Toward Automated Authorization Policy Enforcement Vinod Ganapathy - - PowerPoint PPT Presentation

▶
toward automated authorization policy enforcement
SMART_READER_LITE
LIVE PREVIEW

Toward Automated Authorization Policy Enforcement Vinod Ganapathy - - PowerPoint PPT Presentation

Jan 01, 2023 387 likes •795 views

Toward Automated Authorization Policy Enforcement Vinod Ganapathy Trent Jaeger Somesh Jha vg@cs.wisc.edu tjaeger@cse.psu.edu jha@cs.wisc.edu March 1 st , 2006 Second Annual Security-enhanced Linux Symposium Baltimore, Maryland Introduction

slide-1
SLIDE 1

Toward Automated Authorization Policy Enforcement

Somesh Jha

jha@cs.wisc.edu

Trent Jaeger

tjaeger@cse.psu.edu

Vinod Ganapathy

vg@cs.wisc.edu

March 1st, 2006 Second Annual Security-enhanced Linux Symposium Baltimore, Maryland

slide-2
SLIDE 2

SELinux 2006 Ganapathy/Jaeger/Jha: Toward Automated Authorization Policy Enforcement 2

Introduction

  • SELinux helps meet information-flow goals
  • Expressive access-control policy language
  • Security-enhanced operating system

Request Allowed? Yes/No Yes/No

User App

slide-3
SLIDE 3

SELinux 2006 Ganapathy/Jaeger/Jha: Toward Automated Authorization Policy Enforcement 3

Security-aware Applications

  • Need for security-aware applications
  • Can we build applications that can enforce

mandatory access control policies?

Request Allowed? Yes/No Yes/No

User App

slide-4
SLIDE 4

SELinux 2006 Ganapathy/Jaeger/Jha: Toward Automated Authorization Policy Enforcement 4

Security-aware Applications

  • Need for security-aware applications

Request Allowed? Yes/No Yes/No

Client Server

Allowed? Yes/No

slide-5
SLIDE 5

SELinux 2006 Ganapathy/Jaeger/Jha: Toward Automated Authorization Policy Enforcement 5

Security-aware Applications

  • Need for security-aware applications
  • Our work: How to build security-aware

applications?

  • Focus is on mechanism, not policy

Request Allowed? Yes/No Yes/No

Client Server

slide-6
SLIDE 6

SELinux 2006 Ganapathy/Jaeger/Jha: Toward Automated Authorization Policy Enforcement 6

Motivating Example

Remote Client: Alice Alice Local

X Server

slide-7
SLIDE 7

SELinux 2006 Ganapathy/Jaeger/Jha: Toward Automated Authorization Policy Enforcement 7

Motivating Example

Remote Client: Alice Alice

X Server

Remote Client: Bob Bob

slide-8
SLIDE 8

SELinux 2006 Ganapathy/Jaeger/Jha: Toward Automated Authorization Policy Enforcement 8

Motivating Example

Remote Client: Alice

X Server

Remote Client: Bob Remote Client: Alice Alice Keyboard input

Malicious client can snoop on input violating Alice’s confidentiality

slide-9
SLIDE 9

SELinux 2006 Ganapathy/Jaeger/Jha: Toward Automated Authorization Policy Enforcement 9

Motivating Example

Remote Client: Alice

X Server

Remote Client: Bob Remote Client: Alice Alice

Malicious client can alter settings

  • n other client windows
slide-10
SLIDE 10

SELinux 2006 Ganapathy/Jaeger/Jha: Toward Automated Authorization Policy Enforcement 10

Motivating Example

Remote Client: Alice

X Server

Remote Client: Bob Remote Client: Alice Alice

No mechanism to enforce authorization policies on client interactions

slide-11
SLIDE 11

SELinux 2006 Ganapathy/Jaeger/Jha: Toward Automated Authorization Policy Enforcement 11

