使いこなせて安全なLinuxを目指して

Similar documents
TOMOYO Linuxを体験しよう

CompartmentGuard_Ver3.0-Rev1.0a.doc

明日はじめるSELinux

2

[5] Web HTTP [6] [7] Linux OS TOMOYO Linux OS 2.1 (DAC: Discretionary Access Control) (MAC: Mandatory Access Control) 2 [8] DAC (identi

MAC root Linux 1 OS Linux 2.6 Linux Security Modules LSM [1] Security-Enhanced Linux SELinux [2] AppArmor[3] OS OS OS LSM LSM Performance Monitor LSMP

Docker Haruka Iwao Storage Solution Architect, Red Hat K.K. February 12, 2015

目次 Hardened Gentoo での SELinux の導入 導入するときの注意点 Hardened Gentoo と Fedora Core 4 との違い例題 : id_t, id_exec をつくってみる SETools の活用法 Apol seaudit Reference Policy

(1)

section 1 1 Copyright 2008 NTT DATA KYUSHU CORPORATION

Samba_HowTo.doc

_‚Ofl¼

untitled

TOMOYO LinuxでLinuxの動きを見てみよう

Market( ) Market 2

ExpressUpdate Agent インストレーションガイド

インストール取扱説明書

1 1 CentOS Java JDK(JavaSE Development Kit)......

PRIMEQUEST 1000シリーズ Linux設計ガイド

スライド 1

自動シャットタ<3099>ウンクイックインストールカ<3099>イト<3099>.indb

防災マップ作成システムの開発業務基本設計書

SE-PostgreSQL Linux SELinux Security-Enhanced PostgreSQL

Xen入門 ppt

Xen入門 ppt

ExpressUpdate Agent インストレーションガイド

etrust Access Control etrust Access Control UNIX(Linux, Windows) 2

untitled

tomo_sp1

2. (297) 91 (365) (366) (371) (673) (938) (64) 85 (91) (631) (561) (302) (616) 63 (906) 68 (338) (714) (747) (169) (718) 62 (1,063) 67 (714) (169) (90

2. (1,009) 45 (368) (226) (133) (54) (260) 25 (446) 30 (774) (156) (805) (244) (652) 22 (128) (652) (157) (597) (805) (446) 30 (774) 35 (238) (581) (1

2 3


<834E C F D E657073>

DNS (BIND, djbdns) JPNIC・JPCERT/CC Security Seminar 2005

cover1.indd

debian_manual.dvi

Oracle Identity Managementの概要およびアーキテクチャ

Information Security Management System ISO/IEC 27001:2005 ISMS A Copyright JIPDEC ISMS,

01.12期・井須英次1.doc

1.3期・井上健0.doc

オペレーティングシステム2003 第2回:

INR-HG5290b_users_Linux-RHEL4_.doc

日本Sambaユーザ会 次年度活動計画案

DNSを「きちんと」設定しよう

1



unix.dvi

new_emc_panf_Hyoushi_0818

sanboot-whitepaper.pdf

Evalution of Linux Container(LXC) on Embedded Linux 株式会社富士通コンピュータテクノロジーズ町田裕樹 1201ka01 Copyright 2013 FUJITSU COMPUTER TECHLONOGIES LIMITED

Microsoft Word - 教材ガイド一覧ビデオ.doc

クララパンフレット2011冬1P-P40

i HTTP Basi

名称未設定

HP ProLiant Gen8とRed Hatで始めるHadoop™ ~Hadoop™スタートアップ支援サービス~

橡07第1章1_H160203_.PDF

untitled

Linux上のOracle Real Application Clustersの記憶領域オプション

Northern Lights Server

タイプ継承を可能にするSELinuxポリシーコンパイラの拡張

名称未設定

ExpressUpdate Agent インストレーションマニュアル

Transcription:

haradats@nttdata.co.jp

Linux Linux(DAC) 2005/6/2 Copyright (C) 2005 NTT DATA CORPORATION. 1

Linux Linux NO SELinux Yes 2005/6/2 Copyright (C) 2005 NTT DATA CORPORATION. 2

2005/6/2 Copyright (C) 2005 NTT DATA CORPORATION. 3

SELinux Linux 2.6 SELinux (2003.8) Fedora Core 3, Red Hat Enterprise Linux 4.0 SELinux SELinux 2005/6/2 Copyright (C) 2005 NTT DATA CORPORATION. 4

Linux /bin/bash /usr/bin/passwd /usr/bin/passwd uid: harada euid: harada fork() owner: root group: root -r-s--x--x execve() uid: harada euid: root /etc/shadow root /usr/bin/passwd root set uid /usr/bin/passwd root /bin/ping /bin/ping user: root group: root -r-------- /etc/shadow owner: root group: root -r-s--x--x execve() uid: nobody euid: root 2005/6/2 Copyright (C) 2005 NTT DATA CORPORATION. 5

