haradats@nttdata.co.jp
Linux Linux(DAC) 2005/6/2 Copyright (C) 2005 NTT DATA CORPORATION. 1
Linux Linux NO SELinux Yes 2005/6/2 Copyright (C) 2005 NTT DATA CORPORATION. 2
2005/6/2 Copyright (C) 2005 NTT DATA CORPORATION. 3
SELinux Linux 2.6 SELinux (2003.8) Fedora Core 3, Red Hat Enterprise Linux 4.0 SELinux SELinux 2005/6/2 Copyright (C) 2005 NTT DATA CORPORATION. 4
Linux /bin/bash /usr/bin/passwd /usr/bin/passwd uid: harada euid: harada fork() owner: root group: root -r-s--x--x execve() uid: harada euid: root /etc/shadow root /usr/bin/passwd root set uid /usr/bin/passwd root /bin/ping /bin/ping user: root group: root -r-------- /etc/shadow owner: root group: root -r-s--x--x execve() uid: nobody euid: root 2005/6/2 Copyright (C) 2005 NTT DATA CORPORATION. 5
SELinux (TE) 2005/6/2 Copyright (C) 2005 NTT DATA CORPORATION. 6
SELinux (RBAC) SELinux TE RBAC (Role-Based Access Control) 2005/6/2 Copyright (C) 2005 NTT DATA CORPORATION. 7
SELinux TE : Type Enforcement Access Vector RBAC : Role-Based Access Control SELinux RBAC 2005/6/2 Copyright (C) 2005 NTT DATA CORPORATION. 8
SELinux execve() sysadm_t staff_t user_t sysadm_t httpd_t sshd_t kernel_t init_t initrc_t 2005/6/2 Copyright (C) 2005 NTT DATA CORPORATION. 9
SELinux allow passwd_t shadow_t : file {read write }; 2005/6/2 Copyright (C) 2005 NTT DATA CORPORATION. 10
SELinux allow user_t passwd_exec_t : file { getattr execute }; /usr/bin/passwd /usr/bin/passwd passwd_exec_t allow passwd_t passwd_exec_t : file entrypoint; allow user_t passwd_t : process transition; /usr/bin/passwd user_t passwd_t allow passwd_t shadow_t : file { read write append }; /usr/bin/passwd /etc/shadow read /etc/shadow shadow_t 2005/6/2 Copyright (C) 2005 NTT DATA CORPORATION. 11
SELinux permissive RSA 2005 Frank Mayer Don t use it! enforcing SELinux 2005/6/2 Copyright (C) 2005 NTT DATA CORPORATION. 12
SELinux 2005/6/2 Copyright (C) 2005 NTT DATA CORPORATION. 13
SELinux MITRE Tresys SELinux New Reference Policy Project Mayer RSA NTT Linux TOMOYO Linux 2005/6/2 Copyright (C) 2005 NTT DATA CORPORATION. 14
TOMOYO Linux 2005/6/2 Copyright (C) 2005 NTT DATA CORPORATION. 15
TOMOYO Linux Linux Linux Conference 2003 <http://lc.linux.or.jp/lc2003/30.html> 2004 http://www.jnsa.org/seminar_20041101.html Samba Java Web /dev Linux /dev 2005/6/2 Copyright (C) 2005 NTT DATA CORPORATION. 16
TOMOYO Linux Network Security Forum 2003 <http://www.jnsa.org/award/2003/result.html> Linux /sbin/init SubDomain TOMOYO Linux- Linux Linux Conference 2004 <http://lc.linux.or.jp/lc2004/03.html> TOMOYO Linux 2005/6/2 Copyright (C) 2005 NTT DATA CORPORATION. 17
TOMOYO Linux LC2004 (SAKURA) 2.6 (SYAORAN) 2005/6/2 Copyright (C) 2005 NTT DATA CORPORATION. 18
TOMOYO Linux execve SELinux read, write, execute SELinux 2005/6/2 Copyright (C) 2005 NTT DATA CORPORATION. 19
TOMOYO Linux 2005/6/2 Copyright (C) 2005 NTT DATA CORPORATION. 20
TOMOYO Linux <kernel> <kernel> /sbin/init init <kernel> /sbin/init /etc/rc.d/rc rc <kernel> /sbin/init /etc/rc.d/rc /etc/rc.d/init.d/httpd rc httpd <kernel> /sbin/init /etc/rc.d/rc /etc/rc.d/init.d/httpd /sbin/initlog rc httpd initlog <kernel> /sbin/init /etc/rc.d/rc /etc/rc.d/init.d/sshd rc sshd <kernel> /sbin/init /etc/rc.d/rc /etc/rc.d/init.d/sshd /sbin/initlog rc sshd initlog 2005/6/2 Copyright (C) 2005 NTT DATA CORPORATION. 21
