A Control Point for Reducing Root Abuse of File-System Privileges - PowerPoint PPT Presentation

Introduction Solution for the Desktop A Control Point for Reducing Root Abuse of File-System Privileges Glenn Wurster , Paul C. van Oorschot School of Computer Science Carleton University, Canada 6 Oct 2010 Glenn Wurster, Paul C. van Oorschot Reducing Root Abuse 1/ 24

Introduction Solution for the Desktop Separation of Duties Installer Frameworks Problem Root privileged processes can arbitrarily modify the system Solution Don’t run as root Glenn Wurster, Paul C. van Oorschot Reducing Root Abuse 2/ 24

Introduction Solution for the Desktop Separation of Duties Installer Frameworks Re-phrasing the requirements On the desktop, we should treat two applications as mutually untrustworthy. During install, upgrade, uninstall, and 1 run-time. The paper concentrates only on the 2 file-system. Allow file-system reads, but don’t allow modifications. Glenn Wurster, Paul C. van Oorschot Reducing Root Abuse 3/ 24

Introduction Solution for the Desktop Separation of Duties Installer Frameworks Other Approaches to Divide Root e.g., SELinux dpkg given almost total control over the file-system Glenn Wurster, Paul C. van Oorschot Reducing Root Abuse 4/ 24

Introduction Solution for the Desktop Separation of Duties Installer Frameworks T wo States Glenn Wurster, Paul C. van Oorschot Reducing Root Abuse 5/ 24

Introduction Solution for the Desktop Separation of Duties Installer Frameworks T wo States, Many Users Glenn Wurster, Paul C. van Oorschot Reducing Root Abuse 6/ 24

Introduction Solution for the Desktop Separation of Duties Installer Frameworks T wo States, Many Applications Glenn Wurster, Paul C. van Oorschot Reducing Root Abuse 7/ 24

Introduction Solution for the Desktop Separation of Duties Installer Frameworks Our focus Configuration related files: Modified during configuration, not during day-to-day use 1 We focus on system-wide configuration files 2 Files most commonly modified through install, upgrade, and uninstall Glenn Wurster, Paul C. van Oorschot Reducing Root Abuse 8/ 24

Introduction Solution for the Desktop Separation of Duties Installer Frameworks Application Installers Run a Script or Binary Provided by application author 1 Usually run as Administrator 2 e.g., make install , self-extracting 3 ZIP Glenn Wurster, Paul C. van Oorschot Reducing Root Abuse 9/ 24

Introduction Solution for the Desktop Separation of Duties Installer Frameworks Application Packages sudo apt-get install <package> Typically, become root and run 1 package manager Package manager runs scripts in 2 package Glenn Wurster, Paul C. van Oorschot Reducing Root Abuse 10/ 24

Introduction Solution for the Desktop Separation of Duties Installer Frameworks Application Bundles Drag and Drop Drag to the destination folder 1 No scripts run during install 2 Glenn Wurster, Paul C. van Oorschot Reducing Root Abuse 11/ 24

Introduction Solution for the Desktop Separation of Duties Installer Frameworks Google Android Self Signing Isolate update to just the package 1 No scripts run during install 2 Glenn Wurster, Paul C. van Oorschot Reducing Root Abuse 12/ 24

Introduction Solution for the Desktop Separation of Duties Installer Frameworks GoboLinux Don’t modify files during 1 upgrade Redesign the file-system 2 hierarchy Glenn Wurster, Paul C. van Oorschot Reducing Root Abuse 13/ 24

Introduction Solution for the Desktop Separation of Duties Installer Frameworks GoboLinux - Restricting Scripts Restricting Scripts Script has write access to 1 build source and install destination Glenn Wurster, Paul C. van Oorschot Reducing Root Abuse 14/ 24

