Security Module Stacks That Don't Fall Over. Casey Schaufler Intel Open Source Technology Center

Transcription

1 Security Module Stacks That Don't Fall Over Casey Schaufler Intel Open Source Technology Center

2 Casey Schaufler Kernel developer from the 1970 s Supercomputers in the 1990 s Smack Linux Security Module Security module stacking Photo Curtesy Ann Forrister 2

3 Linux Security Module Collection of security hooks Additions to traditional access controls You security people are insane. 3

4 Security Module Stack A collection of security modules Called in order Bail on fail policy 4

5 Minor Security Module Checks based on available state

6 Major Security Module Checks on module managed state System managed security blobs Netlabel and/or secmarks

7 Capability Yama LoadPin Stacking as of 4.18 Success Failure

8 Stumbing Block Blob Pointers

9 task cred file sock inode ipc key msg_msg superblock Security Blobs 9

10 cred Infrastructure Managed Blobs I want 200 I want 176 I want 32 I want 8 10

11 Capability Yama LoadPin Stacking with infrastructure managed blobs Success Failure

12 Stumbling Block secids

13 32 bits allows one module s data rc = security_cred_getsecid(cred, &secid); rc = security_secctx_to_secid(ctx, ctxlen, &secid); rc = security_secid_to_secctx(secid, &data, &datalen); 13

14 Replace u32 with struct secids With stacking struct secids { u32 selinux; u32 smack; u32 apparmor; }; Without stacking struct secids { union { u32 selinux; u32 smack; u32 apparmor; }; }; 14

15 Identify which to use Within a security module sec->sid = secid->selinux; 15

16 Identify which to use In netfilter case SECMARK_MODE_SEL: info->secid = secid.selinux; break; case SECMARK_MODE_SMACK: info->secid = secid.smack; break; 16

17 Identify which to use Select by task attribute prctl(pr_set_display_lsm, selinux, 7, 0, 0); 17

18 Capability Yama LoadPin Stacking with struct secids Success Failure

19 Stumbling Block Mount Options

20 Unrecognized Option mount o seclabel,smackfsroot= * Stop failing on unknown options Multiple mount option structures 20

21 Stumbling Block netlabel

22 Packet Labeling One CIPSO tag IP Packet Packet Header IP Options CIPSO/CALIPSO Security modules must agree 22

23 Pushed attributes Security modules push data to netlabel Other sub-systems pull data Attributes stored in socket In network format May not be used in the end 23

24 Netlabel Configuration Unlabeled networks Default for SELinux Labeled networks Default for Smack Address selectors Defers labeling until delivery 24

25 Granularity Security modules won t be synchronized May change after socket creation 25

26 Capability Yama LoadPin Stacking with netlabel equality Success Failure

27 What Can Still Cause Problems?

28 Redundant purpose Don t use SELinux and Smack together Do use Smack and AppArmor together 28

29 Networking Don t confuse IP Use one network enabled module 29

30 User Space May get confused /sys/kernel/security/lsm Updates needed for real support systemd id ls 30

31 Advice For New Security Modules

32 Networking Make netlabel optional Read the netlabel code before trying to use it Define sane behavior on unlabeled networks 32

33 Process Attributes Create a subdir in /proc/ /attr Create user space wrappers for SO_PEERSEC 33

34 Think twice about using secids Do you need audit events? What about tmpfs? 34

35 Be careful with state Module hooks may not get called Avoid additional memory management Let the infrastructure do it 35

36 Summary

37 Stacks of dissimilar modules are good Stacks should avoid fighting over the network Modules should color within the lines 37

38 Thank You