linux-kernel - Re: [RFC][PATCH 8/8] SLIM: documentation

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 24 Aug 2006 08:03:40 -0500
From:	"Serge E. Hallyn" <sergeh@...ibm.com>
To:	Pavel Machek <pavel@....cz>
Cc:	Mimi Zohar <zohar@...ibm.com>, David Safford <safford@...ibm.com>,
	kjhall@...ibm.com, linux-kernel <linux-kernel@...r.kernel.org>,
	LSM ML <linux-security-module@...r.kernel.org>,
	linux-security-module-owner@...r.kernel.org,
	Serge E Hallyn <sergeh@...ibm.com>
Subject: Re: [RFC][PATCH 8/8] SLIM: documentation

Quoting Pavel Machek (pavel@....cz):
> Hi!
> 
> > > > +In normal operation, the system seems to stabilize with a roughly
> > > > +equal mixture of SYSTEM, USER, and UNTRUSTED processes. Most
> > >
> > > So you split processes to three classes (why three?), and
> > > automagically move them between classes based on some rules? (What
> > > rules?)
> > >
> > > Like if I'm UNTRUSTED process, I may not read ~/.ssh/private_key? So
> > > files get this kind of labels, too? And it is "mozilla starts as a
> > > USER, but when it accesses first web page it becomes UNTRUSTED"?
> > 
> > Processes are not moved from one integrity level to another, but are
> > demoted when they read from a lower integrity level object. By
> > definition sockets, are defined as UNTRUSTED, so reading from a
> > socket demotes the process to UNTRUSTED.  (Secrecy is a separate
> > attribute.) In the Mozilla example, /usr/bin/mozilla is defined as
> > SYSTEM, preventing any process with lesser integrity from modifying
> > it.  'level -s' displays the level of the current process or of a
> > given file.  For example,
> > 
> > [zohar@...098X ~]$ level -s /usr/bin/mozilla
> > /usr/bin/mozilla
> >         security.slim.level: SYSTEM PUBLIC
> > 
> > Both mozilla and firefox-bin are defined as SYSTEM, as soon as the
> > firefox-bin process opens a socket, the process is demoted to
> > UNTRUSTED.
> > 
> > I hope this answered some of your questions.  We're working on
> > more comprehensive documentation, which we'll post with the next
> > release.
> 
> Do you have examples where this security model stops an attack?
> 
> Both my mail client and my mozilla will be UNTRUSTED (because of
> network connections, right?) -- so mozilla exploit will still be able
> t osee my mail? Not good. And ssh connects to the net, too, so it will
> not even protect my ~/.ssh/private_key ?

I believe it will read your private_key while at a higher level, then
will be demoted when it access the net.

Is that right?

-serge
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/