Automatic Placement of Authorization Hooks in the Linux Security - - PowerPoint PPT Presentation

▶
automatic placement of authorization hooks in the linux
SMART_READER_LITE
LIVE PREVIEW

Automatic Placement of Authorization Hooks in the Linux Security - - PowerPoint PPT Presentation

Feb 11, 2023 190 likes •607 views

Automatic Placement of Authorization Hooks in the Linux Security Modules Framework Vinod Ganapathy vg@cs.wisc.edu University of Wisconsin, Madison Joint work with Trent Jaeger Somesh Jha tjaeger@cse.psu.edu jha@cs.wisc.edu Pennsylvania

slide-1
SLIDE 1

Automatic Placement of Authorization Hooks in the Linux Security Modules Framework

University of Wisconsin, Madison Pennsylvania State University

Somesh Jha

jha@cs.wisc.edu

Trent Jaeger

tjaeger@cse.psu.edu

Joint work with Vinod Ganapathy

vg@cs.wisc.edu

University of Wisconsin, Madison

slide-2
SLIDE 2

CCS 2005 Automatic Placement of Authorization Hooks in the Linux Security Modules Framework

2

Context of this talk

Authorization policies and their enforcement Three concepts:

Subjects (e.g., users, processes) Objects (e.g., system resources) Security-sensitive operations on objects.

Authorization policy:

A set of triples: (Subject, Object, Operation)

Key question: How to ensure that the

authorization policy is enforced?

slide-3
SLIDE 3

CCS 2005 Automatic Placement of Authorization Hooks in the Linux Security Modules Framework

3

Enforcing authorization policies

Reference monitor consults the policy. Application queries monitor at appropriate locations.

Application to be secured Reference Monitor

(subj.,obj.,oper.) (subj.,obj.,oper.) (subj.,obj.,oper.) (subj.,obj.,oper.) (subj.,obj.,oper.)

Policy Can I perform operation OP? Yes/No

slide-4
SLIDE 4

CCS 2005 Automatic Placement of Authorization Hooks in the Linux Security Modules Framework

4

Linux security modules framework

Framework for authorization policy enforcement. Uses a reference monitor-based architecture. Integrated into Linux-2.6

Linux Kernel Reference Monitor

(subj.,obj.,oper.) (subj.,obj.,oper.) (subj.,obj.,oper.) (subj.,obj.,oper.) (subj.,obj.,oper.)

Policy

slide-5
SLIDE 5

CCS 2005 Automatic Placement of Authorization Hooks in the Linux Security Modules Framework

5

Linux security modules framework

Reference monitor calls (hooks) placed appropriately

in the Linux kernel.

Each hook is an authorization query.

Linux Kernel Reference Monitor

(subj.,obj.,oper.) (subj.,obj.,oper.) (subj.,obj.,oper.) (subj.,obj.,oper.) (subj.,obj.,oper.)

Policy Hooks

slide-6
SLIDE 6

CCS 2005 Automatic Placement of Authorization Hooks in the Linux Security Modules Framework

6

Linux security modules framework

Authorization query of the form: (subj., obj., oper.)? Kernel performs operation only if query succeeds.

Linux Kernel Reference Monitor

(subj.,obj.,oper.) (subj.,obj.,oper.) (subj.,obj.,oper.) (subj.,obj.,oper.) (subj.,obj.,oper.)

Policy (subj., obj., oper.)? Yes/No

slide-7
SLIDE 7

CCS 2005 Automatic Placement of Authorization Hooks in the Linux Security Modules Framework

7

Linux Kernel Reference Monitor

(subj.,obj.,oper.) (subj.,obj.,oper.) (subj.,obj.,oper.) (subj.,obj.,oper.) (subj.,obj.,oper.)