Motivating Example

Remote Client: Alice

X Server

Remote Client: Bob Remote Client: Alice Alice Keyboard input

Input Request Disallowed

Goal of the Security enhanced X server project [Kilpatrick et al., 2003]

slide-12
SLIDE 12

SELinux 2006 Ganapathy/Jaeger/Jha: Toward Automated Authorization Policy Enforcement 12

Need for Security-awareness

  • More examples: user-space servers

– Samba – Web servers – Proxy and cache servers – Middleware

  • Common features

– Manage multiple clients simultaneously – Offer shared resources to clients – Perform services on behalf of their clients

slide-13
SLIDE 13

SELinux 2006 Ganapathy/Jaeger/Jha: Toward Automated Authorization Policy Enforcement 13

Main Claim

To effectively meet security-goals, all applications managing shared resources must be made security-aware

slide-14
SLIDE 14

SELinux 2006 Ganapathy/Jaeger/Jha: Toward Automated Authorization Policy Enforcement 14

Focus of our work

  • How to build security-aware applications?
  • Focus is on mechanism, not policy

– Can use tools like Tresys’ SELinux Policy Management Toolkit

Request Allowed? Yes/No Yes/No

Client Server

slide-15
SLIDE 15

SELinux 2006 Ganapathy/Jaeger/Jha: Toward Automated Authorization Policy Enforcement 15

Security-aware Applications

  • How to build security-aware applications?
  • Proactively design code for security

– MULTICS project [Corbato et al., 1965] – Postfix mail server [Venema]

  • Retrofit existing, legacy code

– Linux Security Modules project [Wright et al., 2002] – Security-enhanced X project [Kilpatrick et al., 2003] – Privilege separated OpenSSH [Provos et al., 2003]

Our work: Tool support to retrofit legacy servers for authorization policy enforcement

slide-16
SLIDE 16

SELinux 2006 Ganapathy/Jaeger/Jha: Toward Automated Authorization Policy Enforcement 16

Our Work

  • Tools to analyze and retrofit legacy code
  • Two case studies:

– Retrofitting the X server [IEEE S&P 2006] – Retrofitting Linux [ACM CCS 2005]

Legacy server Security-aware server

slide-17
SLIDE 17

SELinux 2006 Ganapathy/Jaeger/Jha: Toward Automated Authorization Policy Enforcement 17

Main Goal

  • Tool support to add reference monitoring

to user-space servers

Reference Monitor

Security-Event Yes/No

Server

Main challenge: Where to place reference monitor hooks?

slide-18
SLIDE 18

SELinux 2006 Ganapathy/Jaeger/Jha: Toward Automated Authorization Policy Enforcement 18

Authorization Policies

  • Access-control matrix [Lampson’71]
  • Three entities: ‹subject, object, operation›

– Subject (user or process) – Object (resource, such as file or socket) – Security-sensitive operation (access vectors) r r/w/x

vg

r/w r/w/x r/w

root /var/log /usr/vg/a.out /etc/passwd

slide-19
SLIDE 19

SELinux 2006 Ganapathy/Jaeger/Jha: Toward Automated Authorization Policy Enforcement 19

Main Goal

  • Analysis techniques to find where server

performs security-sensitive operations

Reference Monitor

Security-Event Yes/No

Server

slide-20
SLIDE 20

SELinux 2006 Ganapathy/Jaeger/Jha: Toward Automated Authorization Policy Enforcement 20

Key Insight: Fingerprints

  • Each security-sensitive operation has a

fingerprint

  • Intuition: Denotes key code-level steps to

achieve the operation

slide-21
SLIDE 21

SELinux 2006 Ganapathy/Jaeger/Jha: Toward Automated Authorization Policy Enforcement 21

Examples of Fingerprints

  • Three access vectors from SELinux
  • DIR_WRITE :-

– Set inode->i_ctime & – Call address_space_ops->prepare_write()