SELinux (TE) 2005/6/2 Copyright (C) 2005 NTT DATA CORPORATION. 6

SELinux (RBAC) SELinux TE RBAC (Role-Based Access Control) 2005/6/2 Copyright (C) 2005 NTT DATA CORPORATION. 7

SELinux TE : Type Enforcement Access Vector RBAC : Role-Based Access Control SELinux RBAC 2005/6/2 Copyright (C) 2005 NTT DATA CORPORATION. 8

SELinux execve() sysadm_t staff_t user_t sysadm_t httpd_t sshd_t kernel_t init_t initrc_t 2005/6/2 Copyright (C) 2005 NTT DATA CORPORATION. 9

SELinux allow passwd_t shadow_t : file {read write }; 2005/6/2 Copyright (C) 2005 NTT DATA CORPORATION. 10

SELinux allow user_t passwd_exec_t : file { getattr execute }; /usr/bin/passwd /usr/bin/passwd passwd_exec_t allow passwd_t passwd_exec_t : file entrypoint; allow user_t passwd_t : process transition; /usr/bin/passwd user_t passwd_t allow passwd_t shadow_t : file { read write append }; /usr/bin/passwd /etc/shadow read /etc/shadow shadow_t 2005/6/2 Copyright (C) 2005 NTT DATA CORPORATION. 11

SELinux permissive RSA 2005 Frank Mayer Don t use it! enforcing SELinux 2005/6/2 Copyright (C) 2005 NTT DATA CORPORATION. 12

SELinux 2005/6/2 Copyright (C) 2005 NTT DATA CORPORATION. 13

SELinux MITRE Tresys SELinux New Reference Policy Project Mayer RSA NTT Linux TOMOYO Linux 2005/6/2 Copyright (C) 2005 NTT DATA CORPORATION. 14

TOMOYO Linux 2005/6/2 Copyright (C) 2005 NTT DATA CORPORATION. 15

TOMOYO Linux Linux Linux Conference 2003 <http://lc.linux.or.jp/lc2003/30.html> 2004 http://www.jnsa.org/seminar_20041101.html Samba Java Web /dev Linux /dev 2005/6/2 Copyright (C) 2005 NTT DATA CORPORATION. 16

TOMOYO Linux Network Security Forum 2003 <http://www.jnsa.org/award/2003/result.html> Linux /sbin/init SubDomain TOMOYO Linux- Linux Linux Conference 2004 <http://lc.linux.or.jp/lc2004/03.html> TOMOYO Linux 2005/6/2 Copyright (C) 2005 NTT DATA CORPORATION. 17

TOMOYO Linux LC2004 (SAKURA) 2.6 (SYAORAN) 2005/6/2 Copyright (C) 2005 NTT DATA CORPORATION. 18

TOMOYO Linux execve SELinux read, write, execute SELinux 2005/6/2 Copyright (C) 2005 NTT DATA CORPORATION. 19

TOMOYO Linux 2005/6/2 Copyright (C) 2005 NTT DATA CORPORATION. 20

TOMOYO Linux <kernel> <kernel> /sbin/init init <kernel> /sbin/init /etc/rc.d/rc rc <kernel> /sbin/init /etc/rc.d/rc /etc/rc.d/init.d/httpd rc httpd <kernel> /sbin/init /etc/rc.d/rc /etc/rc.d/init.d/httpd /sbin/initlog rc httpd initlog <kernel> /sbin/init /etc/rc.d/rc /etc/rc.d/init.d/sshd rc sshd <kernel> /sbin/init /etc/rc.d/rc /etc/rc.d/init.d/sshd /sbin/initlog rc sshd initlog 2005/6/2 Copyright (C) 2005 NTT DATA CORPORATION. 21

TOMOYO Linux <kernle> /sbin/init /etc/rc.d/rc /etc/rc.d/init.d/sshd /sbin/initlog /sbin/initlog /sbin/initlog /bin/mount /etc/rc.d/init.d/httpd /etc/rc.d/init.d/sshd /usr/bin/passwd /bin/date /etc/rc.d/rc.sysinit /etc/rc.d/rc /var/www/cgi-bin/cookie1 /bin/bash /bin/tcsh /sbin/modprobe /sbin/init /usr/sbin/httpd /usr/sbin/sshd <kernel> 2005/6/2 Copyright (C) 2005 NTT DATA CORPORATION. 22

