Proactive Security in Linux Lukas Vrabec About me Lukas Vrabec - - PowerPoint PPT Presentation

▶
proactive security in linux
SMART_READER_LITE
LIVE PREVIEW

Proactive Security in Linux Lukas Vrabec About me Lukas Vrabec - - PowerPoint PPT Presentation

Aug 18, 2022 323 likes •1.55k views

Proactive Security in Linux Lukas Vrabec About me Lukas Vrabec Software Engineer Member of Security Technologies team at Red Hat Fedora Contributor (selinux-policy, xguest, udica, netlabel_tools) lvrabec@redhat.com

slide-1
SLIDE 1

Proactive Security in Linux

Lukas Vrabec

slide-2
SLIDE 2

About me

  • Lukas Vrabec
  • Software Engineer
  • Member of Security Technologies team at Red Hat
  • Fedora Contributor (selinux-policy, xguest, udica, netlabel_tools)
  • lvrabec@redhat.com
  • https://lukas-vrabec.com
  • https://github.com/wrabcak
  • https://twitter.com/mynamewrabcak
slide-3
SLIDE 3

Agenda

  • Proactive Security
  • Traditional Linux Security
  • SELinux Security Policy
  • Updated Userspace with Easier Policy Customization
  • SELinux and Containers
  • AVC Messages
slide-4
SLIDE 4

Proactive Security

slide-5
SLIDE 5

WHEN DO PEOPLE CARE ABOUT SECURITY?

slide-6
SLIDE 6
slide-7
SLIDE 7

WHERE DO SECURITY ISSUES COME FROM?

slide-8
SLIDE 8
slide-9
SLIDE 9

HOW ARE THEY FIXED?

slide-10
SLIDE 10

REACTIVE SECURITY

slide-11
SLIDE 11
slide-12
SLIDE 12

YOUR SYSTEM IS NOT PROTECTED DURING THE WINDOW OF VULNERABILITY!

slide-13
SLIDE 13

PROACTIVE SECURITY

slide-14
SLIDE 14
slide-15
SLIDE 15

PROACTIVE SECURITY HELPS TO PROTECT YOUR SYSTEM DURING THE WINDOW OF VULNERABILITY!

slide-16
SLIDE 16

SECURITY ENHANCED LINUX IS A SECURITY MECHANISM BRINGING PROACTIVE SECURITY FOR YOUR SYSTEM.

slide-17
SLIDE 17

TECHNOLOGY FOR PROCESS ISOLATION TO MITIGATE ATTACKS VIA PRIVILEGE ESCALATION

slide-18
SLIDE 18

EXPLOIT EXAMPLES WHERE SELINUX HELPED TO PROTECT YOUR SYSTEM

slide-19
SLIDE 19

VENOM

slide-20
SLIDE 20

VENOM DOCKER CVE-2016-9962

slide-21
SLIDE 21

VENOM DOCKER CVE-2016-9962 SHELLSHOCK

slide-22
SLIDE 22

HACKING TIME!

slide-23
SLIDE 23
slide-24
SLIDE 24

DEMO TIME!

slide-25
SLIDE 25
slide-26
SLIDE 26

CONCLUSION?

slide-27
SLIDE 27
slide-28
SLIDE 28

Traditional Linux Security

slide-29
SLIDE 29

$ ls -dl /var/www/html/ drwx r-x r-x. 2 root root /var/www/html/

USER GROUP ALL

slide-30
SLIDE 30

$ ps -ef | grep NetworkManager root 11781 1 0 Feb27 00:01:24 /usr/sbin/NetworkManager --no-daemon

