Overview of NSA Security Enhanced Linux Russell Coker
Features of SE Linux Mandatory Access Control (MAC). Administrator fully controls access granted to user resources. The user can not grant more access to their files than the administrator desires. Fully configurable by policy – no need to recompile programs to change the access granted to resources. All access is controlled by SE Linux, a root user with low SE Linux privileges can not do anything exciting – I have run machines on the Internet with an open root password to demonstrate this.
Isolation of Security Domains
Strict vs Targeted Policy Strict policy aims to restrict all access as much as possible. Restricts all daemons and all user login sessions. Usually requires some configuration and customisation. Often requires custom policy for daemons or setuid programs for which there is currently no policy. Targeted policy aims to restrict only programs that can be restricted without much risk. No restrictions on user login sessions and some daemons are not restricted. In most situations it will work with no customisation. Daemons which lack policy run with no restrictions.
Security Policy Kernel stores a database which for each combination of domain and type specifies what access is to be granted and whether it is to be logged Security policy database is loaded into the kernel by init early in the boot process Policy database can be re-loaded at any time to change the security policy (if permitted) Every file/directory on disk must be labeled with a security context in accordance with the policy (the policy package includes a file which lists the default contexts for files)
Domain Type The core of SE Linux access control is the “Domain Type” model (DT) Every process has a security domain Every object a process may access has a type Domains and types not strongly differentiated, a domain is a type that applies to a process
MLS SE Linux also includes support for Multi-Level Security (MLS) Implemented in a flexible manner which is under the control of policy Expected that the DT model protects the system integrity while MLS protects data secrecy MLS support includes levels (equivalent to Top Secret, Secret, Classified, and Unclassified), there may be an arbitrary number of levels which are numbered Also includes categories such as for departments, projects, etc Support for preventing “read-up” and “write-down”
MCS Multi Category Security (MCS) meets the needs of commercial organizations Provides a set of categories to determine access to each file Process can access a file if it's categories are a super-set of the categories of the file MCS is a variant of MLS
Q/A Main SE Linux web site My SE Linux web pages (includes notes from this talk