Less known Solaris Features: Signed binaries

I'm a member of

Quicksearch

Codenews Search

Disclaimer

The individual owning this blog works at Sun Microsystems GmbH in Germany, a subsidiary of Oracle. The opinions expressed here are his own, are not necessarily reviewed in advance by anyone but the individual author, and neither Oracle nor any other party necessarily agrees with them.

Navigation

< zZz is playing: Grip | links for 2008-02-08 >

Less known Solaris Features: Signed binaries

Friday, February 8. 2008

One of problems in computer security is the validation of binaries: Is this the original binary or is it a counterfeit binary? Since Solaris 10 Sun electronically signs the binaries of the Solaris Operating Environment. You can check the signature of the binaries with the elf-sign tool.

[root@gandalf:/etc]$ elfsign verify -v /usr/sbin/ifconfig elfsign: verification of /usr/sbin/ifconfig passed. format: rsa_md5_sha1. signer: CN=SunOS 5.10, OU=Solaris Signed Execution, O=Sun Microsystems Inc.

Obviously you have to trust the elfsign. But you can check it, when you boot the system from a trusted media (like a original media kit or a checksum validated iso-image. This enables you to check the signature of the elfsign independently from the system.

By the way: This certificate and the signature is very important for crypto modules. The crypto framework of solaris just loads modules signed by Sun to prevent the usage of malicious modules (for example to read out the key store and send it somewhere) into the framework.

Posted by Joerg Moellenkamp in English at 11:23 | Comments (0) | Trackback (1)

Defined tags for this entry: lksf

, Security

, solaris

, sun

Related entries by tags:

View as PDF: This entry | This month | Full blog

Trackbacks

Trackback specific URI for this entry

Validated Execution
Some weeks ago i posted an article about the signed binaries in Solaris. Every binary in Solaris has an digital signature. It´s the next logical step to execute only signed binaries. And ... welll ... now there´s a project in progress to give Solaris exa

Weblog: c0t0d0s0.org
Tracked: Mar 06, 06:46

Comments

Display comments as (Linear | Threaded)

No comments

Add Comment

Name
Email
Homepage
In reply to
Comment	E-Mail addresses will not be displayed and will only be used for E-Mail notifications. To prevent automated Bots from commentspamming, please enter the string you see in the image below in the appropriate input box. Your comment will only be submitted if the strings match. Please ensure that your browser supports and accepts cookies, or your comment cannot be verified correctly. Enter the string from the spam-prevention image above: Standard emoticons like :-) and ;-) are converted to images. Enclosing asterisks marks text as bold (word), underscore are made via _word_.
	Remember Information? Subscribe to this entry

View as PDF: This entry | This month | Full blog

Competition entry by David Cummins powered by Serendipity v1.0

Links in this article

The LKSF book

The book with the consolidated Less known Solaris Tutorials is available for download here

Twitterfeeds

twitter.com/c0t0d0s0
just blogged: links for 2010-03-19: Gedanken eines Fliegenden: Freikoerperkultur ... http://bit.ly/c21ARU

twitter.com/codenews
6935782 need to manually increment build number one more time http://bit.ly/aMqEbX

twitter.com/SunPatches
Security patch: 120228-40 - Messaging Server 6.3-11.01: core patch. Available for SPARC since Mar/17/10. http://bit.ly/bk1hw3

twitter.com/SolPatchesX86
122301-49 - SunOS 5.9_x86: Kernel Patch. Available since Mar/17/10. http://bit.ly/9ETInV

twitter.com/SolPatchesSPARC
122300-49 - SunOS 5.9: Kernel Patch. Available since Mar/17/10. http://bit.ly/b9ZvRJ