Policy (subj., obj., oper.)? Yes/No

Example

Virtual File System Code for Directory Removal int vfs_rmdir(inode *dir, dentry *dentry) { … err = security_inode_rmdir(dir,dentry); if (!err) { dir->i_op->rmdir(dir,dentry); } }

slide-8
SLIDE 8

CCS 2005 Automatic Placement of Authorization Hooks in the Linux Security Modules Framework

8

Linux Kernel Reference Monitor

(subj.,obj.,oper.) (subj.,obj.,oper.) (subj.,obj.,oper.) (subj.,obj.,oper.) (subj.,obj.,oper.)

Policy (subj., obj., oper.)? Yes/No

Example

Virtual File System Code for Directory Removal int vfs_rmdir(inode *dir, dentry *dentry) { … err = security_inode_rmdir(dir,dentry); if (!err) { dir->i_op->rmdir(dir,dentry); } }

slide-9
SLIDE 9

CCS 2005 Automatic Placement of Authorization Hooks in the Linux Security Modules Framework

9

Linux Kernel Reference Monitor

(subj.,obj.,oper.) (subj.,obj.,oper.) (subj.,obj.,oper.) (subj.,obj.,oper.) (subj.,obj.,oper.)

Policy (subj., obj., oper.)? Yes/No

Example

Virtual File System Code for Directory Removal int vfs_rmdir(inode *dir, dentry *dentry) { … err = security_inode_rmdir(dir,dentry); if (!err) { dir->i_op->rmdir(dir,dentry); } }

slide-10
SLIDE 10

CCS 2005 Automatic Placement of Authorization Hooks in the Linux Security Modules Framework

10

Linux Kernel Reference Monitor

(subj.,obj.,oper.) (subj.,obj.,oper.) (subj.,obj.,oper.) (subj.,obj.,oper.) (subj.,obj.,oper.)

Policy (subj., obj., oper.)? Yes/No

Example

Virtual File System Code for Directory Removal int vfs_rmdir(inode *dir, dentry *dentry) { … err = security_inode_rmdir(dir,dentry); if (!err) { dir->i_op->rmdir(dir,dentry); } }

slide-11
SLIDE 11

CCS 2005 Automatic Placement of Authorization Hooks in the Linux Security Modules Framework

11

Linux Kernel Reference Monitor

(subj.,obj.,oper.) (subj.,obj.,oper.) (subj.,obj.,oper.) (subj.,obj.,oper.) (subj.,obj.,oper.)

Policy (subj., obj., oper.)? Yes/No

Example

Virtual File System Code for Directory Removal int vfs_rmdir(inode *dir, dentry *dentry) { … err = security_inode_rmdir(dir,dentry); if (!err) { dir->i_op->rmdir(dir,dentry); } }

Key: Hooks must achieve complete mediation.

slide-12
SLIDE 12

CCS 2005 Automatic Placement of Authorization Hooks in the Linux Security Modules Framework

12

Hook placement is crucial

Must achieve complete mediation.

Security-sensitive operations must be mediated

by a hook that authorizes the operation.

Current practice:

Hooks placed manually in the kernel. Takes a long time: approx. 2 years for Linux

security modules framework.

Can this achieve complete mediation?

Prior work has found bugs in hook placement.

[Zhang et al., USENIX Security 2002, Jaeger et al., ACM CCS 2002]

slide-13
SLIDE 13

CCS 2005 Automatic Placement of Authorization Hooks in the Linux Security Modules Framework

13

Main message of this talk

Static analysis can largely autom ate authorization hook placem ent and achieve com plete m ediation

slide-14
SLIDE 14

CCS 2005 Automatic Placement of Authorization Hooks in the Linux Security Modules Framework

14

Main message of this talk

Static analysis can largely autom ate authorization hook placem ent and achieve com plete m ediation

Reduces turnaround tim e of Linux Security Modules-like projects

slide-15
SLIDE 15

CCS 2005 Automatic Placement of Authorization Hooks in the Linux Security Modules Framework

15

Main message of this talk

Static analysis can largely autom ate authorization hook placem ent and achieve com plete m ediation

Towards correctness by construction

slide-16
SLIDE 16

CCS 2005 Automatic Placement of Authorization Hooks in the Linux Security Modules Framework

16

Key intuition: Matchmaking

Each kernel function performs an operation. Each hook authorizes an operation. Match kernel functions with appropriate hooks.

