Skip to content
Search

Linux:Kernel:Security

lastmod 2023-03-09created 2019-10-2212 edits

Discretionary Access Control (Unix DAC)

Refers to access control using UID, GID, permissions, and so on. Linux also uses this UNIX model as is.

POSIX ACLs (Extended DAC)

There were several efforts to create a standard that improves on Unix DAC; one of them is POSIX ACLs, which is applied in Linux.

Same concept as Unix DAC, but allows more detailed settings. For example, say users other than the owner (other) have no permissions at all on the file test.txt. With POSIX ACLs, it is possible to give read permission to JB alone among the other users.

POSIX Capabilities

Subdivides the traditional super user (root) based system administration privileges further. That is, it can limit the abilities root can have for a specific executable.

For example, even if the a.out file runs with root privileges ==> restrictions such as "cannot change UID, GID" and "cannot send kill signals" can be imposed. Here, "cannot change UID, GID" ==> each such item is called a "capability".

Linux namespaces

Limits what a process can see. A feature that enables partitioning or isolation.

  • Not a feature made for security, but it can be used for security.
  • Many namespaces can be created, and each process belongs to one namespace.
  • Namespaces are the foundation of Linux containers.
  • In Linux today, the namespaces assigned to a process include several types of namespaces, as follows.
    • UTS: lets each namespace have its own nodename and domainname, as obtained through the uname command (system call).
    • IPC: for SystemV IPC and Posix Message Queues, lets different namespaces have IPC objects with the same name.
    • VFS: lets each process see a different root path. Uses chroot().
    • PID: processes in different namespaces can have the same PID.
    • NETWORK: can have different networking resources.
      • That is, information such as network devices, IP addresses, and IP routing tables can be assigned differently per namespace.
      • Useful when setting up containers: each container has its own network devices, IP addresses, and routing tables, and can use networking when communicating with other containers.
    • USER: isolates the uid and gid space. A process's uid and gid can differ inside and outside the namespace.
      • This way, a process with uid=user is seen as uid=root in its own namespace and as uid=user outside it. This makes sandboxing setups possible.

Network Security

Netfilter

A framework that provides packet filtering.

Labeled Networking

NetLabel, CIPSO, Labeled IPSec and SECMARK.

Label-based network access control. (Like smack labels)

  • Previously, network access control required a separate solution such as iptables, but with labels it can be managed in one place in the LSM.
  • Supported by SELinux and Smack.

Labels packets or sockets according to netfilter rules.

NuFW

  • https://lwn.net/Articles/146120/
  • Not officially included in the Linux kernel.
  • Provides firewall functionality using netfilter. Adds authentication to provide better firewall functionality. (Previously it was based only on IP and port, so users were not taken into account)
  • Accee control is possible not only by IP and PORT but also by User. To avoid degrading performance, for TCP only the initial handshake (SYN packet) is authenticated.

FileSystem

eCryptfs

Enterprise Cryptographic Filesystem. Implemented to fit the POSIX file system level encryption layer.

Difference between block device level encryption and file system level encryption (ecryptfs):

  • block device level encryption : data is encrypted/decrypted during read/write between FileSystem <-> Storage. That is, File Data from Storage is decrypted once it is loaded into kernel memory.
  • file system level encryption : the FileSystem itself encrypts each file and directory. The advantage of this method is that each file or directory can be encrypted with a different key.

It is a stackable file system. lower (encrypted directory), upper (unencrypted directory). It is split into these 2 layers.

  • lower refers to the main file system. For example, if the lower directory is under a directory where ext4 is mounted, it is the ext4 file system.
  • upper is the actual ecryptfs file system, and the ecryptfs file system code links it to lower through encryption and decryption.

Storage

Refers to security features at the block device level.

dm-verity

Handles integrity checking of block devices. The block device being checked must be read-only.

