1. Security Improvements in Linux Using Capabilities
Gautam Barua
Department Of Computer Science & Engg
Indian Institute of Technology, Guwahati

2. Outline Posix Capabilities Discretionary Access Control
Set user on execution
Mandatory Access Control
Linux Security Modules
SeLinux
Buffer Overflow Attack
Posix Capabilities
Work at IITG

3. Discretionary Access Control
Owner-administered
Mode bits: User, Group, Others
Basic Permissions: Read, Write, Execute
rwxr_ _ r_ _ owner_id group_id …….
Access Control Lists added in later versions of Unix (and Linux).
Can specify particulars users or groups who are given permissions or denied permissions.
IIT Guwahati

4. Discretionary Access Control
Setting controls is at the discretion of users.
An “owner” is identified with every file
Mode bits can be changed by the owner.
Distributed control
Easy to manage
User controls her data
Attacks can be catastrophic
IIT Guwahati

5. Set uid on execution ls – l /var/bin/ps
r_sr_xr_x root root ……………… ps
When user gb executes “ps”, the process executing “ps” gets an effective user id of “root”.
So privileges of “root” are available to the program “ps” even though it is gb executing it.
IIT Guwahati

6. Set uid on execution
But only what “ps” can do as root is allowed to gb.
This method of controlled escalation of privileges provides flexibility in managing resources.
BUT
Mistakes may be made by administrators
If write permission is given inadvertently to the file containing “ps” ….
IIT Guwahati

7. Set uid on Execution More seriously, there may be a bug in “ps”
This may be exploited by an intruder, and the process running “ps” may be made to execute some malicious code.
This malicious code will get root privileges and can therefore wreck havoc.
We should give only the necessary privileges to programs like “ps”, not full root privileges.
IIT Guwahati

8. Mandatory Access Control
Controls imposed by a central administrator
Enforced by the OS kernel
User programmes cannot over-ride the controls
Complex to implement
Restrictive to users
Less vulnerable to attacks
IIT Guwahati

9. Mandatory Access Control
Linux Security Module (LSM)
General kernel framework for implementing security modules
Around 200 hooks
About 150 are for mediation
Others for allocation/freeing, labelling, ad hoc management
IIT Guwahati

10. Linux Security Module Add a “security” field to major data structures:
task_struct, inode, sk_buff, net_device, …
Type: void *security;
Add hooks in kernel critical points
To manage the “security” field
To perform access control as per defined policies
Register/unregister
Using register_security()/unregister_security()
LSM recognizes only the primary module
mod_reg_security enables a second module to stack
IIT Guwahati

11. Security Enhanced Linux (SeLinux)
Mandatory Access Control Implementation
Uses LSM
Fine Grained Control Possible
Complex to set up
Flexibility is therefore low
Critics say chances of misconfiguration high and so vulnerability increases
IIT Guwahati

12. Security Enhanced Linux (SeLinux)
Subject (e.g. process)
Object (e.g. file)
Action (e.g. file read)
Subject has a
Security Context :
User Identifier (few)
Role (few)
Types (hundreds)
IIT Guwahati

13. Buffer Overflow Attack
void func (char *str) {
char buffer[16];
strcpy(buffer,str); }
void main() {
char large_string[256];
int i;
for( i = 0; i < 255; i++)
large_string[i] = 'A';
func (large_string);
IIT Guwahati

14. Buffer Overflow Attack
Run Time Stack when “func” is called
Buffer [0..15]
*str
Return address
Attack Code
IIT Guwahati

15. Buffer Overflow Attack
#include <stdio.h>
void main() {
char *name[2];
name[0] = "/bin/sh";
name[1] = NULL;
execve(name[0], name, NULL); }
IIT Guwahati

16. POSIX Capabilities Fine grain control of who can do what
Traditional: all-or-nothing: root can do everything, normal user can do nothing
Capabilities: define a set of distinct privileges in the system (if a task has a capability, it is permitted to do a certain task)
POSIX 1.e defines a list of capabilities
Linux implements 8 from POSIX, and adds 24 Linux-specific (total 32)
Not Capabilities as per classical definition
IIT Guwahati