  • DIR_RMDIR :-

– Set inode->i_size TO 0 & – Decrement inode->i_nlink

  • SOCKET_BIND :-

– Call socket->proto_ops->bind()

slide-22
SLIDE 22

SELinux 2006 Ganapathy/Jaeger/Jha: Toward Automated Authorization Policy Enforcement 22

Examples of Fingerprints

  • Access vectors for the X server
  • WINDOW_MAP:-

– Set WindowPtr->mapped TO TRUE & – Set xEvent->type TO MapNotify

  • WINDOW_ENUMERATE:-

– Read WindowPtr->firstChild & – Read WindowPtr->nextSib & – Compare WindowPtr ≠ 0

slide-23
SLIDE 23

SELinux 2006 Ganapathy/Jaeger/Jha: Toward Automated Authorization Policy Enforcement 23

Key Insight: Fingerprints

  • How to find fingerprints?
  • How to use fingerprints to place hooks?
slide-24
SLIDE 24

SELinux 2006 Ganapathy/Jaeger/Jha: Toward Automated Authorization Policy Enforcement 24

Using Fingerprints: An Example

  • X server function MapSubWindows

MapSubWindows(Window *pParent, Client *pClient) { xEvent event; Window *pWin; … pWin = pParent->firstChild; … for (;pWin != 0; pWin=pWin->nextSib) { pWin->mapped = TRUE; … event.type = MapNotify; } }

slide-25
SLIDE 25

SELinux 2006 Ganapathy/Jaeger/Jha: Toward Automated Authorization Policy Enforcement 25

Examples of Fingerprints

  • Access vectors for the X server
  • WINDOW_MAP:-

– Set WindowPtr->mapped TO TRUE & – Set xEvent->type TO MapNotify

  • WINDOW_ENUMERATE:-

– Read WindowPtr->firstChild & – Read WindowPtr->nextSib & – Compare WindowPtr ≠ 0

slide-26
SLIDE 26

SELinux 2006 Ganapathy/Jaeger/Jha: Toward Automated Authorization Policy Enforcement 26

Using Fingerprints: An Example

  • X server function MapSubWindows

MapSubWindows(Window *pParent, Client *pClient) { xEvent event; Window *pWin; … pWin = pParent->firstChild; … for (;pWin != 0; pWin=pWin->nextSib) { pWin->mapped = TRUE; … event.type = MapNotify; } }

Performs Window_Map

slide-27
SLIDE 27

SELinux 2006 Ganapathy/Jaeger/Jha: Toward Automated Authorization Policy Enforcement 27

Examples of Fingerprints

  • Access vectors for the X server
  • WINDOW_MAP:-

– Set WindowPtr->mapped TO TRUE & – Set xEvent->type TO MapNotify

  • WINDOW_ENUMERATE:-

– Read WindowPtr->firstChild & – Read WindowPtr->nextSib & – Compare WindowPtr ≠ 0

slide-28
SLIDE 28

SELinux 2006 Ganapathy/Jaeger/Jha: Toward Automated Authorization Policy Enforcement 28

Using Fingerprints: An Example

  • X server function MapSubWindows

MapSubWindows(Window *pParent, Client *pClient) { xEvent event; Window *pWin; … pWin = pParent->firstChild; … for (;pWin != 0; pWin=pWin->nextSib) { // Code to map window on screen pWin->mapped = TRUE; … event.type = MapNotify; } }

Performs Window_Enumerate

slide-29
SLIDE 29

SELinux 2006 Ganapathy/Jaeger/Jha: Toward Automated Authorization Policy Enforcement 29

Using Fingerprints

  • Fingerprints located using static analysis
  • Key advantage: statically find all locations

where fingerprints occur

  • Can add hooks to all these locations
slide-30
SLIDE 30

SELinux 2006 Ganapathy/Jaeger/Jha: Toward Automated Authorization Policy Enforcement 30

