コンピュータシステムシンポジウム Computer System Symposium ComSys /12/1 SELinux SELinux SELinux SELinux Proposal of a Method to Automatically Reduce Redundan

Size: px

Start display at page:

Download "コンピュータシステムシンポジウム Computer System Symposium ComSys /12/1 SELinux SELinux SELinux SELinux Proposal of a Method to Automatically Reduce Redundan"

もえりうすい
5 years ago
Views:

1 SELinux SELinux SELinux SELinux Proposal of a Method to Automatically Reduce Redundant Security Policy of SELinux Shinya Yagi, Yuichi Nakamura and Toshihiro Yamauchi In many cases, general security policy is used because of the difficulty of creating security policy. However, general security policy is possible to allow excessive rights in system. In addition, it is difficult to use this security policy in embedded systems because of the memory footprint. To deal with these problems, we propose a method system automatically detects redundant security policies by using log SELinux outputs and deletes them. The proposed system also suggests system administrator and improves security of the system and reduces the memory footprint. This paper shows the problems of security policy and dealing with them. This paper also shows design and evaluation. 1. Security- Enhanced Linux SELinux 1) OS SELinux Graduate School of Natural Science and Technology, Okayama University Hitachi Solutions ( ) 5MB 2) SELinux Policy Editor SEEdit 3)4) SLIDE 5) SEEdit Simplified Policy Description Language SEEdit SELinux Linux SLIDE Reference Policy refpolicy 6) Eclipse 84

2 SEEdit SLIDE 1000 SELinux 2. SELinux 2.1 SELinux SELinux National Security Agency OS OS (Mandatory Access Control: MAC) (Least Privilege) OS MAC OS SELinux Multi Level Security Role Based Access Control Type Enforcement 7) 2.2 SELinux refpolicy SELinux policyrule: allow auditallow dontaudit neverallow subj tobj t tclass av policyrule subj t obj t:tclass{av}; allow auditallow read write refpolicy refpolicy Fedora CentOS refpolicy refpolicy targeted strict refpolicy 3 ( 1 ) fc file context ( 2 ) if interface ( 3 ) te type enforcement fc if te te 2.3 SELinux SELinux 3 8) ( 1 ) ( 2 ) 700 ( 3 ) SELinux 85

3 SELinux Fedora 13 (refpolicy) 5.6MB 3. SELinux 3.1 SELinux refpolicy SELinux SELinux SELinux 3.2 ( 1 ) ( 2 ) Linux Auditing System ( 1 ) ( 2 ) ( 3 ) ( 4 ) SELinux ( 1 ) SELinux ( 2 ) Linux Auditing System audit dispatcher daemon audispd 86

4 Linux Auditing System 管理用ポリシポリシのソースファイル (1) audispd auditd kauditd SELinux (3) (2) 1 Fig. 1 (8) 比較部 (4) ログ変換部 (5) System Overview 管理者 (6) ポリシ修正提案部 (7) ポリシ処理の流れデータの流れユーザ空間カーネル空間 ( 3 ) ( 4 ) (2) (3) ( 5 ) ( 6 ) ( 7 ) ( 8 ) ( 1 ) SELinux ( 2 ) audispd ( 3 ) ( 4 ) ( 5 ) ( 6 ) audispd ( 1 ) audispd ( 2 ) ( 3 ) ( 1) auditallow ( 2) audit backlog auditallow ( 3) ( 1 ) ( a ) ( b ) ( c ) ( 2 ) ( a ) 87

5 1 Table 1 Specifications of Command modify policy -a -d -e -f -l -m ( b ) ( c ) ( 4).te.if.fc m4 9) 3.te.if.tmp.te.if m ( 1 ) ( 2 ) ( 3 ) 1 modify policy ( 5) ( 1 ) module= subj= obj= allow subj t obj t:tclass{av}; ( 2 ) subj= obj= syscall= allow subj t obj t:tclass{av}; 3.4 refpolicy refpolicy GUI ( 1 ) ( 2 ) ( 3 ) ( 4 ) ( 5 ) ( 6 ) 3.5 ( 1 ) ( 2 ) SELinux 88

6 SELinux refpolicy SELinux refpolicy ( 3 ) ( 1 ) allow ( 2 ) 1 ( 3 ) ( 4 ) ( 5 ) ( 6 ) (1) (5) Linux fc13.i686.PAE Fedora 13 CPU Pentium GHz 512MB selinux-policy-targeted fc13 (6) Linux CPU SH7760 (SH4) 200MHz SDRAM 64MB Linux fc7 CPU Pentium 4 3GHz 1GB refpolicy allow allow refpolicy base base 2 HTTP FTP DNS 2 allow allow HTTP FTPNTP 89

7 2 Table 2 Amount of Reduced Policy (%) (B) 5,852,591 1,074, ,083 1, allow 271,296 49, Table 3 Detail of Reduced Policy (B) 4,778,510 4,455, ,096 1,666 1,666 0 allow 222, ,167 26,840 4 Table 4 Log Size (KB(MB)) (KB) 1 101,057(98.7) ,273(180.9) ,942(234.3) ,244(272.7) ,769(331.8) ,730(435.3) ,954(505.8) 35.0 Google Chrome httpd t apache apache squid t squid 4 allow httpd_t httpd_t:capability { kill }; allow httpd_t httpd_t:process { signal }; allow httpd_t httpd_t:sem { destroy }; allow httpd_t httpd_var_run_t:file { write }; allow smbd_t devlog_t:sock_file { write }; allow smbd_t smbd_t:unix_dgram_socket { connect create }; allow squid_t logrotate_t:fd { use }; allow squid_t squid_log_t:dir { add_name remove_name search }; allow squid_t squid_log_t:file { rename setattr }; allow squid_t squid_t:process { signal }; allow squid_t system_cronjob_t:fd { use }; 2 Fig. 2 Difference of the Log 5 Table 5 Rate of Reduced Policy (%) apache chrome ftp ntp samba squid % read search getattr open write 7 lock ioctl getattr open read r file perms refpolicy 90

