Information Assurance Research Group 1 NSA Security-Enhanced Linux (SELinux) Grant M. Wagner Information Assurance Research Group National Security Agency

Information Assurance Research Group 1 The Need for Secure OS Increasing risk to valuable information – Wide variety of application space security solutions Dependence on OS protection mechanisms Inadequacy of mainstream operating systems – Discretionary access controls can't do the job Key missing feature: Mandatory Access Control (MAC) – Administratively-set security policy – Control over all processes and objects – Decisions based on all security-relevant information

Information Assurance Research Group 1 What can MAC offer? Strong separation of security domains – Separate data based on confidentiality/integrity/purpose System, application, and data integrity – Protect against unauthorized modifications – Prevent ill-formed modifications Ability to limit program privileges – Safely run code of uncertain trustworthiness – Prevent exploit of flaw in program from escalating privilege – Limit each program to only what is required for its purpose

Information Assurance Research Group 1 What can MAC offer? Processing pipeline guarantees – Ensure that data is processed as required – Split processing into small, minimally trusted stages – Encryption, sanitization, virus scanning Authorization limits for legitimate users – Decompose administrator role – Partition users into classes based on position, clearance, etc.

Information Assurance Research Group 1 SELinux provides Flexible MAC Flexible comprehensive mandatory access controls for Linux implemented as a Linux security module Building on 12 years of NSA’s OS Security research Application of NSA’s Flask security architecture – Cleanly separates policy from enforcement using well-defined policy interfaces – Allows users to express policies naturally and supports changes – Comprehensive fine-grained controls over kernel services – Transparent to applications and users Role-Based Access Control, Type Enforcement, optional Multi-Level Security, easily extensible to other models Highly configurable (example configuration provided)

Information Assurance Research Group 1 SELinux Security Impact Limits damage from virus/trojan horse infection – Can inhibit virus propagation Eliminates most privilege elevation attacks Constrains damage from undiscovered exploits – Servers need not be granted admin privileges – Reduces need for immediate security patching Reduces dependence on all-powerful admin Critical services and data can be isolated Allows control over user actions

Information Assurance Research Group 1 SELinux Research Success SELinux developed at NSA as research prototype – Public release in Dec 2000 w/regular updates since – Currently included as security module in 2.6 Kernels – Continues to be excellent platform for security research

Information Assurance Research Group 1 SELinux Acceptance SELinux was released as a reference implementation Direct benefit to Linux Other OS groups incorporating technology Direct User benefit Meeting real security needs Growing user/developer community is contributing back Open Source can be powerful technology transfer tool

Information Assurance Research Group 1 Interest in SELinux Corporate – Used or being used considered for use in products/solutions – Wide variety of industries including OEMs, ISPs, Defense, Telecommunications, SCADA systems, PDAs and other consumer electronics Linux Distributors accepting technology – Red Hat/Debian/Gentoo/Others??? SELinux deployments – Corporate, government, universities

Information Assurance Research Group 1 Research Direction Further user space integration Complete integration into networked environment – Integrate with 2.6 IPSEC and NFSv4 implementations Security-Enhanced X Windows Policy specification and analysis tools Policy management service Platform for application security mechanisms

Information Assurance Research Group 1 Want to learn more? Available at: Mailing list: Send 'subscribe selinux' to