SENG: An Enhanced Policy SENG: An Enhanced Policy Language for - - PowerPoint PPT Presentation

▶
seng an enhanced policy seng an enhanced policy language
SMART_READER_LITE
LIVE PREVIEW

SENG: An Enhanced Policy SENG: An Enhanced Policy Language for - - PowerPoint PPT Presentation

Oct 01, 2022 335 likes •948 views

SENG: An Enhanced Policy SENG: An Enhanced Policy Language for SELinux Language for SELinux Paul Kuliniewicz <kuliniew@purdue.edu> CERIAS, Purdue University Overview Overview What's wrong with macros? Can we do better?

slide-1
SLIDE 1

SENG: An Enhanced Policy SENG: An Enhanced Policy Language for SELinux Language for SELinux

Paul Kuliniewicz <kuliniew@purdue.edu> CERIAS, Purdue University

slide-2
SLIDE 2

Overview Overview

  • What's wrong with macros?
  • Can we do better?
  • The future...
slide-3
SLIDE 3

What a Language Should Be What a Language Should Be

  • Expressive

– Can say what we want

  • Succinct

– Can say it briefly

  • Analyzable

– Well-defined semantics

  • Natural

– Reflects how we think

slide-4
SLIDE 4

The Current Language The Current Language

  • Expressive and analyzable

– We can write the desired policy – Statements have clear semantics

  • (ignoring macros...)
  • Neither succinct nor natural

– Each AV rule makes small changes – Need many rules to accomplish goals – Lower-level than we usually think

slide-5
SLIDE 5

Anatomy of an AV Rule Anatomy of an AV Rule

allow foo_t bar_t:file getattr; subject

  • bject

permission

bar_t:file getattr foo_t

slide-6
SLIDE 6

Access Matrix Access Matrix

foo_t bar_t baz_t foo_t: file foo_t: dir bar_t: file bar_t: dir

allow foo_t bar_t:file read; allow {bar_t baz_t} foo_t:{file dir} create; read create create create create

slide-7
SLIDE 7

Quantifying Verbosity Quantifying Verbosity

  • Monolithic example policy 1.26:

– 2,024 types – 66,676 AV rules – 2,095 type transition rules

slide-8
SLIDE 8

Macros Macros

  • Succinct

– One macro can replace many rules

  • Neither analyzable nor natural

– Macro behavior is unconstrained by base language – Macros shoehorned into all abstractions needed by policy writer

slide-9
SLIDE 9

Unconstrained Unconstrained

Policy Source Expanded Policy Binary Policy

m4 checkpolicy

m4 Macro Language SELinux Policy Language

slide-10
SLIDE 10

Simple Macro Simple Macro

define(`rw_dir_file', ` allow $1 $2:dir rw_dir_perms; allow $1 $2:file rw_file_perms; allow $1 $2:lnk_file { getattr read }; ') rw_dir_file(foo_t, bar_t) generates ...?

slide-11
SLIDE 11

Complex Macro Complex Macro

define(`can_create_internal', ` ifelse(`$3', `dir', ` allow $1 $2:$3 create_dir_perms; ', `$3', `lnk_file', ` allow $1 $2:$3 create_lnk_perms; ', ` allow $1 $2:$3 create_file_perms; ')') define(`can_create', ` ifelse(regexp($3, `\w'), -1, `', ` can_create_internal($1, $2, regexp($3, `\(\w+\)', `\1')) can_create($1, $2, regexp($3, `\w+\(.*\)', `\1')) ')')

can_create(foo_t, bar_t, `{dir file}') generates...?

slide-12
SLIDE 12

Unnatural Unnatural

  • uses_shlib(foo_t)

– assigns permissions to foo_t

  • tmp_domain(foo)

– also assigns permissions to foo_t

  • Both operate on foo_t

– Leaky abstraction

  • Neither looks like an AV rule
slide-13
SLIDE 13

Overview Overview

  • What's wrong with macros?
  • Can we do better?
  • The future...
slide-14
SLIDE 14

Introducing SENG Introducing SENG

  • Experimental alternative policy

language

  • Replaces macros with well-defined

abstractions

– Easier to read – Easier to write – Easier to analyze

slide-15
SLIDE 15

Features Features

  • Class and permission sets
  • Abstract resources
  • Abstract permissions
  • Templates
  • Abstract type transitions

