CS5460: Operating Systems Lecture 24: Security CS 5460: Operating - PowerPoint PPT Presentation

CS5460: Operating Systems Lecture 24: Security CS 5460: Operating Systems

 Once upon a time, this patch was made to Linux’s wait4() system call: + if ((options == (__WCLONE|__WALL)) && (current->uid = 0)) � + retval = -EINVAL; �  The commit came from one of the most active kernel developers  What is its effect? CS 5460: Operating Systems

What’s Computer Security All About?  Cryptography  Network security  Writing secure code  Secure hardware  Secure operating systems  Etc … CS 5460: Operating Systems Lecture 25

Today  OS security basics  UNIX security  Multilevel security  Secure operating systems  Integrity and auditing CS 5460: Operating Systems

High-Level Security Goals  Privacy / Confidentiality – Information only available to authorized users  Integrity – Information retains intended content and semantics  Availability – Information retains access and presence  There is tension between these goals  Real systems must make difficult choices between them

How Do We Approach Security?  Devise a security policy – Implements a security model – Boils down to a collection of rules  Next, we try to follow the rules – It’s hard to write large programs that follow security rules – It’s hard to get humans to follow security rules  There are many things that can go wrong CS 5460: Operating Systems

Users  UNIX user -> username -> uid – uid is the system’s real name for user – integer 0 ... 65536 (varies in some systems) – mapping is in /etc/passwd regehr:x:1000:1000:John Regehr,,,:/mnt/z:/bin/bash  More than one username may map to a uid – Desired for some system purposes (program tracking) – Problem for ordinary users (confused file ownership) – Security problem (hacker makes duplicate uid account)  Command to change uid temporarily: su

Unix Groups  A user is in one or more groups  A group contains zero or more users – Groups are used to give better file access control – Defined by /etc/groups and network sharing software – ypcat group.byname – CS department has 961 groups – gid - integer system name for group (generally unique)  Listed for individual users with “groups”  Change group of file with “chgrp” – chgrp newgroup myfile

Unix File Security  Each file has owner and group  Permissions set by owner setid – Read, write, execute - rwx rwx rwx – Owner, group, other – Represented by vector of ownr grp othr four octal values  Only owner, root can change permissions – This privilege cannot be delegated or shared  Setid bits – Discuss in a few slides

UNIX Permissions Practice 16 lab3-1:~> ls –l drwx------+ 2 regehr csprof 2 Sep 8 11:02 Desktop drwx------+ 2 regehr csprof 6 Oct 3 21:23 bin -rw-------+ 1 regehr csprof 25524 Nov 24 11:54 blkdev.h -rw-r--r--+ 1 regehr csprof 63507 Sep 11 23:02 clang-113697.patch -rwxrwx---+ 1 regehr csprof 411 Oct 5 18:11 copy_sat_ops.pl CS 5460: Operating Systems

SETUID and SETGID  Special mechanisms: temporarily use a uid or gid during the execution of a program  Part of mode bits – s in user x field - setuid – s in group x field - setgid  To be effective, both s and x must be set – chmod a+x myprog – chmod u+s myprog – chmod 4755 myprog  WARNING: It’s hard to use this correctly

Handin on CADE  Directory listing for the “ handin ” backend: -rwsrwxr-x 1 root tty 24715 Nov 24 1999 rcvhandin  Now tell me how handin works – What happens when you run it? – How would you use handin to read another student’s files? CS 5460: Operating Systems

Unix Summary  Good things – Some protection from most users – Flexible enough to make things possible  Main bad thing: it’s not very expressive – For example, can’t easily just let a single user mount a CDROM or add users to the system – Too tempting to use root privileges

Multilevel Security  Users with different “ needs to know ” share a computer or network  If don’t need to know – shouldn’t even be able to determine if information exists  Should be able to filter functionality based on allowable information

Military Security Model  Information is ranked: – Unclassified – Confidential – Secret – Top Secret  Least Privilege: Subject should have access to fewest objects needed for successful work – The system backup program may be allowed to bypass read restrictions on files, but it would not have the ability to modify files. – “ Need to Know ”

Compartmentalization Information may belong to one or more compartments Compartments are used to enforce need-to- know.  Classification of Information: <rank; compartments>  Clearance: <rank; compartments> – an indication of a level of trust  A subject can access an object only if – The clearance level of the subject is at least as high as that of the information. – The subject has a need to know about all compartments for which the information is classified.

Information Flow Models  Acts as an filter to control the transfer of information permitted by access to a particular object  Information flow analysis can assure that operating system modules that have access to sensitive data cannot leak that data to calling modules

Bell-LaPadula Model  A formal description of the allowable paths of information flow in a secure system – Applies only to privacy (not availability or integrity) – Identifies paths that could lead to inappropriate disclosures – Is used as the basis for the design of systems that handle data of multiple levels – Includes both discretionary and mandatory access rules

Bell-LaPadula Mandatory Controls  Fixed security classes for each subject and each object  Security classes ordered by a relation  Simple Security Property: – Subject may have read access only if object classified at same level or lower.  * - Property: – Subject may have write access only if all objects read are at same level or higher than object to be written.  Summary: “ No read up, no write down ”  Trusted subjects may violate the *-property

Picture: Confidentiality Read below, write above Read above, write below Proprietary Proprietary S S Public Public

Biba Model  Concerned with integrity rather than privacy  Defines integrity levels much like sensitivity levels – Fixed integrity classes for each subject and each object – Ordered integrity classes

Biba Properties  Simple Integrity Property: – Subject can modify object only if integrity class at least as high as the object. (untrusted subjects reduce integrity class when writing)  * - Property: – Subjects may have write access only if the integrity of objects they are reading is at least as high as the object to be written. (untrusted sources reduce integrity of results)

Integrity Preservation  A high integrity file is one whose contents are created by high-integrity processes. – high-integrity file cannot be contaminated by information from low-integrity processes. – high-integrity process cannot be subverted by low integrity processes or data.  The integrity class label on a file guarantees that the contents came only from sources of at least that degree of integrity.

Picture: Integrity Read above, write below Read below, write above Proprietary Proprietary S S Public Public

Problem: Models are contradictory  Bell-LaPadula Confidentiality – Read down, write up  Biba Integrity – Read up, write down  Want both confidentiality and integrity – Only way to satisfy both models is only allow read and write at same classification In reality: Bell-LaPadula used more than Biba model Example: Common Criteria

Sample Features of a Secure OS  Mandatory access control – MAC not under user control  Object reuse protection – Write over old data when file space is allocated  Complete mediation – Prevent any access that circumvents monitor  Audit support  Intrusion detection – Anomaly detection » Learn normal activity, Report abnormal actions – Attack detection » Recognize patterns associated with known attacks

Basic Design Principles  Least privilege - fewest possible privileges for user  Economy of mechanism - small, simple, straight forward  Open design  Complete mediation - check every access  Permission based - default is denial of access  Separation of privilege - no single super user  Least common mechanism - avoid shared objects  Easy to use

Monitor Model  General idea: – Take user's request – Consult access control information – Allow or disallow request  Advantages – Easy to implement – Easy to understand  Disadvantages – Bottleneck in system – Controls only direct accesses (not inferences)

Security Kernel  Responsible for implementing the security mechanisms of the entire operating system.  Provides the security interfaces among the hardware, the operating system, and the other parts of the computing system.  Implementation of a security kernel: – May degrade system performance (one more layer). – May be large. – No guarantees.  Designing a security kernel is hard – Linux, MacOS, and Windows do not have one – Virtual machine managers act as security kernels