slide-31
SLIDE 31

PROBLEMS ROOT BYPASSING THIS SECURITY SETUID BIT

slide-32
SLIDE 32

SELinux Security Policy

slide-33
SLIDE 33

CORE COMPONENT OF SELINUX

slide-34
SLIDE 34

CORE COMPONENT OF SELINUX COLLECTION OF SELINUX POLICY RULES

slide-35
SLIDE 35

CORE COMPONENT OF SELINUX COLLECTION OF SELINUX POLICY RULES LOADED INTO THE KERNEL BY SELINUX USERSPACE TOOLS

slide-36
SLIDE 36
slide-37
SLIDE 37

ENFORCED BY THE KERNEL

slide-38
SLIDE 38

ENFORCED BY THE KERNEL USED TO AUTHORIZE ACCESS REQUESTS ON THE SYSTEM

slide-39
SLIDE 39
slide-40
SLIDE 40

BY DEFAULT EVERYTHING IS DENIED AND YOU DEFINE POLICY RULES TO ALLOW CERTAIN REQUESTS.

slide-41
SLIDE 41

SELINUX POLICY RULES

slide-42
SLIDE 42

DESCRIBE AN INTERACTION BETWEEN PROCESSES AND SYSTEM RESOURCES

slide-43
SLIDE 43

SELINUX POLICY RULE IN HUMAN LANGUAGE

slide-44
SLIDE 44

"APACHE process can READ its LOGGING FILE"

slide-45
SLIDE 45

SELINUX VIEW OF THAT INTERACTION

slide-46
SLIDE 46

ALLOW apache_process apache_log:FILE READ;

slide-47
SLIDE 47

apache_process apache_log ARE LABELS

slide-48
SLIDE 48

LABELS

slide-49
SLIDE 49

ASSIGNED TO PROCESSES

slide-50
SLIDE 50

ASSIGNED TO PROCESSES ASSIGNED TO SYSTEM RESOURCES

slide-51
SLIDE 51

ASSIGNED TO PROCESSES ASSIGNED TO SYSTEM RESOURCES BY SELINUX SECURITY POLICY

slide-52
SLIDE 52

ASSIGNED TO PROCESSES ASSIGNED TO SYSTEM RESOURCES BY SELINUX SECURITY POLICY MAP REAL SYSTEM ENTITIES INTO THE SELINUX WORLD

slide-53
SLIDE 53

LABELS IN REALITY

slide-54
SLIDE 54

STORED IN EXTENDED ATTRIBUTES OF FILE SYSTEMS - EXT2,EXT3, EXT4 ...

slide-55
SLIDE 55

# getfattr -n security.selinux /etc/passwd getfattr: Removing leading '/' from absolute path names # file: etc/passwd security.selinux="system_u:object_r:passwd_file_t:s0" # ls -Z /etc/passwd system_u:object_r:passwd_file_t:s0 /etc/passwd

slide-56
SLIDE 56

SELINUX LABELS CONSIST OF FOUR PARTS

slide-57
SLIDE 57

<user>:<role>:<type>:<MLS/MCS>

slide-58
SLIDE 58
slide-59
SLIDE 59

Not the same as Linux users Several Linux users can be mapped to a single SELinux user

  • bject_u is a placeholder for Linux system resources

system_u is a placeholder for Linux processes Can be limited to a set of SELinux roles <user>:<role>:<type>:<MLS/MCS>

slide-60
SLIDE 60

<user>:<role>:<type>:<MLS/MCS>

<user>:<role>:<type>:<MLS/MCS>

slide-61
SLIDE 61

<user>:<role>:<type>:<MLS/MCS>

SELinux users can have multiple roles but only one can be active

  • bject_r is a placeholder for Linux system resources

system_r is a placeholder for system processes Can be limited to a set of SELinux types

slide-62
SLIDE 62

<user>:<role>:<type>:<MLS/MCS> <user>:<role>:<type>:<MLS/MCS>

slide-63
SLIDE 63

<user>:<role>:<type>:<MLS/MCS>

Security model known as TYPE ENFORCEMENT In 99% you care only about TYPES policy rules and interactions between types

