使いこなせて安全なLinuxを目指して

Size: px

Start display at page:

Download "使いこなせて安全なLinuxを目指して"

みさえかみいしづ
5 years ago
Views:

6 Linux /bin/bash /usr/bin/passwd /usr/bin/passwd uid: harada euid: harada fork() owner: root group: root -r-s--x--x execve() uid: harada euid: root /etc/shadow root /usr/bin/passwd root set uid /usr/bin/passwd root /bin/ping /bin/ping user: root group: root -r /etc/shadow owner: root group: root -r-s--x--x execve() uid: nobody euid: root 2005/6/2 Copyright (C) 2005 NTT DATA CORPORATION. 5

12 SELinux allow user_t passwd_exec_t : file { getattr execute }; /usr/bin/passwd /usr/bin/passwd passwd_exec_t allow passwd_t passwd_exec_t : file entrypoint; allow user_t passwd_t : process transition; /usr/bin/passwd user_t passwd_t allow passwd_t shadow_t : file { read write append }; /usr/bin/passwd /etc/shadow read /etc/shadow shadow_t 2005/6/2 Copyright (C) 2005 NTT DATA CORPORATION. 11

22 TOMOYO Linux <kernel> <kernel> /sbin/init init <kernel> /sbin/init /etc/rc.d/rc rc <kernel> /sbin/init /etc/rc.d/rc /etc/rc.d/init.d/httpd rc httpd <kernel> /sbin/init /etc/rc.d/rc /etc/rc.d/init.d/httpd /sbin/initlog rc httpd initlog <kernel> /sbin/init /etc/rc.d/rc /etc/rc.d/init.d/sshd rc sshd <kernel> /sbin/init /etc/rc.d/rc /etc/rc.d/init.d/sshd /sbin/initlog rc sshd initlog 2005/6/2 Copyright (C) 2005 NTT DATA CORPORATION. 21

23 TOMOYO Linux <kernle> /sbin/init /etc/rc.d/rc /etc/rc.d/init.d/sshd /sbin/initlog /sbin/initlog /sbin/initlog /bin/mount /etc/rc.d/init.d/httpd /etc/rc.d/init.d/sshd /usr/bin/passwd /bin/date /etc/rc.d/rc.sysinit /etc/rc.d/rc /var/www/cgi-bin/cookie1 /bin/bash /bin/tcsh /sbin/modprobe /sbin/init /usr/sbin/httpd /usr/sbin/sshd <kernel> 2005/6/2 Copyright (C) 2005 NTT DATA CORPORATION. 22

24 TOMOYO Linux <kernel> /usr/sbin/sshd /bin/bash 1 /usr/bin/passwd <kernel> /usr/sbin/sshd /bin/bash /usr/bin/passwd 6 /etc/shadow <kernel> /usr/sbin/sshd /bin/bash 2005/6/2 Copyright (C) 2005 NTT DATA CORPORATION. 23

25 TOMOYO Linux TOMOYO Linux <kernel> /usr/sbin/sshd /bin/bash 1 /usr/bin/passwd <kernel> /usr/sbin/sshd /bin/bash /usr/bin/passwd 6 /etc/shadow SELinux type <kernel> /usr/sbin/sshd /bin/bash, domain; type <kernel> /usr/sbin/sshd /bin/bash /usr/bin/passwd, domain; type /usr/bin/passwd, file_type, exec_type; type /etc/shadow, file_type; domain_auto_trans( <kernel> /usr/sbin/sshd /bin/bash, /usr/bin/passwd, <kernel> /usr/sbin/sshd /bin/bash /usr/bin/passwd ); neverallow <kernel> /usr/sbin/sshd /bin/bash <kernel> /usr/sbin/sshd /bin/bash /usr/bin/passwd :process transition; neverallow <kernel> /usr/sbin/sshd /bin/bash /usr/bin/passwd /usr/bin/passwd :file entrypoint; allow <kernel> /usr/sbin/sshd /bin/bash /usr/bin/passwd /etc/shadow :file { read write }; 2005/6/2 Copyright (C) 2005 NTT DATA CORPORATION. 24

26 TOMOYO Linux bind chroot policy.txt allow_bind.txt cap_policy.txt authorized.txt initializer.txt allow_read.txt chroot.txt mount.txt noumount.txt syaoran.conf 2005/6/2 Copyright (C) 2005 NTT DATA CORPORATION. 25

27 TOMOYO Linux <kernel> 1 /sbin/init <kernel> /sbin/init 6 /dev/console 6 /dev/initctl 6 /dev/tty $ 4 /etc/inittab 6 /etc/ioctl.save 4 /etc/localtime 1 /etc/rc.d/rc 1 /etc/rc.d/rc.sysinit 1 /sbin/mingetty 1 /sbin/shutdown 2 /var/log/wtmp <kernel> /sbin/init --x <kernel> /sbin/init /dev/console rw- /dev/initctl rw- /dev/tty[0-9]* rw- /etc/inittab r-- /etc/ioctl.save rw- /etc/localtime r-- /etc/rc.d/rc --x /etc/rc.d/rc.sysinit --x /sbin/mingetty --x /sbin/shutdown --x /var/log/wtmp -w- /var/run/utmp rw- 2005/6/2 Copyright (C) 2005 NTT DATA CORPORATION. 26

TOMOYO Linux

TOMOYO Linux タスク構造体の拡張によるセキュリティ強化 Linux [ 当日説明用資料 ] 平成 16 年 6 月 3 日株式会社 NTT データ技術開発本部オープンシステムアーキテクチャグループ原田季栄 haradats@nttdata.co.jp Linux セキュリティ上の課題所有者による自由裁量のアクセス制御粗い分類と制御の粒度システム管理者に対しては効力を持たないシステム管理者権限を奪われると歯止め無し