lkml.org 
[lkml]   [1998]   [Jul]   [16]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRSBAC 1.0.3 for Linux Kernel 2.0.34
To all people interested in enhancing Linux access control:

The new Rule Set Based Access Control version 1.0.3 is available at
http://agn-www.informatik.uni-hamburg.de/people/1ott/rsbac


RSBAC Changes in recent versions
--------------------------------

1.0.2A: - Port to 2.0.34
- A few #ifdef CONFIG_RSBAC_USE_RSBAC_OWNER were missing, causing
error messages "rsbac_set/get_attr returned error" -> added

1.0.3: - Target DEV added. Now devices can get their own attributes based
on major/minor numbers. Attributes based on their file representations
in /dev are no longer used for open, but still for all other calls.
MAC decisions on open requests for devices must be explicitely enabled
by mac_check to keep system bootable.
Short rule: Only if contents is accessed, DEV attributes apply.
- Attribute object_type removed, was not used anyway and maintained in
linux structures.
- Attributes log_array_low and log_array_high for FILE/DIR/DEV added,
providing individial request based logging for those objects.
- PM module: if DEV is personal_data, neccessary access is checked
for new class DEV (can be changed to custom class)
- A couple of minor bugfixes done


-------------------------

WHAT IS RSBAC?

RSBAC is mostly a big patch for current stable Linux kernels. It is based
on the Generalized Framework for Access Control (GFAC) by Abrams and
LaPadula and provides a flexible system of access control based on several
modules.

All security relevant system calls are extended by security
enforcement code. This code calls the central decision component, which
in turn calls all active decision modules and generates a combined decision.
This decision is then enforced by the system call extensions.

Decisions are based on the type of access (request type), the access target
and on the values
of attributes attached to the subject calling and to the target to be
accessed. Additional independent attributes can be used by individual modules,
e.g. the
privacy module (PM). All attributes are stored in fully protected
directories, one on each mounted device. Thus changes to attributes require
special system calls provided.

As all types of access decisions are based on general decision requests,
many different security policies can be implemented as a decision module. In
the current RSBAC version (1.0.3), six modules are included:

MAC: Bell-LaPadula Mandatory Access Control (compartements not yet
implemented)
CWI: Clark-Wilson-Integrity (only basics implemented)
FC: Functional Control. A simple role based model, restricting access
to security information to security officers and access to system
information to administrators.
SIM: Security Information Modification. Only security
administrators are allowed to modify data labeled as security information
PM: Privacy Model. Simone Fischer-Hübner's Privacy Model in its first implementation.
MS: Malware Scan. Scan all files for malware on execution
(optionally on all read accesses), deny access if infected. Currently only
the Linux viruses Bliss.A and Bliss.B are detected.

A general goal of RSBAC is to some day reach Orange Bool (TCSEC) B1 level.
For this many special problems have been and will have to be addressed.


HOW IT WILL GO ON

Who knows?-) But there are a few things planned for the future:
- Improve documentation - there are man pages, model descriptions and
other stuff missing (volunteers?)
- Move user and password management into kernel structures, providing a combined
login-setuid system call and an administration call
- Provide library patches and changes to checkpasswd (for qmail etc.) to
use it
- Change suser() calls (is user root?) to decision calls with appropiate
requests and targets
- Disable set(u|g)id system calls
- Disable setuid file mode, replace by trusted_for attributes, similar
to replacement of suser() (setting of attributes will be checked by request
MODIFY_ATTRIBUTES, as usual)
- Care for object reuse problem
- Provide a kind of version information and update, if attribute binary
structure has changed (currently done logically by attribute backup and restore)
- (Maybe) Join RSBAC with Pretty Secure Linux
- (Some day) With or without PSL: Meet B1 security requirements.


Amon Ott.

--
Please remove second ao for E-Mail reply - no spam please!
## CrossPoint v3.11 ##

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.altern.org/andrebalsa/doc/lkml-faq.html

\
 
 \ /
  Last update: 2005-03-22 13:43    [W:0.161 / U:0.336 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site