanly installed systems were not protected from the attack because they did not know the attack they were dealing with.

Honey pot methods are highly useful tools.

clamfs is practical under wine.

[Martin Gregorie]

On Wed, 2010-03-10 at 09:14 +0000, David Gerard wrote:

(I don't know of any Windows malware that is aware of Wine, but it
would be trivially easy to write and there's nothing Wine can do to
block it. So you really should run ClamAV as well if you're in the
habit of downloading and installing random things in Wine. Has anyone
written a good page on practical use of an antivirus with Wine?)

The feature that really worries me is the default Z: drive.

Do any applications actually use it or could it be omitted?
If it is used, what is it used for?


Martin

[David Gerard]

On 10 March 2010 12:52, Martin Gregorie <[email protected]> wrote:

On Wed, 2010-03-10 at 09:14 +0000, David Gerard wrote:

(I don't know of any Windows malware that is aware of Wine, but it
would be trivially easy to write and there's nothing Wine can do to
block it. So you really should run ClamAV as well if you're in the
habit of downloading and installing random things in Wine. Has anyone
written a good page on practical use of an antivirus with Wine?)

The feature that really worries me is the default Z: drive.
Do any applications actually use it or could it be omitted?
If it is used, what is it used for?

A program running in Wine as you can do anything you can do, same as
any Unix program running as you. (Including Linux system calls with
int 0x80, etc.) Wine cannot stop this and neither tries to nor
promises to. ~/.wine is NOT a sandbox.

Disconnecting Z:\ is pretty much useless as a security measure.


- d.

[James McKenzie]

oiaohm wrote:

James McKenzie

Actually, if a Linux or Windows system gets 'infected' it gets 'blown
away'. That is because you cannot ever be certain that all affected
files were removed, no matter what OS. Now, you can image any OS and
'blow' it onto an empty hard drive. This is done all the time in
industry. The point is that there is a complete product suite to
monitor Windows systems, called SCCM/SCOM. I don't know of a similar
product for Linux, but there has to be one. This is where money is
really made....

Myths again. There is more than 1 way to clear a system ie blow it away. Linux you can compare all application files install on a system to packages they came from and user data to backups and user data threw executable code clearing. Ie only stuff without macros scripts... left. It kinda impossible to sneak past a binary compare audit. This can be done due to Linux's package management. This is boot loaders kernels libs everything.

I'm not disputing what you are saying. I'm studying for my CISSP and I
have over 20 years of playing around with computers (try 29 to be
exact). However, the ONLY sure way to entirely remove a virus is to
junk the computer and get another one. That being said, you really
don't expect a company with 500+ computers to do this. The next best
thing is to hit up the computer stores and get enough hard drives to
replace those in the infected machines and swap them out and build new
systems.

All altered files from the infected system can be archived. Ie the reduces the size of the data to backup from an infected system to prevent the infection causing data loss.

HUH? You should NEVER backup an infected file. However what you are
suggesting is NOT a best practice, by far. You replace the drive,
reload and recover from a non-infected backup.

Best practice is to pull the hard drive from a live system (this can be
done.) Then you replace the drive, build on top and restore, restore,
restore. This is what I did when I was infected. Sadly, I had to run
through three backups before all was well.

And yes, you can figure out what files belong to what application. When
you are talking industry, we don't have the time. If you fail, you have
less than 24 hours to be back up. Otherwise and unless you occupy a
real niche, you might as well close down completely. 9/11/2001 taught a
lot of companies this lesson.

As to using Wine, it is not a sandbox. Thus you can get a Windows virus
or worm infection and keep on keeping on. Thus some sort of Windows
based AV is necessary until the solution you stated is ready, tested and
accepted.

The OP does and continues to have a valid point. What good is Wine if
it emulates WindowsXP too good and it cannot stop the bad guys from
continuing to spread their 'badness'? The simple explanation is that we
are dealing with a broken operating system that is like a good sieve.
It stops only the big chunks of food, but the 'water' will flow
through. The best program is user education. That stops 99% of the
badness from getting through. Sort of like adding several layers of
cheesecloth to the sieve.

BTW, in the early 1990s, NSA rated Window NT 3.51 SP 2 as safe. All you
had to do is remove the NIC, floppy and CD drives. No USB transmission
was allowed, No modems. Basically no outside connections of any kind.
In this day, this would not be a very productive machine.

Very respectfully,

James McKenzie