– All of these currently implemented ad- hoc using m4

slide-16
SLIDE 16

Class and Permission Sets Class and Permission Sets

allow foo_t bar_t:notdevfile_class_set r_file_perms;

read getattr lock ioctl

define(`notdevfile_class_set', `{ file lnk_file ... }') define(`r_file_perms', `{ read getattr ... }')

file lnk_file sock_file fifo_file

slide-17
SLIDE 17

Class and Permission Sets Class and Permission Sets

allow foo_t bar_t:notdevfile_class_set r_file_perms;

read getattr lock ioctl

classset notdevfile_class_set { file lnk_file ... }; permset r_file_perms { read getattr ... };

file lnk_file sock_file fifo_file

slide-18
SLIDE 18

Features Features

  • Class and permission sets
  • Abstract resources
  • Abstract permissions
  • Templates
  • Abstract type transitions
slide-19
SLIDE 19

Abstract Resources Abstract Resources

uses_shlib(foo_t) shared libraries use define(`uses_shlib', ` allow $1 { root_t usr_t lib_t etc_t }:dir r_dir_perms; allow $1 lib_t:lnk_file r_file_perms; allow $1 ld_so_t:file rx_file_perms; ... ') foo_t

slide-20
SLIDE 20

Abstract Resources Abstract Resources

allow foo_t shlib use; shlib use resource shlib { use }; permission shlib use ($dom) { allow $dom { root_t usr_t lib_t etc_t }:dir r_dir_perms; allow $dom lib_t:lnk_file r_file_perms; allow $dom ld_so_t:file rx_file_perms; ... }; foo_t

slide-21
SLIDE 21

Abstract Resources Abstract Resources

allow foo_t shlib use; shlib use allow foo_t { root_t usr_t lib_t etc_t }:dir r_dir_perms; allow foo_t lib_t:lnk_file r_file_perms; allow foo_t ld_so_t:file rx_file_perms; ... foo_t

slide-22
SLIDE 22

Features Features

  • Class and permission sets
  • Abstract resources
  • Abstract permissions
  • Templates
  • Abstract type transitions
slide-23
SLIDE 23

Abstract Permissions Abstract Permissions

create_dir_file(foo_t, bar_t) create_dir_file bar_t define(`create_dir_file', ` allow $1 $2:dir create_dir_perms; allow $1 $2:file create_file_perms; allow $1 $2:lnk_file create_lnk_perms; ') foo_t

slide-24
SLIDE 24

Abstract Permissions Abstract Permissions

allow foo_t bar_t create_dir_file; create_dir_file bar_t permission create_dir_file ($dom, $typ) { allow $dom $typ:dir create_dir_perms; allow $dom $typ:file create_file_perms; allow $dom $typ:lnk_file create_lnk_perms; }; foo_t

slide-25
SLIDE 25

Abstract Permissions Abstract Permissions

allow foo_t bar_t create_dir_file; create_dir_file bar_t allow foo_t bar_t:dir create_dir_perms; allow foo_t bar_t:file create_file_perms; allow foo_t bar_t:lnk_file create_lnk_perms; foo_t

slide-26
SLIDE 26

Features Features

  • Class and permission sets
  • Abstract resources
  • Abstract permissions
  • Templates
  • Abstract type transitions
slide-27
SLIDE 27

Motivating Templates Motivating Templates

/var/log append append foo_t bar_t

slide-28
SLIDE 28

Template Declaration Template Declaration

type ANYROLE.suffix_t; type ANYTYPE.suffix_t; Replaced with the name

  • f an existing role or

type at instantiation. The “.” character divides a name into a series of tokens.

slide-29
SLIDE 29

Template Instantiation Template Instantiation

type ANYROLE.suffix_t; role foo_r { foo_t }; allow foo_r.suffix_t bar_t:file read; Compiler instantiates template automatically.