  • Hashes in the form of a Hash Tree (== group hash).
  • VFS --> File System Driver --> Device Mapper --> dm-verity --> block devie --> physical disk
    • When the order of writing down to Storage is as above, the Linux kernel has a layer called Device Mapper, and dm-verity is implemented as a device mapper target.
    • (I don't know much about device mapper)

dm-crypt

Provides encryption for block devices.

Linux Security Module (LSM)

AppArmor, TOMOYO, Smack, SELinux, Yama : the LSMs officially included in the Linux kernel. (The others listed below are not officially included)

FBAC-LSM
http://schreuders.org/FBAC-LSM/
functionality-based application restrictions. That is, it restricts what an application can do.
Not officially included in the Linux kernel.
Yama
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/tree/Documentation/security/Yama.txt?id=HEAD
An LSM officially included in the Linux kernel.
adds restrictions to ptrace, providing a programmatic way to declare relationships between processes
Enables access control over the use of ptrace. That is, the goal is to keep malicious processes from interfering with other processes through ptrace.
/proc/sys/kernel/yama/ptrace_scope ==> the ptrace attach policy changes depending on this value.
gresecurity
https://grsecurity.net/features.php
https://en.wikibooks.org/wiki/Grsecurity
extensive security enhancement patch for the Linux kernel (RBAC, chroot hardening, auditing, stack/heap protection randomization and more...)
Not officially included in the Linux kernel.
Hard to call it just an LSM. It is not simple access contol but a solution for improving Linux Kernel Security as a whole.
Provides a huge number of security features. Can also be used together with LSMs.
Requires a kernel patch. Also provides features through gcc plugins.
Broadly, the features it provides are Memory Corruption Defenses (ROP defense, ASLR, stack overflow, etc.), FileSystem Hardening, Miscellaneous Protections, RBAC (=MAC), GCC Plugins
RSBAC (Rule Set Based Access Control)
https://en.wikipedia.org/wiki/RSBAC
https://www.acsa-admin.org/secshelf/book001/09.pdf
Not officially included in the Linux kernel.
RSBAC == RBAC (Role Based Access Control). The two are used with the same meaning.
Does not use LSM; it implements a General Framework with its own hooking code.
Functionality is similar to SELinux.

Integrity

Runs only approved (untampered) programs. Uses the TPM chip to keep unauthenticated programs from running, and runs only good code.

EVM (Extended Verification Module)
Hashes specific file data and metadata, and signs this hash value with the TPM.
That is, the role of EVM is to protect executables from tampering.
IMA (Integrity Measurement Architecture)
Tracks mmap() usage. Hashes the memory region of files mapped as executable code, and keeps tracking this region. (Signs this region with the TPM??)
That is, the role of IMA is to authenticate the executable code of currently running executables.

Thinking of EVM and IMA together: EVM blocks tampering with offline files, and IMA blocks tampering with the memory of running files.

LIM (Linux Integrity Module)
https://lwn.net/Articles/287790/
Early EVM and IMA used LSM. But because LSM Stacking was not possible and there were side effects, they went in as part of LIM. This lets them work together with LSMs.
Just as LSM installs hooks at key points for access control, LIM also installs hooks at key points for integrity checks.

But there is no explicit mention of LIM in the code. Only the concept of installing hooks remains; it seems to have just been merged into IMA.

Audit

Audit is used to record important events and situations in the kernel. That is, Audit provides several event types (uapi/linux/audit.h). Various parts of the kernel code call the Audit API with the event type that fits the situation to record the event.

  • LSMs and other security features use the Audit API heavily. (audit_log() is the main public api)
  • There is a user daemon called auditd. This daemon writes Audit records to files. /etc/audit/auditd.conf is the configuration file.

Seccomp

Short for secure computing mode. Restricts the system calls a process can make.

When the feature is enabled through the seccomp() system call, for all fds in the calling process, every system call except read(), write(), exit(), and sigreturn() becomes impossible. (Calling one results in SIGKILL)

seccomp with filtering added is seccomp-bfp. It is a feature that lets you add filtering on which system calls to block and on system call arguments. Filtering rules can also be set through the seccomp() system call.