Adding Hooks: An Example

  • X server function MapSubWindows

MapSubWindows(Window *pParent, Client *pClient) { xEvent event; Window *pWin; // Code to enumerate child windows avc_has_perm(pClient, pParent, WINDOW_ENUMERATE); pWin = pParent->firstChild; … for (;pWin != 0; pWin=pWin->nextSib) { // Code to map window on screen avc_has_perm(pClient, pWin, WINDOW_MAP); pWin->mapped = TRUE; … event.type = MapNotify; } }

slide-31
SLIDE 31

SELinux 2006 Ganapathy/Jaeger/Jha: Toward Automated Authorization Policy Enforcement 31

Key Insight: Fingerprints

  • How to find fingerprints?
  • How to use fingerprints to place hooks?
slide-32
SLIDE 32

SELinux 2006 Ganapathy/Jaeger/Jha: Toward Automated Authorization Policy Enforcement 32

Finding Fingerprints

  • Using analysis of runtime traces
  • Key Insight:

– If server does a security-sensitive operation its fingerprint must be in the trace

  • Example:

– Get X server to perform WINDOW_MAP

Set WindowPtr->mapped TO TRUE Set xEvent->type TO MapNotify

slide-33
SLIDE 33

SELinux 2006 Ganapathy/Jaeger/Jha: Toward Automated Authorization Policy Enforcement 33

Finding Fingerprints

  • Main challenge:

– Locating fingerprints in the runtime trace

  • Key insight:

– Compare several runtime traces

Set WindowPtr->mapped TO TRUE Set xEvent->type TO MapNotify

“DIFF”

Trace 1: Server does not perform WINDOW_MAP

slide-34
SLIDE 34

SELinux 2006 Ganapathy/Jaeger/Jha: Toward Automated Authorization Policy Enforcement 34

Finding Fingerprints

  • Main challenge:

– Locating fingerprints in the runtime trace

  • Key insight:

– Compare several runtime traces

Set WindowPtr->mapped TO TRUE Set xEvent->type TO MapNotify

“DIFF”

Trace 2: Server does not perform WINDOW_MAP

slide-35
SLIDE 35

SELinux 2006 Ganapathy/Jaeger/Jha: Toward Automated Authorization Policy Enforcement 35

Key Insight: Fingerprints

  • How to find fingerprints?
  • How to use fingerprints to place hooks?
slide-36
SLIDE 36

SELinux 2006 Ganapathy/Jaeger/Jha: Toward Automated Authorization Policy Enforcement 36

Results

  • Retrofitted version of X server
  • Fingerprint-finding technique is effective:

– Fewer than 10 functions to be examined to write fingerprints – In comparison, each trace exercises several hundred distinct X server functions

  • Details in upcoming IEEE S&P 2006 paper
slide-37
SLIDE 37

SELinux 2006 Ganapathy/Jaeger/Jha: Toward Automated Authorization Policy Enforcement 37

Examples of fingerprints

Call ProcessPointerEvent, Call ProcessKeybdEvent

WINDOW_INPUTEVENT

Call MoveWindowInStack

WINDOW_CHSTACK

Set xEvent->type TO UnmapNotify

WINDOW_UNMAP

Call DeleteWindow

WINDOW_DESTROY

Call CreateWindow

WINDOW_CREATE

Fingerprint Operation

slide-38
SLIDE 38

SELinux 2006 Ganapathy/Jaeger/Jha: Toward Automated Authorization Policy Enforcement 38

Slide to take home

  • Goal: Placing authorization hooks in servers
  • Key insight: Security-sensitive operations have

fingerprints

  • Finding fingerprints: Using “diff” of runtime traces
  • Placing hooks: By statically locating fingerprints
slide-39
SLIDE 39

Somesh Jha

jha@cs.wisc.edu

Trent Jaeger

tjaeger@cse.psu.edu

Vinod Ganapathy

vg@cs.wisc.edu

Questions?

Toward Automated Authorization Policy Enforcement

http://www.cs.wisc.edu/~vg http://www.cse.psu.edu/~tjaeger http://www.cs.wisc.edu/~jha