17. Capabilities CAP_CHOWN: allow changing file ownership
CAP_SETUID: allow manipulations of UIDs
CAP_NET_BIND_SERVICE: allow binding to TCP/UDP port below 1024
CAP_DAC_OVERRIDE: bypass rwx permission checks
CAP_SYS_NICE: allow changing nice level
CAP_FOWNER: bypass need for uids to match (e.g. chmod)
CAP_SYS_PTRACE: allow ptrace() of any process
CAP_SYS_CHROOT: allow use of chroot()
IIT Guwahati

18. Capabilities CAP_MKNOD: allow creation of special files
CAP_SYS_MODULE: allow loading and unloading of kernel modules
CAP_DAC_READ_SEARCH: bypass directory read and execute permission checks
CAP_FSETID: don’t clear suid and sgid flags on files when modified.
CAP_KILL: bypass permission checks for sending signals
CAP_NET_RAW: allow the use of raw sockets
IIT Guwahati

19. Capabilities Implementation
32-bit integer
Bitmap: 1 bit per capability: 1 means having the corresponding capability , 0 means no
Maximum 32 capabilities support in Linux (will increase to 64 bit in coming versions)
Operations:
cap_raise(c, flag): Include the capability in c
cap_lower(c, flag): Remove the capability from c
cap_raised(c, flag): c having the capability?
IIT Guwahati

20. Capability Set in Processes
Each process has 3 sets of capabilities
Permitted set: capabilities the task can use
Effective set: capabilities that the task currently chooses to use (so as to lower privileges temporarily)
Inheritable set: capabilities that are preserved across an “execve”
A child that is forked gets a copy of each of the three sets
IIT Guwahati

21. Use Capabilities
Kernel can check the capability before doing privileged actions:
...
if (!capable(CAP_XXX))
return -EPERM;
capable(cap): does this process have the capability?
int capable(int cap) {
if (cap_raised(current->cap_effective, cap))
return 1;
return 0; }
IIT Guwahati

22. Capability Example Controlling system call nice() In kernel/sched.c: {
asmlinkage long sys_nice(int increment) {
if (increment < 0) {
if (!capable(CAP_SYS_NICE))
return -EPERM; …
IIT Guwahati

23. Giving Capabilities Capabilities are copied from the parent process
But there is a need to provide program specific capabilities, and inheriting from the parent will not give the required functionality.
So associate capabilities with executable programs.
Store capabilities in files containing executable programs.
IIT Guwahati

24. File Capabilities Executable files can have capabilities too
Also have 3 sets: permitted, effective, inheritable
Stored as file attributes in file systems
Changes the process's capabilities after execve()
Capability rules
Inheritable set does not change after execve()
New permitted set = file permitted set OR (file inheritable set AND process permitted set)
New effective set = file effective set AND new permitted set
IIT Guwahati

25. File Capability Implementation
Executable file data structure: struct linux_binprm
Defined in include/linux/binfmts.h
Fields related to capabilities:
kernel_cap_t cap_inheritable, cap_permitted, cap_effective;
When an executable file is loaded:
Fill in linux_binprm from file system and call compute_creds()
Example: load ELF file: function load_elf_binary() calls compute_creds()
IIT Guwahati

26. File Capability Implementation (Cont.)
File system support has been recently added in the Linux kernel starting from Linux rc2.
Uses “extended attributes” feature of ext2 file system to store file capabilities.
IIT Guwahati

27. Ongoing Research at IITG
No process should run with euid = 0
Its difficult to figure out required capabilities for a given executable
How to convert a running system into one with capabilities
Is the available set of capabilities sufficient for an executable?
IIT Guwahati

28. (Cont.) Our goal To ease the process of setting caps
tool which sets the required caps by diagnosing the given executable
Monitor a server (with caps enabled):
Has the tool set the least required caps or not
Gather more information to see if there are any areas left uncovered by the Capability System which should get attention.
IIT Guwahati

29. (cont.) Diagnostic tool
Checks which system calls are called by the executable
In cases where the capabilities check straightaway access to the system call like CAP_CHOWN, CAP_SYS_PTRACE etc., decision is obvious.
For cases like CAP_NET_RAW, CAP_NET_BIND_SERVICE etc. dynamic heuristics are required as decision depends on arguments passed
IIT Guwahati

30. Questions ???
IIT Guwahati