Overview of AGL the FLOSS embedded secured OS based on linux 9th October 2018 José Bollo Security Technical Lead jose.bollo@iot.bzh
IoT.bzh LORIENT October 2015 Stéphane Manuel Fulup Yannick José ● Mostly dedicated to AGL vannes ● https://iot.bzh/en/ ● http://github.com/iotbzh October 2018 9th October 2018 overview of AGL, FLOSS embedded secured OS 2
Overview of AGL system 9th October 2018 overview of AGL, FLOSS embedded secured OS 3
AGL 6.0 Funky Flounder DASHBOARD HOMESCREEN LAUNCHER MEDIAPLAYER HVAC MIXER AGL applications SETTINGS RADIO NAVI PHONE POI ... AGL framework windowmanager persistence mediascanner SystemD weather low-can bluetooth AGL services network nfc homescreen geoclue mediaplayer unicens identity audio-4a ... bluez geoclue gstreamer upstream services (pulseaudio) Network-Manager ... LINUX KERNEL 9th October 2018 overview of AGL, FLOSS embedded secured OS 4
Micro service architecture APPLICATION Applications and services are running isolated one another by Services are their smack security context like applications A SECURITY CONTEXT inter SERVICE APPLICATION connection network dbus, ws, bus1, tls, B C SECURITY SECURITY ... CONTEXT CONTEXT The communication between applications is controlled by policy (framework, fjrewall, SERVICE gateway, OAuth, openid connect) D Access to service features is controlled SECURITY CONTEXT by permission enforcement mechanism (cynara, OAuth) 9th October 2018 overview of AGL, FLOSS embedded secured OS 5
Mechanisms of security ● Mandatory Access Control with SMACK – S imple M andatory A ccess C ontrol K ernel – Strong isolation of kernel objects (files, sockets) ● Network firewall and filtering – Using netherd and netfilter ● Permission database cynara – Filtering permission – User consent mechanism ● User credential management – Oauth and OpenID Connect 9th October 2018 overview of AGL, FLOSS embedded secured OS 6
Global view of security Access Control provides operations to control accesses +has_access() NSBAC PBAC DAC MAC NameSpace Based Permission Based Discretionary Mandatory Access Access Control Access Control Access Control Control (containers) LINUX KERNEL SMACK ACL CYNARA Simple Mandatory Standard Linux Access Control Access Control Kernel 9th October 2018 overview of AGL, FLOSS embedded secured OS 7
Mechanisms of security Legitimate application BlackHat application GRANTED DENIED Smack linux LINUX KERNEL security module helps to protect system resources System resource The permission DENIED GRANTED database Cynara helps to protect services Protected Service 9th October 2018 overview of AGL, FLOSS embedded secured OS 8
Permission checking : CLIENT : SOLUTION : SERVICE CONNECT Subject to permission to connect to the service INVOKE METHOD Subject to permission to invoke the METHOD of the service return from INVOKE Subject to permission SIGNAL EVENT to receive EVENT of the service 9th October 2018 overview of AGL, FLOSS embedded secured OS 9
Permission and composition of services Policy for Y is: requires permission P <<depends>> <<depends>> X : SERVICE Y : SERVICE : SOLUTION : CLIENT About permission P, the policy for X is either: - P is required by transitivity - P is a hidden requirement of X AGL framework takes care of composition of permissions. Under control of strict policy, it allows some services to run with the context of their clients, behaving as their client. 9th October 2018 overview of AGL, FLOSS embedded secured OS 10
Links ● Doc: http://docs.automotivelinux.org/ ● Wiki: https://wiki.automotivelinux.org/ ● More: https://iot.bzh/en/publications 9th October 2018 overview of AGL, FLOSS embedded secured OS 11
Overview of LSM SMACK 9th October 2018 overview of AGL, FLOSS embedded secured OS 12
Short overview ● The author of Smack is mainly Casey Schaufler. ● In Linux since kernel 2 6 25 – 17 April 2008 – as a LSM (Linux Security Module) ● Use extended file attributes to store data related to files (like SELinux). ● Controlled via a filesystem interface: smackfs. ● Controls accesses of processes to files, IPC, sockets and processes (ptrace, signals, ...). ● Controls CIPSO labelled IPV4 packets ● Integrated in systemd 9th October 2018 overview of AGL, FLOSS embedded secured OS 13
The Smack rules ● Smack's rules have 3 items: Simple !!! – the subject's label – the object's label – the access System User rwx This rule tells to allow read , write and execute access to objects labeled User for the processes labeled System . What are labels? What are subjects? What are objects? How to set? 9th October 2018 overview of AGL, FLOSS embedded secured OS 14
