Modern Security Model for Linux Operating Systems Aleksander Zdyb S - PowerPoint PPT Presentation

Aleksander Zdyb Modern Security Model for Linux Operating Systems

Aleksander Zdyb S OFTWARE E NGINEER T IZEN P LATFORM S ECURITY a.zdyb@samsung.com https://github.com/azdyb

• Briefly about security requirements • About Tizen operating system • Dedicated security model • Application lifecycle • Summary A.Z DYB | „ M ODERN S ECURITY M ODEL FOR L INUX O PERATING S YSTEMS ” | B RUSSELS 2016-01-30 | 3/46

A BOUT SECURITY REQUIREMENTS

(CC ) Stiftelsen Elektronikkbransjen (CC ) Sascha Müsse (CC ) Intel Free Press A.Z DYB | „ M ODERN S ECURITY M ODEL FOR L INUX O PERATING S YSTEMS ” | B RUSSELS 2016-01-30 | 5/46

A.Z DYB | „ M ODERN S ECURITY M ODEL FOR L INUX O PERATING S YSTEMS ” | B RUSSELS 2016-01-30 | 6/46

A.Z DYB | „ M ODERN S ECURITY M ODEL FOR L INUX O PERATING S YSTEMS ” | B RUSSELS 2016-01-30 | 7/46

• Classic approach: software acts on behalf of user to full extent • Usage of many kinds of privileges is more and more common • There is a conflict between privileges granularity and comfort of usage and administration A.Z DYB | „ M ODERN S ECURITY M ODEL FOR L INUX O PERATING S YSTEMS ” | B RUSSELS 2016-01-30 | 8/34

A BOUT T IZEN

• Modern operating system for embedded devices • A Linux distribution • Developed by Open Source community • Main contribution from Samsung at the moment A.Z DYB | „ M ODERN S ECURITY M ODEL FOR L INUX O PERATING S YSTEMS ” | B RUSSELS 2016-01-30 | 10/46

• Smartphones, smartwatches, smart TVs • IVI systems (In-Vehicle Infotainment) • And more wiki.tizen.org A.Z DYB | „ M ODERN S ECURITY M ODEL FOR L INUX O PERATING S YSTEMS ” | B RUSSELS 2016-01-30 | 11/46

TIZEN 2.x TIZEN 3.0 • Commercially released in many • Still in developent Samsung's devices (smartwatches, • Works on ODROID XU3 (arm), smart TVs, smartphones) MinnowBoard MAX (x86_64) • Security ensured with classic and other architectures mechanisms of Linux • Modern, dedicated security model A.Z DYB | „ M ODERN S ECURITY M ODEL FOR L INUX O PERATING S YSTEMS ” | B RUSSELS 2016-01-30 | 12/46

S ERVICES , RESOURCES AND PRIVILEGES

Example services and resources • E-mail • Camera • Networking A.Z DYB | „ M ODERN S ECURITY M ODEL FOR L INUX O PERATING S YSTEMS ” | B RUSSELS 2016-01-30 | 14/46

Example services and resources Related privileges • E-mail • Reading, sending messages • Contacts preview • Camera • Taking photos • Browsing pictures • Networking • Accessing remote hosts • Usage of different protocols A.Z DYB | „ M ODERN S ECURITY M ODEL FOR L INUX O PERATING S YSTEMS ” | B RUSSELS 2016-01-30 | 15/46

Applications Services and resources Camera Internet Mapy Kalkulator Przeglądarka Location Contacts Gra A.Z DYB | „ M ODERN S ECURITY M ODEL FOR L INUX O PERATING S YSTEMS ” | B RUSSELS 2016-01-30 | 16/46

Applications Services and resources Camera Internet Mapa Kalkulator Access control Przeglądarka Location Contacts Gra A.Z DYB | „ M ODERN S ECURITY M ODEL FOR L INUX O PERATING S YSTEMS ” | B RUSSELS 2016-01-30 | 17/46

D EDICATED S ECURITY M ODEL

• DAC – Discretionary Access Control (classic access control system) Cynara • Smack – Simplified Mandatory Access Control Kernel (one of LSMs) Smack DAC • Cynara – dedicated privilege checker (userspace) A.Z DYB | „ M ODERN S ECURITY M ODEL FOR L INUX O PERATING S YSTEMS ” | B RUSSELS 2016-01-30 | 19/46

• Protects resources on filesystem • Access control set by owner of the resource • Access types: r w x • Subject is identified by its id and groups it belongs to Larry Ewing and The GIMP A.Z DYB | „ M ODERN S ECURITY M ODEL FOR L INUX O PERATING S YSTEMS ” | B RUSSELS 2016-01-30 | 20/46

• Protects resources on filesystem • Access control set by owner of the resource • Access types: r w x • Subject is identified by its id and groups it belongs to A.Z DYB | „ M ODERN S ECURITY M ODEL FOR L INUX O PERATING S YSTEMS ” | B RUSSELS 2016-01-30 | 21/46

• Both object and subject are identified by their labels • Access control is set by administrator • Access types: a r w x t l (GFDL) Casey Schaufler A.Z DYB | „ M ODERN S ECURITY M ODEL FOR L INUX O PERATING S YSTEMS ” | B RUSSELS 2016-01-30 | 22/46

subject action object (label 1) (a r w x l) (label 2) A.Z DYB | „ M ODERN S ECURITY M ODEL FOR L INUX O PERATING S YSTEMS ” | B RUSSELS 2016-01-30 | 23/46

