使いこなせて安全なLinuxを目指して

Size: px

Start display at page:

Download "使いこなせて安全なLinuxを目指して"

みさえかみいしづ
7 years ago
Views:

6 Linux /bin/bash /usr/bin/passwd /usr/bin/passwd uid: harada euid: harada fork() owner: root group: root -r-s--x--x execve() uid: harada euid: root /etc/shadow root /usr/bin/passwd root set uid /usr/bin/passwd root /bin/ping /bin/ping user: root group: root -r /etc/shadow owner: root group: root -r-s--x--x execve() uid: nobody euid: root 2005/6/2 Copyright (C) 2005 NTT DATA CORPORATION. 5

12 SELinux allow user_t passwd_exec_t : file { getattr execute }; /usr/bin/passwd /usr/bin/passwd passwd_exec_t allow passwd_t passwd_exec_t : file entrypoint; allow user_t passwd_t : process transition; /usr/bin/passwd user_t passwd_t allow passwd_t shadow_t : file { read write append }; /usr/bin/passwd /etc/shadow read /etc/shadow shadow_t 2005/6/2 Copyright (C) 2005 NTT DATA CORPORATION. 11

22 TOMOYO Linux <kernel> <kernel> /sbin/init init <kernel> /sbin/init /etc/rc.d/rc rc <kernel> /sbin/init /etc/rc.d/rc /etc/rc.d/init.d/httpd rc httpd <kernel> /sbin/init /etc/rc.d/rc /etc/rc.d/init.d/httpd /sbin/initlog rc httpd initlog <kernel> /sbin/init /etc/rc.d/rc /etc/rc.d/init.d/sshd rc sshd <kernel> /sbin/init /etc/rc.d/rc /etc/rc.d/init.d/sshd /sbin/initlog rc sshd initlog 2005/6/2 Copyright (C) 2005 NTT DATA CORPORATION. 21

23 TOMOYO Linux <kernle> /sbin/init /etc/rc.d/rc /etc/rc.d/init.d/sshd /sbin/initlog /sbin/initlog /sbin/initlog /bin/mount /etc/rc.d/init.d/httpd /etc/rc.d/init.d/sshd /usr/bin/passwd /bin/date /etc/rc.d/rc.sysinit /etc/rc.d/rc /var/www/cgi-bin/cookie1 /bin/bash /bin/tcsh /sbin/modprobe /sbin/init /usr/sbin/httpd /usr/sbin/sshd <kernel> 2005/6/2 Copyright (C) 2005 NTT DATA CORPORATION. 22

24 TOMOYO Linux <kernel> /usr/sbin/sshd /bin/bash 1 /usr/bin/passwd <kernel> /usr/sbin/sshd /bin/bash /usr/bin/passwd 6 /etc/shadow <kernel> /usr/sbin/sshd /bin/bash 2005/6/2 Copyright (C) 2005 NTT DATA CORPORATION. 23

25 TOMOYO Linux TOMOYO Linux <kernel> /usr/sbin/sshd /bin/bash 1 /usr/bin/passwd <kernel> /usr/sbin/sshd /bin/bash /usr/bin/passwd 6 /etc/shadow SELinux type <kernel> /usr/sbin/sshd /bin/bash, domain; type <kernel> /usr/sbin/sshd /bin/bash /usr/bin/passwd, domain; type /usr/bin/passwd, file_type, exec_type; type /etc/shadow, file_type; domain_auto_trans( <kernel> /usr/sbin/sshd /bin/bash, /usr/bin/passwd, <kernel> /usr/sbin/sshd /bin/bash /usr/bin/passwd ); neverallow <kernel> /usr/sbin/sshd /bin/bash <kernel> /usr/sbin/sshd /bin/bash /usr/bin/passwd :process transition; neverallow <kernel> /usr/sbin/sshd /bin/bash /usr/bin/passwd /usr/bin/passwd :file entrypoint; allow <kernel> /usr/sbin/sshd /bin/bash /usr/bin/passwd /etc/shadow :file { read write }; 2005/6/2 Copyright (C) 2005 NTT DATA CORPORATION. 24

26 TOMOYO Linux bind chroot policy.txt allow_bind.txt cap_policy.txt authorized.txt initializer.txt allow_read.txt chroot.txt mount.txt noumount.txt syaoran.conf 2005/6/2 Copyright (C) 2005 NTT DATA CORPORATION. 25

27 TOMOYO Linux <kernel> 1 /sbin/init <kernel> /sbin/init 6 /dev/console 6 /dev/initctl 6 /dev/tty $ 4 /etc/inittab 6 /etc/ioctl.save 4 /etc/localtime 1 /etc/rc.d/rc 1 /etc/rc.d/rc.sysinit 1 /sbin/mingetty 1 /sbin/shutdown 2 /var/log/wtmp <kernel> /sbin/init --x <kernel> /sbin/init /dev/console rw- /dev/initctl rw- /dev/tty[0-9]* rw- /etc/inittab r-- /etc/ioctl.save rw- /etc/localtime r-- /etc/rc.d/rc --x /etc/rc.d/rc.sysinit --x /sbin/mingetty --x /sbin/shutdown --x /var/log/wtmp -w- /var/run/utmp rw- 2005/6/2 Copyright (C) 2005 NTT DATA CORPORATION. 26

TOMOYO Linuxを体験しよう

TOMOYO Linuxを体験しよう TOMOYO Linux を体験しよう 2.1. TOMOYO Linux についてポイント! TOMOYO Linux は誰でも使えるセキュア OS を目指して開発された国産のセキュア OS です SELinux はもともと軍事政府向けに開発されていること特に CC 認証を取得することを目的としていることもあり使い勝手の面ではあまりよくありませんでしたそこで誰でもつかえるセキュア OS