slide-30
SLIDE 30

Using Templates Using Templates

append_log_domain(foo) define(`append_log_domain', ` type $1_log_t, file_type, sysadmfile, logfile; allow $1_t var_log_t:dir ra_dir_perms; allow $1_t $1_log_t:file { create ra_file_perms }; type_transition $1_t var_log_t:file $1_log_t; ') /var/log append foo_t

slide-31
SLIDE 31

Using Templates Using Templates

allow foo_t log append; resource log { append ... } type ANYTYPE.log_t { file_type sysadmfile logfile }; permission log append ($dom) { allow $dom var_log_t:dir ra_dir_perms; allow $dom $dom.log_t:file { create ra_file_perms }; type_transition $dom var_log_t $dom.log_t:file; }; log append foo_t

slide-32
SLIDE 32

Using Templates Using Templates

allow foo_t log append; type ANYTYPE.log_t { file_type sysadmfile logfile }; allow foo_t var_log_t:dir ra_dir_perms; allow foo_t foo_t.log_t:file { create ra_file_perms }; type_transition foo_t var_log_t foo_t.log_t:file; foo_t log append

slide-33
SLIDE 33

Prefix Resolution Prefix Resolution

type foo_t; type ANYTYPE.suffix_t; foo_t.suffix_t prefix(foo_t.suffix_t) foo_t Extracts the name of the type or role used as the prefix of the template instantiation.

slide-34
SLIDE 34

Using Prefix Resolution Using Prefix Resolution

user_r's /home private_access user_r.app_t staff_r's /home private_access staff_r.app_t

slide-35
SLIDE 35

Using Prefix Resolution Using Prefix Resolution

user_r's /home private_access user_r.app_t user_r.app_t user_r.home_t:dir user_r.app_t.privhome_t rw_dir_perms create_dir_file

slide-36
SLIDE 36

Using Prefix Resolution Using Prefix Resolution

home_private_access(user, app) define(`home_private_access', ` type $1_$2_privhome_t; allow $1_$2_t $1_home_t:dir rw_dir_perms; create_dir_file($1_$2_t, $1_$2_privhome_t) ') user_r's home private_access user_r.app_t

slide-37
SLIDE 37

Using Prefix Resolution Using Prefix Resolution

allow user_r.app_t home private_access; type ANYROLE.app_t; type ANYROLE.home_t; type ANYTYPE.privhome_t; permission home private_access ($dom) { allow $dom prefix($dom).home_t:dir rw_dir_perms; allow $dom $dom.privhome_t create_dir_perms; }; home private_access user_r.app_t

slide-38
SLIDE 38

Using Prefix Resolution Using Prefix Resolution

allow user_r.app_t home private_access; type ANYROLE.app_t; type ANYROLE.home_t; type ANYTYPE.privhome_t; allow user_r.app_t prefix(user_r.app_t).home_t:dir rw_dir_perms; allow user_r.app_t user_r.app_t.privhome_t create_dir_perms; home private_access user_r.app_t

slide-39
SLIDE 39

Using Prefix Resolution Using Prefix Resolution

allow user_r.app_t home private_access; type ANYROLE.app_t; type ANYROLE.home_t; type ANYTYPE.privhome_t; allow user_r.app_t user_r.home_t:dir rw_dir_perms; allow user_r.app_t user_r.app_t.privhome_t create_dir_perms; home private_access user_r.app_t

slide-40
SLIDE 40

Features Features

  • Class and permission sets
  • Abstract resources
  • Abstract permissions
  • Templates
  • Abstract type transitions
slide-41
SLIDE 41

Permissions and Transitions Permissions and Transitions

foo_t:process bar_t:process bar_exec_t allow foo_t bar_t:process transition allow foo_t bar_exec_t:file { read x_file_perms}; allow bar_t bar_exec_t:file rx_file_perms; allow bar_t foo_t:process sigchld; ...

slide-42
SLIDE 42

Permissions and Transitions Permissions and Transitions

foo_t:process foo_t.bar_t:file bar_t allow foo_t bar_t:dir rw_dir_perms; allow foo_t foo_t.bar_t:file create_file_perms;

slide-43
SLIDE 43

Permissions and Transitions Permissions and Transitions

foo_t:process foo_t.bar_t:dir bar_t allow foo_t bar_t:dir rw_dir_perms; allow foo_t foo_t.bar_t:dir create_dir_perms;

slide-44
SLIDE 44

Abstract Transitions Abstract Transitions

foo_t:process bar_t:process bar_exec_t type_transition foo_t bar_exec_t bar_t:process domain; trans domain ($from_dom, $via_typ, $to_dom:process) { allow $from_dom $to_dom:process transition; allow $from_dom $via_typ:file { read x_file_perms }; allow $to_dom $from_dom:process sigchld; allow $to_dom $via_typ:file rx_file_perms; ... };

slide-45
SLIDE 45

Abstract Transitions Abstract Transitions

foo_t:process bar_t:process bar_exec_t type_transition foo_t bar_exec_t bar_t:process domain; allow foo_t bar_t:process transition; allow foo_t bar_exec_t:file { read x_file_perms }; allow bar_t foo_t:process sigchld; allow bar_t bar_exec_t:file rx_file_perms; ...

