Messages in this thread | | | Date | 16 Jul 1998 15:33:00 +0200 | From | (A. Ott) | Subject | RSBAC 1.0.3 for Linux Kernel 2.0.34 |
| |
To all people interested in enhancing Linux access control:
The new Rule Set Based Access Control version 1.0.3 is available at http://agn-www.informatik.uni-hamburg.de/people/1ott/rsbac
RSBAC Changes in recent versions --------------------------------
1.0.2A: - Port to 2.0.34 - A few #ifdef CONFIG_RSBAC_USE_RSBAC_OWNER were missing, causing error messages "rsbac_set/get_attr returned error" -> added
1.0.3: - Target DEV added. Now devices can get their own attributes based on major/minor numbers. Attributes based on their file representations in /dev are no longer used for open, but still for all other calls. MAC decisions on open requests for devices must be explicitely enabled by mac_check to keep system bootable. Short rule: Only if contents is accessed, DEV attributes apply. - Attribute object_type removed, was not used anyway and maintained in linux structures. - Attributes log_array_low and log_array_high for FILE/DIR/DEV added, providing individial request based logging for those objects. - PM module: if DEV is personal_data, neccessary access is checked for new class DEV (can be changed to custom class) - A couple of minor bugfixes done
-------------------------
WHAT IS RSBAC?
RSBAC is mostly a big patch for current stable Linux kernels. It is based on the Generalized Framework for Access Control (GFAC) by Abrams and LaPadula and provides a flexible system of access control based on several modules.
All security relevant system calls are extended by security enforcement code. This code calls the central decision component, which in turn calls all active decision modules and generates a combined decision. This decision is then enforced by the system call extensions.
Decisions are based on the type of access (request type), the access target and on the values of attributes attached to the subject calling and to the target to be accessed. Additional independent attributes can be used by individual modules, e.g. the privacy module (PM). All attributes are stored in fully protected directories, one on each mounted device. Thus changes to attributes require special system calls provided.
As all types of access decisions are based on general decision requests, many different security policies can be implemented as a decision module. In the current RSBAC version (1.0.3), six modules are included:
MAC: Bell-LaPadula Mandatory Access Control (compartements not yet implemented) CWI: Clark-Wilson-Integrity (only basics implemented) FC: Functional Control. A simple role based model, restricting access to security information to security officers and access to system information to administrators. SIM: Security Information Modification. Only security administrators are allowed to modify data labeled as security information PM: Privacy Model. Simone Fischer-Hübner's Privacy Model in its first implementation. MS: Malware Scan. Scan all files for malware on execution (optionally on all read accesses), deny access if infected. Currently only the Linux viruses Bliss.A and Bliss.B are detected.
A general goal of RSBAC is to some day reach Orange Bool (TCSEC) B1 level. For this many special problems have been and will have to be addressed.
HOW IT WILL GO ON
Who knows?-) But there are a few things planned for the future: - Improve documentation - there are man pages, model descriptions and other stuff missing (volunteers?) - Move user and password management into kernel structures, providing a combined login-setuid system call and an administration call - Provide library patches and changes to checkpasswd (for qmail etc.) to use it - Change suser() calls (is user root?) to decision calls with appropiate requests and targets - Disable set(u|g)id system calls - Disable setuid file mode, replace by trusted_for attributes, similar to replacement of suser() (setting of attributes will be checked by request MODIFY_ATTRIBUTES, as usual) - Care for object reuse problem - Provide a kind of version information and update, if attribute binary structure has changed (currently done logically by attribute backup and restore) - (Maybe) Join RSBAC with Pretty Secure Linux - (Some day) With or without PSL: Meet B1 security requirements.
Amon Ott.
-- Please remove second ao for E-Mail reply - no spam please! ## CrossPoint v3.11 ##
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.rutgers.edu Please read the FAQ at http://www.altern.org/andrebalsa/doc/lkml-faq.html
| |