Filtering rules follow the BPF (berkely packet filter) format.

The Linux kernel documentation says seccomp can be used for sandboxing.

Hardening

Hardening means making it harder for attackers to hack the Linux kernel. It can be applied at various levels.

Address Space Layout Randomization (ASLR)
Randomizes the memory into which user level executables are loaded. Recently, a feature that also randomizes the memory loading of the Linux Kernel was added.

== Platform Security (=Hardware Security) == The Linux kernel supports several Hardware Security Features.

SMAP (supervisor mode access prevention)
https://lwn.net/Articles/517475/
A security feature of intel CPUs. Support for it was added to the Linux kernel in 2012.
A page fault occurs on user --> kernel access. But the reverse case, kernel --> user, has no access control. Since the kernel can access every part of user space, this can be dangerous. So it blocks access to user memory with kernel privileges. That is the role of SMAP.
A specific bit for SMAP is added to the CR4 register. When SMAP is enabled, a page fault occurs when the kernel accesses user memory. New instructions called STAC and CLAC were also added, and they enable/disable SMAP. (Access such as copy_to_user must be allowed)
The advantages of SMAP are as follows.
  • Prevents expolits caused by the kernel reading or writing invalid user memory.
  • Kernel developers' mistakes (regarding user memory access) can be found easily.
TPM (Trusted Platform Module)
Refers to a Hardware Chip specification that can store encryption keys and perform cryptographic operations.
Many PCs and laptops since 2006 have shipped with a TPM.
IOMMU (Input Output Memory Management Unit)
https://en.wikipedia.org/wiki/Input%E2%80%93output_memory_management_unit
IOMMU applies the CPU<->MMU<->Physical Memory concept to DMA-capable buses. That is, it becomes peripheral device<->IOMMU<->Physical Memory.
  • That is, during DMA the device does not access physical memory directly; it accesses virtual memory -> the IOMMU remaps it to a physical address.
  • This enables memory protection in the IOMMU.
Supported under the names Intel ==> VT-d / ARM ==> SMMU.
NX (Never Execute)
A technique that separates code and data regions so that data regions are not executed. Using a specific bit in the page table, only memory in executable regions can be executed.
On ARM it is used as the xn bit.

Key (Key Retention Service)

A service that keeps keys, authentication tokens, cross-domain user mappings(??), and so on in the kernel and provides them on request.

  • keyring: a set of keys.
  • user: a key that can also be accessed from user space.
  • logon: a key that can only be accessed from the kernel. (Created from user space; accessed only from the kernel) That is, mainly used when a user space user wants to hide their data in the kernel.
  • Trusted Keys : keys generated in the TPM and kept in the TPM.
  • Encrypted Keys : AES keys generated in the kernel. Protected with a master key. (master key == Trusted Key or user)
    • (For both user and logon, user-space passes the key to the kernel, and the kernel keeps it)

The keys currently managed by the kernel can be checked through /proc/keys and /proc/key-users.

Kernel Self Protection

Bugs caused by faulty kernel code keep appearing. Kernel self protection means addressing these flaws.

static checker (smatch, coverity, ..), dynamic checker (kernel configs, trinity, KASAN, ...),

Linux Containers

An OS-level virtualization method using features provided by the Linux Kernel. (Provides container functionality using kernel features such as namespaces and cgroups)

LXC, LXD, (LXCFS) ==> containers made by canonical. LXC is a container made in 2008, and LXD is an advanced container announced in 2014 and currently in development.

Docker ==> currently the hottest technology using containers(?). If LXC is a container, Docker is an open-source project focused on deploying container-based apps. Docker can run containers using libcontainer (its own container technology), libvirt, LXC, systemd-nspawn, and so on.

See also

Favorite site

author Zer0 sitemap