Linux Kernel Reference Monitor

(subj.,obj.,oper.) (subj.,obj.,oper.) (subj.,obj.,oper.) (subj.,obj.,oper.) (subj.,obj.,oper.)

Policy

  • p1,op2,op3
  • p3
  • p1,op2
  • p1,op2
  • p3
slide-17
SLIDE 17

CCS 2005 Automatic Placement of Authorization Hooks in the Linux Security Modules Framework

17

Input:

A set of security-sensitive operations. Source code of reference monitor hooks. Source code of the Linux kernel, without hooks

placed.

Output:

Linux kernel with hooks placed.

Tool for Authorization Hook Placement

slide-18
SLIDE 18

CCS 2005 Automatic Placement of Authorization Hooks in the Linux Security Modules Framework

18

Tool for Authorization Hook Placement

Hook code Linux kernel, no hooks. Linux kernel + hooks.

TAHOE

slide-19
SLIDE 19

CCS 2005 Automatic Placement of Authorization Hooks in the Linux Security Modules Framework

19

Tool for Authorization Hook Placement

Hook code Linux kernel, no hooks. Linux kernel + hooks.

TAHOE

Hook analysis Kernel analysis Join Hook Placer

Operations authorized Operations perform ed

slide-20
SLIDE 20

CCS 2005 Automatic Placement of Authorization Hooks in the Linux Security Modules Framework

20

Security-sensitive operations

We use the set of operations from the LSM

implementation of SELinux.

Comprehensive set of operations on resources:

FILE_READ DIR_READ FILE_WRITE DIR_WRITE SOCKET_RECV_MESG SOCKET_LISTEN … (504 such operations)

slide-21
SLIDE 21

CCS 2005 Automatic Placement of Authorization Hooks in the Linux Security Modules Framework

21

Authorization hook analysis

Analyze source code of hooks and:

Recover the operations authorized. Conditions under which they are authorized.

Example:

int selinux_inode_permission(struct *inode, int mask) {

  • p = 0;

// s = info about process requesting operation if (mask & MAY_EXEC) op |= DIR_SEARCH; if (mask & MAY_WRITE) op |= DIR_WRITE; if (mask & MAY_READ) op |= DIR_READ; Query_Policy(s, inode, op); }

TAHOE

slide-22
SLIDE 22

CCS 2005 Automatic Placement of Authorization Hooks in the Linux Security Modules Framework

22

Authorization hook analysis

Flow-and-context-sensitive static analysis:

DIR_READ authorized if `mask & MAY_READ’ DIR_WRITE authorized if `mask & MAY_WRITE’ DIR_SEARCH authorized if `mask & MAY_EXEC’

int selinux_inode_permission(struct *inode, int mask) {

  • p = 0;

// s = info about process requesting operation if (mask & MAY_EXEC) op |= DIR_SEARCH; if (mask & MAY_WRITE) op |= DIR_WRITE; if (mask & MAY_READ) op |= DIR_READ; Query_Policy(s, inode, op); }

TAHOE

slide-23
SLIDE 23

CCS 2005 Automatic Placement of Authorization Hooks in the Linux Security Modules Framework

23

Linux kernel analysis

Analyze Linux kernel to determine the

security-sensitive operations performed by each function.

More challenging than hook analysis. Example:

Virtual File System Code for Directory Removal

int vfs_rmdir (struct inode *dir, struct dentry *dentry) { ... dir->i_op->rmdir(dir, dentry); ... } Points to physical file system code

TAHOE

slide-24
SLIDE 24

CCS 2005 Automatic Placement of Authorization Hooks in the Linux Security Modules Framework

24

Example

How to infer the security-sensitive operations

performed by dir->i_op->rmdir(dir,dentry)?

