in reply to Secure deployment of binary perl modules

Binary deployment can be achieved using pp.

(Update: I spotted a hidden but reasonable assumption that deployment takes place in chain from some other environment where compilers and interpreters are freely allowed).

But it is worth pointing out that for these purposes, the perl executable is not a compiler but a scripting interpreter. Assuming there is no webserver running, if it were me, I'd demand that they be consistent about it, i.e. remove /bin/ksh and /bin/sh (the erm "predecessors" of Perl :)) or they allow /usr/bin/perl - there is then zero difference from a security point of view between one scripting language and another. Of course, they can't remove ksh and sh because that would break the system so badly it would descend into a coma never to return or reboot, requiring reinstallation of the operating system.

If the system is indeed connected to the internet, a more reasonable and far more competent security precaution would be nevertheless to restrict the execute permission of /usr/bin/perl to 750, chown it to the group where applications run and to run the webserver in a separate group.

The real incompetence is usually running webservers as root and it is ridiculous to blame Perl for the security consequences of that - i.e. it is like rearranging the deckchairs on the Titanic.

-M

Free your mind

  • Comment on Re: Secure deployment of binary perl modules

Replies are listed 'Best First'.
Re^2: Secure deployment of binary perl modules
by polettix (Vicar) on Mar 19, 2007 at 15:38 UTC
    I think that the OP was simply stating that they're not allowed to have C/C++ compilers on production machines, hence they cannot install modules the usual way because they cannot deal with XS.

    Update: d'oh, I see that this was already raised up further in the thread.

    Flavio
    perl -ple'$_=reverse' <<<ti.xittelop@oivalf

    Don't fool yourself.
Re^2: Secure deployment of binary perl modules
by TGI (Parson) on Mar 19, 2007 at 17:47 UTC

    My sense of the original post, though it was unclear, was that the OP wanted a way to install pre-compiled modules for use with an existing perl interpreter.

    In any case the PAR tools should do the trick. The OP can use PAR to create application bundles and run straight from the PAR, or he can use PAR-Dist to install them. If a general purpose perl interpreter is forbidden, as you said, he can use pp to bundle an interpreter.


    TGI says moo