Floor (_) System User • Read-only system • /run, /dev, /var/log • Home directories directories • System services • Launcher • Kernel’s helper and users’ services processes Domains are sets of labels with common prefix. There are other labels, like System::Shared, User::Home and more. A.Z DYB | „ M ODERN S ECURITY M ODEL FOR L INUX O PERATING S YSTEMS ” | B RUSSELS 2016-01-30 | 24/46

• System service keeping and managing security policies • Dedicated solution for Tizen 3.0 • Generic – can be easily deployed in other Linux distributions A.Z DYB | „ M ODERN S ECURITY M ODEL FOR L INUX O PERATING S YSTEMS ” | B RUSSELS 2016-01-30 | 25/46

Application Service Extension Cynara A.Z DYB | „ M ODERN S ECURITY M ODEL FOR L INUX O PERATING S YSTEMS ” | B RUSSELS 2016-01-30 | 26/46

Privacy Manifests Manager Built-in Administrator Cynara A.Z DYB | „ M ODERN S ECURITY M ODEL FOR L INUX O PERATING S YSTEMS ” | B RUSSELS 2016-01-30 | 27/46

L IFECYCLE OF A PPLICATION

• Security Manager – service managing and configuring all of security modules in operating systems • Made for Tizen 3.0 • Can be deployed in other Linux distributions A.Z DYB | „ M ODERN S ECURITY M ODEL FOR L INUX O PERATING S YSTEMS ” | B RUSSELS 2016-01-30 | 29/46

Security Manager is involved in: • installing applications – populates Cynara's database, creates Smack labels for apps • launching applications – applies security context (labels, groups) on behalf of launcher • managing security policies – supports edition of policies by administrator and users (Privacy Manager) (CC) Patrick Breen • managing users A.Z DYB | „ M ODERN S ECURITY M ODEL FOR L INUX O PERATING S YSTEMS ” | B RUSSELS 2016-01-30 | 30/46

Depends on configuration Globally and privileges Unpacking files For user Installator Populating Cynara’s db Creating labels Installator configures manifest for apps application with help Security Manager from Security Manager Labelling files A.Z DYB | „ M ODERN S ECURITY M ODEL FOR L INUX O PERATING S YSTEMS ” | B RUSSELS 2016-01-30 | 31/46

• Spawns a process Launcher • SM checks in Cynara what groups to apply for process Cynara • SM sets effective groups to allow access to some special files (e.g. devices) DAC • SM sets a proper Smack label for process Smack A.Z DYB | „ M ODERN S ECURITY M ODEL FOR L INUX O PERATING S YSTEMS ” | B RUSSELS 2016-01-30 | 32/46

Hi Cynara! Can Maps haz perms to read location? GPS Yep, them can haz dat! A.Z DYB | „ M ODERN S ECURITY M ODEL FOR L INUX O PERATING S YSTEMS ” | B RUSSELS 2016-01-30 | 33/46

Client is a Smack label Client identifying the application GPS MAPS User Application (e.g. maps) run with a Cynara Service managing protected proper label and by a given user (e.g. resource (e.g. GPS location) Suzan, uid=1001) requests access checks in Cynara , if the User is an uid GPS location (bound to privilege access should be granted of user running http://tizen.org/privilege/location ) the application Privilege One of privileges in Tizen 3.0, e.g. http://tizen.org/privilege/location A.Z DYB | „ M ODERN S ECURITY M ODEL FOR L INUX O PERATING S YSTEMS ” | B RUSSELS 2016-01-30 | 34/46

Hi Cynara! Can Calculator haz Camera, if them want? No, man! Launcher No way we gib them dat! A.Z DYB | „ M ODERN S ECURITY M ODEL FOR L INUX O PERATING S YSTEMS ” | B RUSSELS 2016-01-30 | 36/46

Linux checks (DAC) if process belongs to a proper group (e.g. camera_users ) Groups are assigned by Security Manager on every launch Application (e.g. Camera) run with a proper label and / dev/camera by a given user (e.g. Susan, uid=1001) requests access to device /dev/camera A.Z DYB | „ M ODERN S ECURITY M ODEL FOR L INUX O PERATING S YSTEMS ” | B RUSSELS 2016-01-30 | 37/46

B ONUSES

• Serving on D- Bus? We’ve got your back • Nether – networking access control • nice-lad – auditing • Vasum – containers A.Z DYB | „ M ODERN S ECURITY M ODEL FOR L INUX O PERATING S YSTEMS ” | B RUSSELS 2016-01-30 | 39/46

S UMMARY

• Security of embedded systems and privacy of stored data are very important • Classic security mechanisms are not enough • Security must be taken into account from the very beginning • Security doesn't have to be burdensome for developers A.Z DYB | „ M ODERN S ECURITY M ODEL FOR L INUX O PERATING S YSTEMS ” | B RUSSELS 2016-01-30 | 41/46

Q UESTIONS ?

• https://wiki.tizen.org/wiki/Main_Page • https://wiki.tizen.org/wiki/Security/Overview • https://wiki.tizen.org/wiki/Security:Cynara • https://wiki.tizen.org/wiki/Security:nice-lad A.Z DYB | „ M ODERN S ECURITY M ODEL FOR L INUX O PERATING S YSTEMS ” | B RUSSELS 2016-01-30 | 43/46