Introduction Solution for the Desktop Separation of Duties Installer Frameworks Application Installer Goal Encapsulates User Friendly FS Hierarchy Separation Agnostic Upgrade Scripts Config Method � � � � Installer Package � � � � � Bundle � � � Android � � � � GoboLinux � � � � Goal � � � � � � Glenn Wurster, Paul C. van Oorschot Reducing Root Abuse 15/ 24

Introduction Solution for the Desktop Breakdown of Separation Configuration related files: 1 Identified as c-locked , protected by kernel Encapsulating configuration of applications: 2 Delegated to a user-space app called configd Glenn Wurster, Paul C. van Oorschot Reducing Root Abuse 16/ 24

Introduction Solution for the Desktop The Control Point Glenn Wurster, Paul C. van Oorschot Reducing Root Abuse 17/ 24

Introduction Solution for the Desktop What can be c-locked? Store the c-locking flag in the inode, protecting: Files 1 Symbolic Links 2 Hard Links 3 Directories 4 Glenn Wurster, Paul C. van Oorschot Reducing Root Abuse 18/ 24

Introduction Solution for the Desktop The Prototype: GoboLinux + Debian Linux Files in the package are segregated by 1 Debian’s dpkg Scripts are restrained using an approach 2 similar to GoboLinux File-system hierarchy is same as standard 3 Debian Glenn Wurster, Paul C. van Oorschot Reducing Root Abuse 19/ 24

Introduction Solution for the Desktop The Prototype: Restricting Applications Restricting Installers We likely don’t have a custom security 1 policy for the program being installed We’re not working with security experts 2 Enforcement Continue enforcement past install 1 Any application gaining root should not be 2 able to modify the system Glenn Wurster, Paul C. van Oorschot Reducing Root Abuse 20/ 24

Introduction Solution for the Desktop Philosophizing T wo options for restricting installers Don’t run installers as root; or 1 Don’t give root all the privileges it 2 currently gets Shifting to not run installers as root Users automatically become root to install 1 Applications still sometimes get root 2 privileges ’Root’ does not distinguish between 3 configuration and day-to-day use Glenn Wurster, Paul C. van Oorschot Reducing Root Abuse 21/ 24

Introduction Solution for the Desktop Prototype Implementation Extended the Linux kernel to enforce 1 c-locked flag Used extended attribute functionality Any file in a package is marked as c-locked Extended dpkg to work with configd 2 Ran install scripts with a restricted UID 3 Glenn Wurster, Paul C. van Oorschot Reducing Root Abuse 22/ 24

Introduction Solution for the Desktop Prototype Evaluation Performance overhead ≤ 4 . 8 % 1 Malware prevented from modifying core 2 c-locked system binaries Satisfied design goals 3 Glenn Wurster, Paul C. van Oorschot Reducing Root Abuse 23/ 24

Introduction Solution for the Desktop A Control Point for Reducing Root Abuse of File-System Privileges Glenn Wurster, Paul C. van Oorschot http://ccsl.carleton.ca Glenn Wurster, Paul C. van Oorschot Reducing Root Abuse 24/ 24

Introduction Solution for the Desktop Slide References Projects: - http://www.debian.org/ - http://www.gobolinux.org/ Images: - http://www.mypointless.com/2009/05/more-headlines-of-obvious.html http://en.wikivisual.com/index.php/Key_(lock) - - http://zarious.deviantart.com/art/Spy-vs-Spy-WallPaper-2560X1024-115603200 - http://websvn.kde.org/trunk/kdesupport/oxygen-icons/scalable/apps/ - http://arstechnica.com/open-source/reviews/2010/07/android-22-froyo.ars/ - http://www.android.com/media/ - http://www.directindustry.com/prod/norma-group/exhaust-pipe-clamp-15287-33925.html - http://www.codeproject.com/kb/WPF/TheWpfThoughtProcess.aspx - http://www.multiplaying.net/2009/07/29/slurms-pondering-of-the-day4/ - http://www.cs.gettysburg.edu/~tneller/mazes/oskar4bit/arduino.html Glenn Wurster, Paul C. van Oorschot Reducing Root Abuse 25/ 24