Security-Enhanced Linux Stephanie Stelling Center for Information Security Department of Computer Science University of Tulsa, Tulsa, OK 74104

Overview History Goals Mandatory Access Controls/Flask Other Features/Default Policy Settings Future of SELinux

About SELinux Not an actual distribution of Linux A set of Linux Security Modules (LSM) that are integrated into the Linux kernel Streamlines software responsible for security policy enforcement Supports DoD’s Orange Book requirements for evaluation classes needing a Trusted Computer Base (B3, A1)

History Originally developed by the NSA’s National Information Assurance Research Laboratory in conjunction with Secure Computing Corporation (SCC) Released to the Open Source community in December 2000 ( Integrated into version 2.6 of the Linux kernel in 2003

Goals Enforce the separation of information based on confidentiality and integrity requirements to provide system security Confine damage caused by malicious or flawed applications

SELinux Basics Mandatory Access Controls (MAC) allow administrators to define how applications and users can access different resources (files, devices, networks, IPC) User can be differentiated from the applications they run Ex. - A user’s shell may be able to do anything within his home directory, but a mail client run by that user may be prevented from accessing certain resources within the home directory

SELinux Basics Type Enforcement All files, processes, network resources, etc. are given a “type” Ex – files in a home directory could be given type user_home_t. The MAC will treat all files with this type the same way based on the security policies. Running applications are also given types and are associated with a domain Ex – Firefox – firefox_t Controls what types can access what resource labels Types for new objects (files) are based on the domain of the creating process and the process’ label Sample policy: allow firefox_t user_home_t : file (read write); This allows the user’s firefox browser to read and write files to the user’s home directory.

Mandatory Access Controls The OS controls the ability of a subject (user, program, etc.) to perform operations on objects (files, directories, ports, memory segments, etc.) Need for: Systems can be easily compromised by exploitable bugs in programs Discretionary Access Control systems don’t take buggy software into consideration

Mandatory Access Controls

Flask: Flux Advanced Security Kernel Based on MAC architecture Defines what objects should be available and not how they should be implemented Supports “user friendly” security policies (easy to understand syntax) Separates policy from enforcement Contains a Security Server and Object Managers

Other Features Policy controls Clean separation of policy from enforcement Well-defined policy interfaces Support for applications querying the policy and enforcing access control (for example, crond running jobs in the correct context) Independent of specific policies and policy languages Support for policy changes Very flexible policy

Other Features Independent of specific security label formats and contents Individual labels and controls for kernel objects and services Caching of access decisions for efficiency Separate measures for protecting system integrity (domain-type) and data confidentiality (multilevel security) Controls over process initialization and inheritance and program execution Controls over file systems, directories, files, and open file descriptors Controls over sockets, messages, and network interfaces

Default Security Policy 1.Control raw access to data Defines types for kernel memory devices, disk devices, etc. Define separate domains for processes that require access to above types 2.Protect the integrity of the kernel Define types for boot files, module object files, module utilities, and module configuration files Defines separate domains for applications requiring write access to the files

Default Security Policy 3.Protect integrity of system software, system configuration info, and system logs Only administrators can modify system software Defines separate types for system configuration files and system logs 4.Confine potential damage from the exploitation of a privileged process Privileged system processes are placed in a separate domain Each domain is limited to only the privileges it requires

Default Security Policy 5.Protect privileged processes from executing malicious code An executable type is defined for each program. Transitions can only be made to the privileged domain by privileged executable typed programs. 6.Prevent the administrator role and domain from being entered without proper authentication Administrator role and domain can only be entered via the login program newrole program added to permit administrator remote login

Default Security Policy 7.Prevent regular user processes from interfering with system or administrator processes Only certain processes and administrators can access procfs entries for other domains Files created in shared directories (/tmp) are separately typed based on domain 8.Protect users and admins from the exploitation of browser flaws The browser is placed in a separate domain with limited permissions Users can allow the browser read or write access to local files

Is SELinux Enabled? Command sestatus Enforcing = System is protected by SELinux Permissive = SELinux is enabled but not currently protecting the system Disabled = SELinux is completely disabled

Implementations SELinux is currently integrated into the following: Linux kernel 2.6 series Solaris Darwin kernel

Future of SELinux NSA has not made any major updates since Sept Control of the project has passed to the SELinux Project group. Goals: Integrate SELinux awareness into other userspace object managers Modify other applications to better leverage SELinux Enhance policy tools and infrastructure Enhance the SELinux reference policy Enhance device labeling Enhance revocation support Develop flexible trusted path mechanism Improve network scalability and performance Improve baseline performance Develop framework and controls for driver-specific operations Develop support for polyinstantiated ports

Similar Systems/Approaches AppArmor (created by Novell Inc.) Virtualization as a means of isolating processes

Sources “Discretionary Access Control vs. Mandatory Access Control”. Fall07/handouts/426_Fall07_lect12.pdf Fall07/handouts/426_Fall07_lect12.pdf “Fig.2 Discretionary and mandatory access controls diagrams”. 76/. 76/ “Security-Enhanced Linux”. “SELinux Project Wiki”.

Questions?