Documentacion

Secure Programming for Linux and Unix HOWTO

David A. Wheeler
Copyright © 1999, 2000, 2001, 2002, 2003 by David A. Wheeler v3.010, 3 March 2003

This book provides a set of design and implementation guidelines for writing secure programs for Linux and Unix systems. Such programs include application programs used as viewers of remote data, web applications (including CGI scripts),network servers, and setuid/setgid programs. Specific guidelines for C, C++, Java, Perl, PHP, Python, Tcl, and Ada95 are included. For a current version of the book, see http://www.dwheeler.com/secure−programs

This book is Copyright (C) 1999−2003 David A. Wheeler. Permission is granted to copy, distribute and/or modify this book under the terms of the GNU Free Documentation License(GFDL), Version 1.1 or any later version published by the Free Software Foundation; with the invariant sections being ``About the Author'', with no Front−Cover Texts, and no Back−Cover texts. A copy of the license is included in the section entitled "GNU Free Documentation License". This book is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even theimplied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

Secure Programming for Linux and Unix HOWTO

Table of Contents
Chapter 1. Introduction ......................................................................................................................................1 Chapter 2.Background......................................................................................................................................4 2.1. History of Unix, Linux, and Open Source / Free Software..............................................................4 2.1.1. Unix..................................................................................................................................4 2.1.2. Free Software Foundation.................................................................................................4 2.1.3. Linux.................................................................................................................................5 2.1.4. Open Source / Free Software............................................................................................5 2.1.5. Comparing Linux andUnix..............................................................................................5 2.2. Security Principles............................................................................................................................6 2.3. Why do Programmers Write Insecure Code?...................................................................................7 2.4. Is Open Source Good forSecurity?..................................................................................................8 2.4.1. View of Various Experts ...................................................................................................8 2.4.2. Why Closing the Source Doesn't Halt Attacks...............................................................10 2.4.3. Why Keeping VulnerabilitiesSecret Doesn't Make Them Go Away............................11 2.4.4. How OSS/FS Counters Trojan Horses ............................................................................11 2.4.5. Other Advantages...........................................................................................................12 2.4.6. BottomLine....................................................................................................................12 2.5. Types of Secure Programs..............................................................................................................13 2.6. Paranoia is a Virtue.........................................................................................................................14 2.7. Why Did I Write This...