Skip to content

Protego: patch for Linux kernel to obviate setuid-to-root binaries

Notifications You must be signed in to change notification settings

oscarlab/protego

Repository files navigation

protego

Protego is a linux variant based on Ubuntu that never raises the privilege of an user that isn't the administrator. Specifically, Protego removes the need for utilities that are setuid-to-root. Protego currently de-privileges 12,732 lines of code in trusted setuid-to-root binaries by changing just 715 lines of kernel code.

We have carefully studied 28 setuid-to-root binaries. According to the Debian and Ubunty "popularity contest" results, this set includes all binaries installed on more than 10.5% of systems surveyed.

There are an additional 91 binaries packaged and distributed by Ubuntu, and testing that these work on Protego is ongoing work. Based on documentation, most of these use interfaces Protego has already addressed, but check back later for updates.

Note: Please refer to setup.sh for instructions to setup protego.

About

Protego: patch for Linux kernel to obviate setuid-to-root binaries

Resources

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published