TAHOE

int vfs_rmdir (struct inode *dir, struct dentry *dentry) { ... dir->i_op->rmdir(dir, dentry); ... } $ ls foo/ bar/

slide-25
SLIDE 25

CCS 2005 Automatic Placement of Authorization Hooks in the Linux Security Modules Framework

25

Example

How to infer the security-sensitive operations

performed by dir->i_op->rmdir(dir,dentry)?

TAHOE

int vfs_rmdir (struct inode *dir, struct dentry *dentry) { ... dir->i_op->rmdir(dir, dentry); ... } $ cd foo/ $ rmdir bar/

slide-26
SLIDE 26

CCS 2005 Automatic Placement of Authorization Hooks in the Linux Security Modules Framework

26

Example

How to infer the security-sensitive operations

performed by dir->i_op->rmdir(dir,dentry)?

Removing bar from foo involves:

Lookup of entry for bar in foo. Removing (and hence writing to) foo’s data

structures.

rmdir involves DIR_SEARCH, DIR_RMDIR and

DIR_WRITE.

TAHOE

int vfs_rmdir (struct inode *dir, struct dentry *dentry) { ... dir->i_op->rmdir(dir, dentry); ... }

How to extract this information?

slide-27
SLIDE 27

CCS 2005 Automatic Placement of Authorization Hooks in the Linux Security Modules Framework

27

Key observation

Each security sensitive operation typically

involves certain idiomatic events.

Examples:

DIR_WRITE :- Set inode->i_ctime & Call

address_space_ops->prepare_write()

DIR_SEARCH :- Read inode->i_mapping DIR_RMDIR :- Set inode->i_size TO 0 &

Decrement inode->i_nlink

These rules are called Idioms:

Boolean combination of code-patterns. Idiom language resembles Datalog.

TAHOE

slide-28
SLIDE 28

CCS 2005 Automatic Placement of Authorization Hooks in the Linux Security Modules Framework

28

Linux kernel analysis

Flow-insensitive, inter-procedural search for

code patterns.

Example: Call-graph of ext2 file system

TAHOE

ext2_rmdir ext2_unlink ext2_dec_count

ext2_rmdir (struct inode *dir, struct dentry *dentry) { ext2_unlink(…); … ext2_dec_count(…); }

slide-29
SLIDE 29

CCS 2005 Automatic Placement of Authorization Hooks in the Linux Security Modules Framework

29

Linux kernel analysis

Flow-insensitive, inter-procedural search for

code patterns.

Example: Call-graph of ext2 file system

TAHOE

ext2_rmdir ext2_unlink ext2_dec_count

ext2_rmdir (struct inode *dir, struct dentry *dentry) { ext2_unlink(…); … ext2_dec_count(…); }

slide-30
SLIDE 30

CCS 2005 Automatic Placement of Authorization Hooks in the Linux Security Modules Framework

30

Linux kernel analysis

Flow-insensitive, inter-procedural search for

code patterns.

Example: Call-graph of ext2 file system

TAHOE

ext2_rmdir ext2_get_page ext2_delete_entry ext2_unlink ext2_dec_count ext2_find_entry

slide-31
SLIDE 31

CCS 2005 Automatic Placement of Authorization Hooks in the Linux Security Modules Framework

31

Linux kernel analysis

Flow-insensitive, inter-procedural search for

code patterns.

Example: Call-graph of ext2 file system

TAHOE

ext2_rmdir ext2_get_page ext2_delete_entry ext2_unlink ext2_dec_count ext2_find_entry

page->mapping->a_ops->prepare_write() mapping = inode->i_mapping inode->i_nlink-- inode->i_size = 0

slide-32
SLIDE 32

CCS 2005 Automatic Placement of Authorization Hooks in the Linux Security Modules Framework

32

Linux kernel analysis

Flow-insensitive, inter-procedural search for

code patterns.