TOMOYO Linux <kernle> /sbin/init /etc/rc.d/rc /etc/rc.d/init.d/sshd /sbin/initlog /sbin/initlog /sbin/initlog /bin/mount /etc/rc.d/init.d/httpd /etc/rc.d/init.d/sshd /usr/bin/passwd /bin/date /etc/rc.d/rc.sysinit /etc/rc.d/rc /var/www/cgi-bin/cookie1 /bin/bash /bin/tcsh /sbin/modprobe /sbin/init /usr/sbin/httpd /usr/sbin/sshd <kernel> 2005/6/2 Copyright (C) 2005 NTT DATA CORPORATION. 22
TOMOYO Linux <kernel> /usr/sbin/sshd /bin/bash 1 /usr/bin/passwd <kernel> /usr/sbin/sshd /bin/bash /usr/bin/passwd 6 /etc/shadow <kernel> /usr/sbin/sshd /bin/bash 2005/6/2 Copyright (C) 2005 NTT DATA CORPORATION. 23
TOMOYO Linux TOMOYO Linux <kernel> /usr/sbin/sshd /bin/bash 1 /usr/bin/passwd <kernel> /usr/sbin/sshd /bin/bash /usr/bin/passwd 6 /etc/shadow SELinux type <kernel> /usr/sbin/sshd /bin/bash, domain; type <kernel> /usr/sbin/sshd /bin/bash /usr/bin/passwd, domain; type /usr/bin/passwd, file_type, exec_type; type /etc/shadow, file_type; domain_auto_trans( <kernel> /usr/sbin/sshd /bin/bash, /usr/bin/passwd, <kernel> /usr/sbin/sshd /bin/bash /usr/bin/passwd ); neverallow <kernel> /usr/sbin/sshd /bin/bash <kernel> /usr/sbin/sshd /bin/bash /usr/bin/passwd :process transition; neverallow <kernel> /usr/sbin/sshd /bin/bash /usr/bin/passwd /usr/bin/passwd :file entrypoint; allow <kernel> /usr/sbin/sshd /bin/bash /usr/bin/passwd /etc/shadow :file { read write }; 2005/6/2 Copyright (C) 2005 NTT DATA CORPORATION. 24
TOMOYO Linux bind chroot policy.txt allow_bind.txt cap_policy.txt authorized.txt initializer.txt allow_read.txt chroot.txt mount.txt noumount.txt syaoran.conf 2005/6/2 Copyright (C) 2005 NTT DATA CORPORATION. 25
TOMOYO Linux <kernel> 1 /sbin/init <kernel> /sbin/init 6 /dev/console 6 /dev/initctl 6 /dev/tty $ 4 /etc/inittab 6 /etc/ioctl.save 4 /etc/localtime 1 /etc/rc.d/rc 1 /etc/rc.d/rc.sysinit 1 /sbin/mingetty 1 /sbin/shutdown 2 /var/log/wtmp <kernel> /sbin/init --x <kernel> /sbin/init /dev/console rw- /dev/initctl rw- /dev/tty[0-9]* rw- /etc/inittab r-- /etc/ioctl.save rw- /etc/localtime r-- /etc/rc.d/rc --x /etc/rc.d/rc.sysinit --x /sbin/mingetty --x /sbin/shutdown --x /var/log/wtmp -w- /var/run/utmp rw- 2005/6/2 Copyright (C) 2005 NTT DATA CORPORATION. 26
Linux rpm SELinux Targeted 2005/6/2 Copyright (C) 2005 NTT DATA CORPORATION. 27
TOMOYO Linux TOMOYO Linux 2005/6/2 Copyright (C) 2005 NTT DATA CORPORATION. 28
Linux /dev/sda /dev/null /dev (SYAORAN) /dev 2005/6/2 Copyright (C) 2005 NTT DATA CORPORATION. 29
TOMOYO Linux 2005/6/2 Copyright (C) 2005 NTT DATA CORPORATION. 30
TOMOYO Linux TOMOYO Linux SELinux RBAC (Role-Based Access Control) 2005/6/2 Copyright (C) 2005 NTT DATA CORPORATION. 31
TOMOYO Linux TOMOYO Linux SELinuxsshd ssh 2005/6/2 Copyright (C) 2005 NTT DATA CORPORATION. 32
TOMOYO Linux RBAC TOMOYO Linux SELinux RBAC (Role-Based Access Control) tcsh bash 2005/6/2 Copyright (C) 2005 NTT DATA CORPORATION. 33
ssh root root 2005/6/2 Copyright (C) 2005 NTT DATA CORPORATION. 34
2005/6/2 Copyright (C) 2005 NTT DATA CORPORATION. 35
root RBAC zsh Web zsh tcsh emacs tcsh bash bash 2005/6/2 Copyright (C) 2005 NTT DATA CORPORATION. 36
RBAC emacs Web 2005/6/2 Copyright (C) 2005 NTT DATA CORPORATION. 37
TOMOYO Linux Linux SELinux SELinux TOMOYO Linux 2005/6/2 Copyright (C) 2005 NTT DATA CORPORATION. 38
2005 5 11 SELinux Frank Mayer Mayer SELinux TOMOYO Linux TOMOYO Linux TOMOYO Linux tomoyo-support@kits.nttdata.co.jp 2005/6/2 Copyright (C) 2005 NTT DATA CORPORATION. 39