Security model for embedded systems using Smack * Simple but secure - - PowerPoint PPT Presentation
Security model for embedded systems using Smack * Simple but secure * S implified M andatory A ccess C ontrol K ernel - Jos Bollo - - Jos Bollo - Con Contex text Jos Bollo Intel Eurogiciel Tizen Smack Linux 2
Simple but secure
* Simplified Mandatory Access Control Kernel
2 February 2014 2 February 2014 Smack for embeddeds ( Smack for embeddeds (2 2/16) /16)
2 February 2014 2 February 2014 Smack for embeddeds ( Smack for embeddeds (3 3/16) /16)
Smack is mainly Casey Schaufler Casey Schaufler.
since kernel 2 6 25 – 17 April 2008 – as a LSM LSM (Linux Security Module)
Tizen since the first days (2012).
extended file attributes to store data relating to files.
smackfs.
and processes (ptrace, signals, ...).
2 February 2014 2 February 2014 Smack for embeddeds ( Smack for embeddeds (4 4/16) /16)
– the subject's label
subject's label
– the object's label
– the access
access
System User rwx
This rule tells to allow read, write and execute access to objects labelled User for the processes labelled System.
What are labels? What are subjects? What are objects? How to set? Simple !!!
2 February 2014 2 February 2014 Smack for embeddeds ( Smack for embeddeds (5 5/16) /16)
Labels are just text (of valid ASCII characters) without any special meaning: they are compared to equality (case sensitive: a≠A).
Subjects are running processes: any running process has a smack label.
Objects are files files, IPC IPC, sockets sockets, processes processes.
context.
– The commands id, ps (option -Z or -M), ls (option -Z) are prompting
the contexts of the current process, the running processes, the files.
accesses are: read read (r), write write (w), execute execute (x), append append (a), lock lock (l), transmute transmute (t).
2 February 2014 2 February 2014 Smack for embeddeds ( Smack for embeddeds (6 6/16) /16)
You can't! Except if you have the capability CAP_MAC_ADMIN CAP_MAC_ADMIN.
You can only reduce accesses accesses for the current thread (inherited by cloning). But if you have the capability CAP_MAC_ADMIN CAP_MAC_ADMIN, you can change all rules.
# chsmack --access label file # echo -n label > /proc/$$/attr/current # echo “subject object rwt” > /sys/fs/smackfs/load-self2 # echo “subject object rwt” > /sys/fs/smackfs/load2 # echo “subject object rwt” > smackload
2 February 2014 2 February 2014 Smack for embeddeds ( Smack for embeddeds (7 7/16) /16)
mobile hansets In-vehicle infotainment (IVI) NUCs and boxes television
2 February 2014 2 February 2014 Smack for embeddeds ( Smack for embeddeds (8 8/16) /16)
Single seat Multi seats Single user handsets boxes Multi users tablets - laptops NUC IVI Multi seats is meaning that several users are using the same system through several interfaces. IVI is using Wayland Wayland
2 February 2014 2 February 2014 Smack for embeddeds ( Smack for embeddeds (9 9/16) /16)
Installed Applications (untrusted) Trusted System (installed, signed) Installer Installed Application with manifest The installer enable the application and configure the system according to the manifest. Trusted environment
Smack rules for authorised services
process
2 February 2014 2 February 2014 Smack for embeddeds ( Smack for embeddeds (10 10/16) /16)
Installed Applications (untrusted) Trusted System (installed, signed) Installer Installed Application with manifest launcher The installer enable the application and configure it according to the manifest. The launcher prepare the environment in agreement with the manifest and launch the application. Trusted environment
Smack rules for authorised services
process
2 February 2014 2 February 2014 Smack for embeddeds ( Smack for embeddeds (11 11/16) /16)
Web RunTime Widget Applications Native Applications Services Service 1 Kernel Service 2 Service 3 ... Tizen offers the possibility to install applications that are either natives or widgets (W3C compliant) or a mix of the both. Each application has potentially access to a wide variety of services. The accessed services MUST be conform to what the manifest of the application is claiming for. That is the condition to have a trusted system, a secure system.
Ok, but how to do that???
IPC
2 February 2014 2 February 2014 Smack for embeddeds ( Smack for embeddeds (12 12/16) /16)
controlling N ressources for M kinds of accesses brings to MN cases!
mobile hanset, not less than 33232 rules!)
– Each application have a own context label – The rules are the spare matrix of all the authorised accesses
– Basically, three subject labels exist: _
_, System System and User User
– There few more object labels – The rules are restricted to the minimum – It requires a launcher to achieve the full control of accesses
2 February 2014 2 February 2014 Smack for embeddeds ( Smack for embeddeds (13 13/16) /16)
Applications: User Services: System Base system: _ The floor domain provides the foundation upon which the system is built The System domain is comprised of the basic system services and the data they maintain. The User domain is comprised
directly with the person using the Tizen system and the data those services maintain.
System::Run System::Shared System::Log
2 February 2014 2 February 2014 Smack for embeddeds ( Smack for embeddeds (14 14/16) /16)
2 February 2014 2 February 2014 Smack for embeddeds ( Smack for embeddeds (15 15/16) /16)
implements it and its community can help you.
tools and models.
2 February 2014 2 February 2014 Smack for embeddeds ( Smack for embeddeds (16 16/16) /16)
2 February 2014 2 February 2014 Smack for embeddeds ( Smack for embeddeds (17 17/16) /16)
integration:
Web Framework,... domains)
multimédia:
– Widi/Miracast stack, – Wayland/Weston, – Webkit2 browser with HW acceleration,
jqmobi, Cordova
2 February 2014 2 February 2014 Smack for embeddeds ( Smack for embeddeds (18 18/16) /16)
Smack is mainly Casey Schaufler Casey Schaufler.
since kernel 2 6 25 – 17 April 2008 – as a LSM LSM (Linux Security Module)
3.12)
2 February 2014 2 February 2014 Smack for embeddeds ( Smack for embeddeds (19 19/16) /16)
Subject Object Rights System System::Run rwxat System System::Shared rwxat System User rwx System ^ rwxa System _ l User System wx User System::Run rwxat User System::Shared rx User _ l Subject Object Rights ^ System rwxa ^ System::Run rwxat _ System wx _ System::Run rwxat _ ^ * Y _ rwxatl rwxatl ^ rx rwxatl rwxatl rx * X rx rwxatl rwxatl
if X=Y
Explicit rules 1/2 Explicit rules 2/2 Some implicit rules Subject Object
2 February 2014 2 February 2014 Smack for embeddeds ( Smack for embeddeds (20 20/16) /16)
But there is no Smack here?!
Service Installed Application Security server
(granted or not)