8 6 Table 6 Detail of Needed Access Vector Permission 5 apache read(21) search(21) getattr(15) open(13) write(8) chrome read(21) search(12) getattr(11) open(8) write(6) ftp read(20) getattr(16) search(13) open(11) write(10) ntp getattr(13) read(13) search(11) open(10) write(9) samba search(33) read(29) getattr(26) write(21) open(20) squid read(23) getattr(18) search(17) open(13) write(8) read(127) search(107) getattr(99) open(75) write(62) 7 Table 7 Detail of Unneeded Access Vector Permission 5 apache ioctl(38) lock(38) getattr(32) open(23) read(23) chrome lock(22) ioctl(21) getattr(19) open(15) read(6) ftp ioctl(26) lock(26) getattr(23) open(17) read(13) ntp lock(25) ioctl(23) getattr(16) open(13) read(13) samba ioctl(49) lock(47) getattr(44) open(37) read(27) squid ioctl(30) lock(30) getattr(22) open(16) read(15) lock(188) ioctl(177) getattr(156) open(121) read(97) refpolicy abrtd 1 abrtd 4 abrtd 10 4 ( 1) abrt ( 2) abrt ( 3) abrt ( 4) abrt ( 1) abrtd abrtd ( 2) abrtd ( 3) abrtd ( 4) abrtd 8 ( 1) ( 4) (110%) ( 1) ( 3) (39%) audispd ( 2) ( 4) (1%) abrtd

9 8 Table 8 Overhead of The Proposal Method ( 1) 0.477s ( 3) 0.344s ( 2) 0.229s ( 4) 0.227s 9 ApacheBench Table 9 Result of ApacheBench (n=10000) (s) (s) (%) c= c= ApacheBench Apache Apache ApacheBench Apache Apache apache ApacheBench n c (70.73%) ApacheBench 70% 8 100% 4.6 ( 1 ) ( 2 ) m4 ( 3 ) ( 4 ) m4 m ( 1 ) modify policy 1 ( 2 ) ( 3 ) Yes No ( 4 ) Yes No 4.7 CAT syslogd syslogd 1 syslogd % 5 syslogd 92

10 syslogd 5. 10) 11) 10) 11) strace 12) 13) 12) SELinux 13) GUI SELinux 11) 6. SELinux SELinux 8 100% 1) NSA: Security-Enhanced Linux. 2) Nakamura, Y. and Sameshima, Y.: SELinux for Consumer Electronics Devices, Proceeding of the Linux Symposium (2008). 3) SELinux Policy Editor Project: SELinux Policy Editor. 4) Nakamura, Y., Sameshima, Y. and Yamauchi, T.: SELinux Security Policy Configuration System with Higher Level Language, Journal of Information Processing, Vol. 18, pp (2010). 5) Tresys Technology: SELinux Policy IDE (SLIDE). 6) Tresys Technology: SELinux Reference Policy. 7) : Linux : 2 SELinux,, Vol. 51, No. 10, pp (2010). 8), : Linux : 3,, Vol. 51, No. 10, pp (2010). 9) GNU Project: GNU m

11 10),, :, Network Security Forum 2003 (2003). 11) Marouf, S., Phuong, D. M. and Shehab, M.: A Learning-Based Approach for SELinux Policy Optimization with Type Mining, Proceedings of the Sixth Annual Workshop on Cyber Security and Information Intelligence Research (CSIIRW 10) (2010). 12) Yokoyama, T., Hanaoka, M., Shimamura, M., Kono, K. and Shinagawa, T.: Reducing Security Policy Size for Internet Servers in Secure Operating Systems, IEICE Transactions on Information and Systems, Vol. E92-D, No. 11, pp (2009). 13), : SELinux, Japan Linux Conference : 1 (2007). 94

MAC root Linux 1 OS Linux 2.6 Linux Security Modules LSM [1] Security-Enhanced Linux SELinux [2] AppArmor[3] OS OS OS LSM LSM Performance Monitor LSMP

MAC root Linux 1 OS Linux 2.6 Linux Security Modules LSM [1] Security-Enhanced Linux SELinux [2] AppArmor[3] OS OS OS LSM LSM Performance Monitor LSMP LSM OS 700-8530 3 1 1 matsuda@swlab.it.okayama-u.ac.jp tabata@cs.okayama-u.ac.jp 242-8502 1623 14 munetoh@jp.ibm.com OS Linux 2.6 Linux Security Modules LSM LSM Linux 4 OS OS LSM An Evaluation of Performance

コンピュータシステム シンポジウム Computer System Symposium ComSys /12/1 SELinux SELinux SELinux SELinux Proposal of a Method to Automatically Reduce Redundan

コンピュータシステムシンポジウム Computer System Symposium ComSys /12/1 SELinux SELinux SELinux SELinux Proposal of a Method to Automatically Reduce Redundan