Secure Programming for Linux and Unix HOWTO

David A. Wheeler

Copyright © 1999, 2000, 2001, 2002, 2003 by David A. Wheeler

v3.010, 3 March 2003

This book provides a set of design and implementation guidelines for writing secure programs for Linux and Unix systems. Such programs include application programs used as viewers of remote data, web applications (including CGI scripts), network servers, and setuid/setgid programs. Specific guidelines for C, C++, Java, Perl, PHP, Python, Tcl, and Ada95 are included. For a current version of the book, see http://www.dwheeler.com/secure-programs

This book is Copyright (C) 1999-2003 David A. Wheeler. Permission is granted to copy, distribute and/or modify this book under the terms of the GNU Free Documentation License (GFDL), Version 1.1 or any later version published by the Free Software Foundation; with the invariant sections being ``About the Author'', with no Front-Cover Texts, and no Back-Cover texts. A copy of the license is included in the section entitled "GNU Free Documentation License". This book is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

Table of Contents

1. Introduction
2. Background

2.1. History of Unix, Linux, and Open Source / Free Software

2.1.1. Unix

2.1.2. Free Software Foundation

2.1.3. Linux

2.1.4. Open Source / Free Software

2.1.5. Comparing Linux and Unix

2.2. Security Principles
2.3. Why do Programmers Write Insecure Code?
2.4. Is Open Source Good for Security?

2.4.1. View of Various Experts

2.4.2. Why Closing the Source Doesn't Halt Attacks

2.4.3. Why Keeping Vulnerabilities Secret Doesn't Make Them Go Away

2.4.4. How OSS/FS Counters Trojan Horses

2.4.5. Other Advantages

2.4.6. Bottom Line

2.5. Types of Secure Programs
2.6. Paranoia is a Virtue
2.7. Why Did I Write This Document?
2.8. Sources of Design and Implementation Guidelines
2.9. Other Sources of Security Information
2.10. Document Conventions

3. Summary of Linux and Unix Security Features

3.1. Processes
3.1.1. Process Attributes
3.1.2. POSIX Capabilities

(more...)

Read more: David A. Wheeler

Posted via email from Jasper-net