HPUX kernel compile???

HPUX kernel compile???
Secure Home | Search | About
Login Password
Register Now! Lost Password?
 General Computer Security    Post an article   get this group's latest topics as an RSS feed add this group's latest topics to your My MSN content add this group's latest topics to your My Yahoo content add this group's latest topics to your Google content
Subject Author Date
HPUX kernel compile??? Neil Jones 07-23-2006
Posted by Neil Jones on July 23, 2006, 4:37 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
Hello,

I have been assigned to perform a security review for a HPUX system
which is in production. One thing I have noticed is that the system has
a C compiler on the system. Since this is not a development system I
suggested that it be removed. The sysadmin mentioned that it is
required to perform kernel compilation, which caught me by surprise. I
come from the Linux camp. (I do love all flavors of Unix). My
understanding is that HPUX is a closed source operating system. Has HP
opened it's source code to open source (like Solaris)? If not, then
what type of kernel code is being compiled by the C compiler? The
sysadmin mentioned that this it is a stripped down compiler.

Thank you in advance for any information.

Regards,
--
Neil Jones
cat @yahoo.com >> castellan-gen

God made men and Colt made them equal.
Linus made Linux and Tux made IT companies equal.

Posted by John Burns on July 23, 2006, 5:56 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
> I have been assigned to perform a security review for a HPUX system
> which is in production. One thing I have noticed is that the system has
> a C compiler on the system. Since this is not a development system I
> suggested that it be removed. The sysadmin mentioned that it is
> required to perform kernel compilation, which caught me by surprise. I
> come from the Linux camp. (I do love all flavors of Unix). My
> understanding is that HPUX is a closed source operating system. Has HP
> opened it's source code to open source (like Solaris)? If not, then
> what type of kernel code is being compiled by the C compiler? The
> sysadmin mentioned that this it is a stripped down compiler.

It's a basic K&R C compiler and it is indeed needed to build a kernel.

I don't know if it compiles anything or not. But I'll bet the linker is
used to add new library modules.

--
Who needs a life when you've got Unix? :-)
Email: john@unixnerd.demon.co.uk, John G.Burns B.Eng, Bonny Scotland
Web : http://www.unixnerd.demon.co.uk - The Ultimate BMW Homepage!
Need Sun or HP Unix kit? http://www.unixnerd.demon.co.uk/unix.html
www.Strathspey.co.uk - Quality Binoculars at a Sensible price

Posted by Dennis Handly on July 25, 2006, 2:38 am
If you were  Registered and logged in, you could reply and use other advanced thread options
John Burns wrote:
: It's a basic K&R C compiler and it is indeed needed to build a kernel.
: I don't know if it compiles anything or not. But I'll bet the linker is
: used to add new library modules.

It depends on what version of HP-UX. On 11.23, only the linker is used.

>I think, the newer HP-UX versions have the aCC with them:

Only on IPF.

>Traditional Unix systems were configured by defining the size of
>certain tables in C code and them compiling and linking them.
>Only a small part of the actual code was shipped with the OS; the
>rest was shipped in binary form.

Yes, that was 11.11 through 11.22 (and previous versions).

>Usually, it's just an ANSI compiler.

Not on HP-UX. For PA it is K&R for IPF it is now a stripped down
ANSI C compiler.

Posted by all mail refused on July 23, 2006, 6:21 pm
If you were  Registered and logged in, you could reply and use other advanced thread options

> I have been assigned to perform a security review for a HPUX system
> which is in production. One thing I have noticed is that the system has
> a C compiler on the system. Since this is not a development system I
> suggested that it be removed. The sysadmin mentioned that it is
> required to perform kernel compilation, which caught me by surprise.

Unless you control all the HP systems in the world removing a compiler
from this one gets you a very limited security benefit. And then there
are all the cross-compilers on other platforms.

You could reasonably ask how often they expect to compile a kernel.

--
Elvis Notargiacomo master AT barefaced DOT cheek
http://www.notatla.org.uk/goen/
One of my other 11 computers runs Minix.

Posted by Andrew on July 23, 2006, 6:37 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
Neil Jones wrote:
> Hello,
>
> I have been assigned to perform a security review for a HPUX system
> which is in production. One thing I have noticed is that the system has
> a C compiler on the system. Since this is not a development system I
> suggested that it be removed. The sysadmin mentioned that it is
> required to perform kernel compilation, which caught me by surprise. I
> come from the Linux camp. (I do love all flavors of Unix). My
> understanding is that HPUX is a closed source operating system. Has HP
> opened it's source code to open source (like Solaris)?

No.

> If not, then
> what type of kernel code is being compiled by the C compiler?

Very little. HPUX does not "re-compile" a kernel in the same sense
you're used to in Linux. It compiles conf.c (containing driver and
tunable parameter information) and links existing libraries to create a
new kernel. Similar to SCO and other proprietary System V variants.
Patches may contain new libraries which are then linked into a new
kernel during the patch-installation/build process.

See: http://docs.hp.com/en/1219/tuningwp.html

> The
> sysadmin mentioned that this it is a stripped down compiler.

He is correct.

See: http://www.faqs.org/faqs/hp/hpux-faq/

Subject: 6.2.1 Why is the default C compiler brain-dead?
Updated: 04/13/01

The C compiler shipped with HP-UX is intended only to rebuild the kernel
with, not for program development. To get a "real" C compiler, you have
two options:

o buy HP's ANSI C product
o use the GNU C Compiler (gcc), downloadable in binary form from the
Liverpool archive

>
> Thank you in advance for any information.

Out of curiosity, why do you believe that removing a C-compiler from a
UNIX system will make it more secure?

andrew@lod.com

Similar ThreadsPosted
Compile/Configure Apache 1.3.31 problem without error message July 19, 2004, 11:49 pm
Recompiling the kernel July 11, 2005, 3:44 am
Does kernel 2.6 include an NSA backdoor? March 4, 2008, 7:19 pm
HPSBUX02127 SSRT051056 - rev.1 HP-UX Kernel Local Denial of Service (DoS) June 23, 2006, 7:59 am

The site map in XML format XML site map

Contact Us | Privacy Policy