Download Downloading - All IT eBooks

Chapter2.MandatoryAccessControls
andSELinux
InChapter1,LinuxAccessControls,weintroducedsomeoftheshortcomingsofa
discretionaryaccesscontrolsystem.Inthesesystems,theownerofanobjecthasfull
controloveritspermissionsflagsandcandemonstrategreatercapabilities(forexample,
theabilitytochown)whenexecutingasrootorwithcertaincapabilities.Inthischapter,
wewill:
ExaminethefundamentalsofMAC
IntroducesomeindustrydriversforSELinux
Discusslabels,users,roles,andtypes
Exploretheimplementationoftangiblepolicytoallowandconstrainobject
interaction
IdealMACsystemsmaintainthepropertyofprovidingdefinitiveaccesscontrolson
kernelresources,suchasfiles,irrespectiveofanobject’sowner.Forinstance,withaMAC
system,theownerofanobjectmightnothavefullcontrolofitspermissions.InLinux,the
MACframeworkworksorthogonallytothecurrentDACcontrols.Thismeansthatthe
MACcontrolsdonotinterferewiththeDACcontrols.Inotherwords,toavoidpotential
conflictsbetweentheMACandDACsystems,thekernelvalidatesaccessusingtheDAC
permissionsbeforecheckingtheMACpermissions.IftheDACpermissionsresultina
permissionsviolation,thentheMACpermissionsareneverchecked.Thekernelwill
validateaccessagainsttheMACpermissionsprovideronlywhentheDACpermissions
pass.FailureateitherlevelwillresultinareturnofEACCESS.IftheDACandtheMAC
permissionspass,thenthekernelresource(forexample,afiledescriptor)issentbackto
userspace.
InLinux,aframeworkcalledtheLinuxSecurityModule(LSM)frameworkwasmerged
duringtheLinux2.6.xseriesofkernels.Thisframeworkallowsyoutoenablethe
mandatoryaccesscontrolsystemsinabuildtimeselectionbytetheringtheLSMhooksto
thesecurityprovider.SecurityEnhancedLinux(SELinux)isthefirstconsumerofthis
MACsecurityframeworkwithinthekernelandisanimplementationofamandatory
accesscontrolsystem.SELinuxshipsinawidevarietyofLinuxsystems,suchasRedHat
EnterpriseLinux(RHEL)andconsequentlyFedora.Recently,ithasbegunshipping
withAndroid.ThesourcecodeforSELinuxcanbefoundintheLinuxsourcecodetree
underkernel/security/selinuxforthosewishingtoreviewit.