TOMOYO Linux <kernel> /usr/sbin/sshd /bin/bash 1 /usr/bin/passwd <kernel> /usr/sbin/sshd /bin/bash /usr/bin/passwd 6 /etc/shadow <kernel> /usr/sbin/sshd /bin/bash 2005/6/2 Copyright (C) 2005 NTT DATA CORPORATION. 23

TOMOYO Linux TOMOYO Linux <kernel> /usr/sbin/sshd /bin/bash 1 /usr/bin/passwd <kernel> /usr/sbin/sshd /bin/bash /usr/bin/passwd 6 /etc/shadow SELinux type <kernel> /usr/sbin/sshd /bin/bash, domain; type <kernel> /usr/sbin/sshd /bin/bash /usr/bin/passwd, domain; type /usr/bin/passwd, file_type, exec_type; type /etc/shadow, file_type; domain_auto_trans( <kernel> /usr/sbin/sshd /bin/bash, /usr/bin/passwd, <kernel> /usr/sbin/sshd /bin/bash /usr/bin/passwd ); neverallow <kernel> /usr/sbin/sshd /bin/bash <kernel> /usr/sbin/sshd /bin/bash /usr/bin/passwd :process transition; neverallow <kernel> /usr/sbin/sshd /bin/bash /usr/bin/passwd /usr/bin/passwd :file entrypoint; allow <kernel> /usr/sbin/sshd /bin/bash /usr/bin/passwd /etc/shadow :file { read write }; 2005/6/2 Copyright (C) 2005 NTT DATA CORPORATION. 24

TOMOYO Linux bind chroot policy.txt allow_bind.txt cap_policy.txt authorized.txt initializer.txt allow_read.txt chroot.txt mount.txt noumount.txt syaoran.conf 2005/6/2 Copyright (C) 2005 NTT DATA CORPORATION. 25

TOMOYO Linux <kernel> 1 /sbin/init <kernel> /sbin/init 6 /dev/console 6 /dev/initctl 6 /dev/tty $ 4 /etc/inittab 6 /etc/ioctl.save 4 /etc/localtime 1 /etc/rc.d/rc 1 /etc/rc.d/rc.sysinit 1 /sbin/mingetty 1 /sbin/shutdown 2 /var/log/wtmp <kernel> /sbin/init --x <kernel> /sbin/init /dev/console rw- /dev/initctl rw- /dev/tty[0-9]* rw- /etc/inittab r-- /etc/ioctl.save rw- /etc/localtime r-- /etc/rc.d/rc --x /etc/rc.d/rc.sysinit --x /sbin/mingetty --x /sbin/shutdown --x /var/log/wtmp -w- /var/run/utmp rw- 2005/6/2 Copyright (C) 2005 NTT DATA CORPORATION. 26

Linux rpm SELinux Targeted 2005/6/2 Copyright (C) 2005 NTT DATA CORPORATION. 27

TOMOYO Linux TOMOYO Linux 2005/6/2 Copyright (C) 2005 NTT DATA CORPORATION. 28

Linux /dev/sda /dev/null /dev (SYAORAN) /dev 2005/6/2 Copyright (C) 2005 NTT DATA CORPORATION. 29

TOMOYO Linux 2005/6/2 Copyright (C) 2005 NTT DATA CORPORATION. 30

TOMOYO Linux TOMOYO Linux SELinux RBAC (Role-Based Access Control) 2005/6/2 Copyright (C) 2005 NTT DATA CORPORATION. 31

TOMOYO Linux TOMOYO Linux SELinuxsshd ssh 2005/6/2 Copyright (C) 2005 NTT DATA CORPORATION. 32

TOMOYO Linux RBAC TOMOYO Linux SELinux RBAC (Role-Based Access Control) tcsh bash 2005/6/2 Copyright (C) 2005 NTT DATA CORPORATION. 33

ssh root root 2005/6/2 Copyright (C) 2005 NTT DATA CORPORATION. 34

2005/6/2 Copyright (C) 2005 NTT DATA CORPORATION. 35

root RBAC zsh Web zsh tcsh emacs tcsh bash bash 2005/6/2 Copyright (C) 2005 NTT DATA CORPORATION. 36

RBAC emacs Web 2005/6/2 Copyright (C) 2005 NTT DATA CORPORATION. 37

TOMOYO Linux Linux SELinux SELinux TOMOYO Linux 2005/6/2 Copyright (C) 2005 NTT DATA CORPORATION. 38

2005 5 11 SELinux Frank Mayer Mayer SELinux TOMOYO Linux TOMOYO Linux TOMOYO Linux tomoyo-support@kits.nttdata.co.jp 2005/6/2 Copyright (C) 2005 NTT DATA CORPORATION. 39