slide-46
SLIDE 46

Abstract Transitions Abstract Transitions

foo_t:process foo_t.bar_t:file bar_t type_transition foo_t bar_t foo_t.bar_t:{ dir file } file_trans; trans file_trans ($from_dom, $via_typ, $to_dom:$to_class) { allow $from_dom $via_typ:dir rw_dir_perms; }; trans file_trans ($from_dom, $via_typ, $to_dom:dir) { allow $from_dom $to_typ:dir create_dir_perms; }; trans file_trans ($from_dom, $via_typ, $to_dom:file) { allow $from_dom $to_typ:file create_file_perms; }; foo_t.bar_t:dir

slide-47
SLIDE 47

Abstract Transitions Abstract Transitions

foo_t:process foo_t.bar_t:file bar_t type_transition foo_t bar_t foo_t.bar_t:{ dir file } file_trans; allow foo_t bar_t:dir rw_dir_perms; allow foo_t foo_t.bar_t:dir create_dir_perms; allow foo_t bar_t:dir rw_dir_perms; allow foo_t foo_t.bar_t:file create_file_perms; foo_t.bar_t:dir

slide-48
SLIDE 48

Overview Overview

  • What's wrong with macros?
  • Can we do better?
  • The future...
slide-49
SLIDE 49

SENG Status SENG Status

  • Proof-of-concept SENG compiler

– Emits equivalent policy in existing monolithic policy language

  • Small-scale smoke testing

– Reimplementing small subset of monolithic policy using SENG

slide-50
SLIDE 50

What's Left: Language What's Left: Language

  • Support for reference policy

– Use SENG abstractions for module interfaces instead of m4?

  • Support for MLS/MCS

– Unknown what changes to SENG would be needed

  • Formally defined semantics for SENG
slide-51
SLIDE 51

What's Left: Toolset What's Left: Toolset

  • Policy analysis using SENG

– SENG should be relatively easy to analyze

  • Full-featured SENG compiler

– Current proof-of-concept not ready for production use

slide-52
SLIDE 52

More Information More Information

  • Website

– http://web.ics.purdue.edu/~kuliniew/seng/ – (coming soon...)

  • Or Ask

– kuliniew@purdue.edu – The person standing at the lectern

slide-53
SLIDE 53

Bonus Slides

slide-54
SLIDE 54

Recursive Instantiation Recursive Instantiation

type ANYTYPE.suffix_t; type foo_t; type foo_t.suffix_t; type foo_t.suffix_t.suffix_t; Could lead to unbounded number of types!

slide-55
SLIDE 55

Recursive Instantiation Recursive Instantiation

type ANYTYPE.suffix_t; resource recursive { use }; permission recursive use ($dom) { allow $dom $dom.suffix_t:file read; allow $dom.suffix_t recursive use; }; allow foo_t recursive use; allow foo_t foo_t.suffix:file read; allow foo_t.suffix_t foo_t.suffix_t.suffix_t:file read; allow foo_t.suffix_t.suffix_t foo_t.suffix_t.suffix_t.suffix_t:file read; ...

slide-56
SLIDE 56

Class and Permission Sets Class and Permission Sets

  • Mere aggregation of multiple classes
  • r permissions
  • Similar to attributes for types in

current language

– In SENG, attributes are called type sets

  • Nothing really new here
slide-57
SLIDE 57

Abstract Resources Abstract Resources

  • Grant domain access to a resource

– Resource composed of multiple things

  • allow syntax makes intent clear

– Rules associated with resource's permission do the necessary work

slide-58
SLIDE 58

Abstract Permissions Abstract Permissions

  • Grant a domain various permissions
  • ver a type

– Permissions spread across multiple classes

  • Again, use of allow makes intent

clear

slide-59
SLIDE 59

Motivating Templates Motivating Templates

  • Intuitive that /var/log should be an

abstract resource

  • foo_t mustn't access bar_t's files

– And vice versa

  • Need to generate new types for each

domain's log files

– We need type templates

slide-60
SLIDE 60

Permissions and Transitions Permissions and Transitions

  • Transitions need supporting

permissions to be granted

– Involve source type, target type, and related type – The permissions may depend on what class of object is being transitioned to

  • Associate these permissions with the

transition itself!