Example: Call-graph of ext2 file system

TAHOE

ext2_rmdir ext2_get_page ext2_delete_entry ext2_unlink ext2_dec_count ext2_find_entry

page->mapping->a_ops->prepare_write() mapping = inode->i_mapping inode->i_nlink-- inode->i_size = 0

DIR_RMDIR :- Set inode->i_size to 0 & Decrement inode->i_nlink

slide-33
SLIDE 33

CCS 2005 Automatic Placement of Authorization Hooks in the Linux Security Modules Framework

33

Result with ext2_rmdir

Flow-insensitive, inter-procedural search for

code patterns.

Results:

TAHOE

ext2_rmdir ext2_get_page ext2_delete_entry ext2_unlink ext2_dec_count ext2_find_entry

DIR_WRITE DIR_WRITE DIR_SEARCH DIR_WRITE, DIR_SEARCH DIR_RMDIR, DIR_WRITE, DIR_SEARCH Pointed to by dir->i_op->rmdir

slide-34
SLIDE 34

CCS 2005 Automatic Placement of Authorization Hooks in the Linux Security Modules Framework

34

Idioms

Currently specified manually by us:

We wrote 150 idioms in a week. We expect that a kernel developer can write

these faster and more precisely.

Difference from manual hook placement:

Only knowledge of kernel required. One-time activity for the kernel: can reuse results

for different reference monitors.

Current work: Automating idiom writing.

TAHOE

slide-35
SLIDE 35

CCS 2005 Automatic Placement of Authorization Hooks in the Linux Security Modules Framework

35

Combining results

From authorization hook analysis

TAHOE

selinux_inode_permission selinux_inode_rmdir

DIR_WRITE DIR_SEARCH DIR_READ DIR_RMDIR

Also know conditions on the formal parameters!

slide-36
SLIDE 36

CCS 2005 Automatic Placement of Authorization Hooks in the Linux Security Modules Framework

36

Combining results

From kernel analysis

TAHOE

selinux_inode_permission selinux_inode_rmdir

DIR_WRITE DIR_SEARCH DIR_READ DIR_RMDIR

Also know conditions on the formal parameters!

ext2_rmdir

Protect ext2_rmdir with

  • selinux_inode_rmdir
  • selinux_inode_permission(MAY_WRITE)
slide-37
SLIDE 37

CCS 2005 Automatic Placement of Authorization Hooks in the Linux Security Modules Framework

37

Placing hooks

Naïve (but correct) approach:

Place hooks at each function call in the kernel

using join analysis results.

May lead to redundant checks.

TAHOE works differently:

Identifies a small set of controlled functions. Suffices to place hooks to protect these.

See paper for details.

TAHOE

slide-38
SLIDE 38

CCS 2005 Automatic Placement of Authorization Hooks in the Linux Security Modules Framework

38

Results

Wrote idioms for inode and socket operations Tested with SELinux reference monitor and Linux

kernel version 2.4.21

False positives and negatives mainly because of

imprecision in idioms.

4 12 12 socket 4 13 40 26 inode False neg. False pos. Num. Locs Num. Hook type

slide-39
SLIDE 39

CCS 2005 Automatic Placement of Authorization Hooks in the Linux Security Modules Framework

39

Future work

Hook placement for general-purpose servers

Example: X server. Must enforce authorization policies on X clients. Example: Prevent a “cut-and-paste” from a high-

security xterm to a low-security xterm.

Hundreds of such servers: database servers,

web servers,…

Manual hook placement?

Simply infeasible!

slide-40
SLIDE 40

CCS 2005 Automatic Placement of Authorization Hooks in the Linux Security Modules Framework

40

Summary of important ideas

Can largely automate authorization hook

placement using static analysis.

Key idea: Matchmaking based on security-

sensitive operations.

TAHOE: A tool for LSM-hook placement.

slide-41
SLIDE 41

Thank You

Web-site http://www.cs.wisc.edu/~vg/papers/ccs2005a/ jha@cs.wisc.edu

Somesh Jha

tjaeger@cse.psu.edu

Trent Jaeger

vg@cs.wisc.edu

Vinod Ganapathy

Contact Information