The Smack vocabulary ● Labels are just text (of valid ASCII characters) without any special meaning: they are compared to equality (case sensitive: a≠A). ● Subjects are running processes: any running process has a smack label. ● Objects are files , IPC , sockets , processes . ● The label of a running process is called its security context . – Commands id, ps (option -Z or -M), ls (option -Z) are prompting contexts processes and files. ● The grantables access modes are: read (r), write (w), execute (x), append (a), lock (l), transmute (t), bringup (b). 9th October 2018 overview of AGL, FLOSS embedded secured OS 15
Setting Smack How to set context? You can't! Except if you have the capability CAP_MAC_ADMIN. # chsmack --access label fjle # echo -n label > /proc/$$/attr/current How to set rules? You can only reduce accesses for the current thread (inherited by cloning). But if you have the capability CAP_MAC_ADMIN, you can change all rules. # echo “subject object rwt” > /sys/fs/smackfs/load-self2 # echo “subject object rwt” > /sys/fs/smackfs/load2 # echo “subject object rwt” | smackload 9th October 2018 overview of AGL, FLOSS embedded secured OS 16
Evolutions of Smack ● The author of Smack is mainly Casey Schaufler. ● In Linux since kernel 2 6 25 – 17 April 2008 – as a LSM (Linux Security Module) ● Evoluting since this first days. – Lock access mode (kernel 3.13) – Support for multi-rule write to load2 and change-rule (kernel 3.12) – Maximum value for CIPSO category change from 63 to 184 (kernel 3.12) – Longer Smack labels (24->255) and recursive transmute (kernel 3,5) – Transmute access mode (kernel 2.6.38) – Bringup mode – Netlabel filtering 9th October 2018 overview of AGL, FLOSS embedded secured OS 17
Smack links ● Kernel doc: https://www.kernel.org/doc/html/latest/admin-g uide/LSM/Smack.html ● User space tools: https://github.com/smack-team/smack ● 9th October 2018 overview of AGL, FLOSS embedded secured OS 18
Overview of CYNARA permission database 9th October 2018 overview of AGL, FLOSS embedded secured OS 19
cynara ● Cynara is a permission database ● Cynara was introduced in 2014 by Samsung for Tizen’s management of permissions – It was a response to the insane growth of smack rules ● Was introduced as an alternative to Polkit that was to slow ● This defines Tizen 3 versus previous Tizens ● The main promoter and contributor is Samsung Poland 9th October 2018 overview of AGL, FLOSS embedded secured OS 20
The cynara rules The 4-uple of values is checked DENIED client session user permission OTHER (ASK, ...) GRANTED ● The client is the requesting process identifjed by its Smack label ● The session is supposed to identify the one session of the client ● The user is the requesting user as identifjed by DAC ● The permission is the permission that is tested client, session, user and permission are text strings 9th October 2018 overview of AGL, FLOSS embedded secured OS 21
cynara HVAC The application HVAC runs with security label User::App::HVAC Request issued over UNIX Domain Socket The low-can service get the credentials of its client using low-can getsockopt ( SO_PEERCRED & SO_PEERSEC ) (getsockopt is a C function) cache Request cynara authorisation for User::App::HVAC PID UID PERM or if known User::App::HVAC SESSION-ID USER-ID PERM Caching is possible to avoid request The server cynara checks whether a rule allows the request cynara Issue with NAND memory (limited write cycle) => specifjc optimizations 9th October 2018 overview of AGL, FLOSS embedded secured OS 22
cynara For some queries, the A t t e n t i o n A t t e n t i o n server cynara may ask an “agent” to give or not The application HVAC HVAC requires permission to change requires permission to change The application the authorization temperature. temperature. Do you accept? Do you accept? Yes forever Yes now Not now Never Yes forever Yes now Not now Never ... Example 1 An agent can ask the user cynara Session manager Example 2 An agent can ask the session manager agent agent agent agent 9th October 2018 overview of AGL, FLOSS embedded secured OS 23
Cynara, comparison 9th October 2018 overview of AGL, FLOSS embedded secured OS 24
Cynara, comparison HVAC low-can cache cynara agent 9th October 2018 overview of AGL, FLOSS embedded secured OS 25
Recommend
More recommend
