Secure Coding Guide.pdf

《Secure Coding Guide.pdf》由会员上传分享，免费在线阅读，更多相关内容在学术论文-天天文库。

1、SecureCodingGuideContentsIntroductiontoSecureCodingGuide7AtaGlance7Hackers,Crackers,andAttackers7NoPlatformIsImmune8HowtoUseThisDocument9SeeAlso10TypesofSecurityVulnerabilities11BufferOverflows11UnvalidatedInput12RaceConditions13InterprocessCommunication13Inse

2、cureFileOperations13AccessControlProblems14SecureStorageandEncryption15SocialEngineering16AvoidingBufferOverflowsandUnderflows17StackOverflows18HeapOverflows20StringHandling22CalculatingBufferSizes25AvoidingIntegerOverflowsandUnderflows27DetectingBufferOverflo

3、ws28AvoidingBufferUnderflows29SecurityFeaturesthatCanHelp32AddressSpaceLayoutRandomization32Non-ExecutableStackandHeap32DebuggingHeapCorruptionBugs33ValidatingInputandInterprocessCommunication34RisksofUnvalidatedInput34CausingaBufferOverflow34FormatStringAttac

4、ks352014-02-11

5、Copyright©2014AppleInc.AllRightsReserved.2ContentsURLsandFileHandling37InjectionAttacks38SocialEngineering38ModificationstoArchivedData39Fuzzing40InterprocessCommunicationandNetworking41RaceConditionsandSecureFileOperations44AvoidingRaceConditio

6、ns44TimeofCheckVersusTimeofUse45SignalHandling47SecuringSignalHandlers47SecuringFileOperations48CheckResultCodes48WatchOutforHardLinks49WatchOutforSymbolicLinks50Case-InsensitiveFileSystemsCanThwartYourSecurityModel50CreateTemporaryFilesCorrectly51FilesinPubli

7、clyWritableDirectoriesAreDangerous52OtherTips58ElevatingPrivilegesSafely60CircumstancesRequiringElevatedPrivileges60TheHostileEnvironmentandthePrincipleofLeastPrivilege61LaunchingaNewProcess62WorkingwithCommand-LineArguments62InheritingFileDescriptors62Abusing

8、EnvironmentVariables63ModifyingProcessLimits63FileOperationInterference64AvoidingElevatedPrivileges64RunningwithElevatedPrivileges64CallstoChangePrivilegeLevel65AvoidingForkingOffaPrivilegedProcess66authopen67launchd67LimitationsandRisksofOtherMechanisms68Writ

9、ingaPrivilegedHelper70Example:Preauthorizing70HelperToolCautions722014-02-11

10、Copyright©2014AppleInc.AllRightsReserved.3ContentsAuthorizationandTrustPolicies73SecurityinaKEXT73Desig