slide-64
SLIDE 64

<user>:<role>:<type>:<MLS/MCS>

Multi Level Security Only the MCS part is used in Targeted Policy with the default s0 level Allow users to mark resources with compartment tags (MCS1, MCS2) Used for RHEL virtualization and for container security s0:c1 can not access s0:c2

slide-65
SLIDE 65
slide-66
SLIDE 66

IN RHEL7 WE SHIP THE TARGETED SELINUX POLICY BY DEFAULT

slide-67
SLIDE 67

WE MOSTLY CARE ONLY ABOUT TYPES

slide-68
SLIDE 68

SELINUX ALLOW RULE SYNTAX WITH TYPES

slide-69
SLIDE 69

ALLOW TYPE1 TYPE2:OBJECT_CLASS PERMISSION;

slide-70
SLIDE 70

ALLOW APACHE_T APACHE_LOG_T:FILE READ;

slide-71
SLIDE 71

DOMAIN TRANSITION RULES

slide-72
SLIDE 72

TYPE_TRANSITION TYPE1 TYPE2:PROCESS NEW_DOMAIN;

slide-73
SLIDE 73

TYPE_TRANSITION INIT_T HTTPD_EXEC_T:PROCESS HTTPD_T;

slide-74
SLIDE 74

FILE TRANSITION RULES

slide-75
SLIDE 75

TYPE_TRANSITION TYPE1 TYPE2:OBJECT_CLASS NEW_TYPE;

slide-76
SLIDE 76

TYPE_TRANSITION HTTPD_T VAR_LOG_T:FILE HTTPD_LOG_T;

slide-77
SLIDE 77

SELINUX MODES

slide-78
SLIDE 78

ENFORCING

slide-79
SLIDE 79

ENFORCING SELINUX SECURITY POLICY IS ENFORCED BY KERNEL

slide-80
SLIDE 80

PERMISSIVE

slide-81
SLIDE 81

PERMISSIVE SELINUX SECURITY POLICY IS NOT ENFORCED BY KERNEL

slide-82
SLIDE 82

PERMISSIVE SELINUX SECURITY POLICY IS NOT ENFORCED BY KERNEL ACCESSES ARE LOGGED

slide-83
SLIDE 83

UPDATED USERSPACE WITH EASIER POLICY CUSTOMIZATION

slide-84
SLIDE 84

NEW COMMON INTERMEDIATE LANGUAGE - CIL

slide-85
SLIDE 85

”M4+COMPILATION” VS. CIL

slide-86
SLIDE 86
slide-87
SLIDE 87

PERFORMANCE IMPROVEMENTS

slide-88
SLIDE 88

PERFORMANCE IMPROVEMENTS NEW POSSIBILITY FOR HLL

slide-89
SLIDE 89

PERFORMANCE IMPROVEMENTS NEW POSSIBILITY FOR HLL USABILITY

slide-90
SLIDE 90

LOCAL POLICY IN TWO STEPS

slide-91
SLIDE 91

# cat myapache.cil

(allow httpd_t httpd_log_t (file (open read getattr)))

slide-92
SLIDE 92

# semodule -i myapache.cil

slide-93
SLIDE 93

HOW DO WE DO IT WITH M4 + COMPILATION?

slide-94
SLIDE 94

# cat myapache.te

require { type httpd_t; type httpd_log_t; } allow httpd_t httpd_log_t:file { open read getattr };

slide-95
SLIDE 95

# make -f /usr/share/selinux/devel/Makefile # semodule -i myapache.pp

slide-96
SLIDE 96

SELINUX VS. CONTAINERS

slide-97
SLIDE 97

APPLIES MAC TO IMPROVE SECURITY WHEN USING VIRTUAL MACHINES

slide-98
SLIDE 98

container_t:s0:c1,c2 container_file_t:s0:c1 container_t:s0:c2,c3 container_file_t:s0:c2 container_file_t:s0:c3

slide-99
SLIDE 99

container_t:s0:c1,c2 container_file_t:s0:c1 container_t:s0:c2,c3 container_file_t:s0:c2 container_file_t:s0:c3

slide-100
SLIDE 100
  • container_t:s0:c1,c2

○ container_file_t:s0 ○ container_file_t:s0:c1 ○ container_file_t:s0:c2 ○ container_file_t:s0:c1,c2

  • container_t:s0:c2,c3

○ container_file_t:s0 ○ container_file_t:s0:c2 ○ container_file_t:s0:c3 ○ container_file_t:s0:c2,c3

Granted access:

slide-101
SLIDE 101
slide-102
SLIDE 102

SELinux user:SELinux role:SELinux type:SELinux category

slide-103
SLIDE 103

SELinux user:SELinux role:SELinux type:SELinux category

system_u:object_r:svirt_t:c306,c536

slide-104
SLIDE 104

SELinux user:SELinux role:SELinux type:SELinux category

system_u:object_r:svirt_t:c306,c536 system_u:object_r:svirt_t:c206,c636

slide-105
SLIDE 105

SELINUX KEEPS YOUR CONTAINER IN ITS OWN SPACE

slide-106
SLIDE 106

container:MCS1 container:MCS2 container:MCS3

slide-107
SLIDE 107

SELinux user:SELinux role:SELinux type:SELinux category

slide-108
SLIDE 108

SELinux user:SELinux role:SELinux type:SELinux category

system_u:object_r:container_t:c306,c536

slide-109
SLIDE 109

SELinux user:SELinux role:SELinux type:SELinux category

system_u:object_r:container_t:c306,c536 system_u:object_r:container_t:c206,c636

slide-110
SLIDE 110

SELinux user:SELinux role:SELinux type:SELinux category

system_u:object_r:container_t:c306,c536 system_u:object_r:container_t:c206,c636 system_u:object_r:container_t:c406,c736

slide-111
SLIDE 111

AVC MESSAGES

slide-112
SLIDE 112

WHERE CAN WE FIND LOGS?

slide-113
SLIDE 113

# cat /var/log/audit/audit.log

slide-114
SLIDE 114

# cat /var/log/audit/audit.log # ausearch -m AVC

slide-115
SLIDE 115

type=AVC msg=audit(1226882925.714:136): avc: denied { read } for pid=2512 comm="httpd" name="file1" dev=dm-0 ino=284133 scontext=unconfined_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:shadow_t:s0 tclass=file

slide-116
SLIDE 116

HOW TO PARSE AVC MESSAGES?

slide-117
SLIDE 117

# ausearch

slide-118
SLIDE 118

# ausearch # audit2allow

slide-119
SLIDE 119

# ausearch -m AVC -ts recent type=AVC msg=audit(1226882925.714:136): avc: denied { read } for pid=2512 comm="httpd" name="shadow" dev=dm-0 ino=284133 scontext=unconfined_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:shadow_t:s0 tclass=file # ausearch -m AVC -ts recent | audit2allow #============= httpd_t ============== allow httpd_t shadow_t:file read;

slide-120
SLIDE 120
  • # semanage fcontext -> manage SELinux contexts
  • # semanage boolean -> manage SELinux booleans
  • # semanage port -> manage SELinux ports
  • # semanage permissive -> put SELinux domain to permissive mode
  • # sesearch -> search for present SELinux rules
  • # ausearch -> search for SELinux denials
  • # sealert -> SELinux troubleshooter
  • # audit2allow -> Parse SELinux denials / create local SELinux module
  • # semodule -DB / # semodule -B -> SELinux policy rebuild
slide-121
SLIDE 121

ARE YOU USING SELINUX IN ENFORCING?

slide-122
SLIDE 122

Lukas Vrabec’s blog https://lukas-vrabec.com/ Dan Walsh’s blog http://danwalsh.livejournal.com/ Miroslav Grepl’s blog https://mgrepl.wordpress.com/ Paul Moore’s blog http://www.paul-moore.com/ Petr Lautrbach’s blog https://plautrba.fedorapeople.org/

BLOGS