toward automated authorization policy enforcement n.
Download
Skip this Video
Loading SlideShow in 5 Seconds..
Toward Automated Authorization Policy Enforcement PowerPoint Presentation
Download Presentation
Toward Automated Authorization Policy Enforcement

Loading in 2 Seconds...

play fullscreen
1 / 39

Toward Automated Authorization Policy Enforcement - PowerPoint PPT Presentation


  • 98 Views
  • Uploaded on

Toward Automated Authorization Policy Enforcement. March 1 st , 2006 Second Annual Security-enhanced Linux Symposium Baltimore, Maryland. Request. Allowed?. Yes/No. Yes/No. Introduction. SELinux helps meet information-flow goals Expressive access-control policy language

loader
I am the owner, or an agent authorized to act on behalf of the owner, of the copyrighted work described.
capcha
Download Presentation

PowerPoint Slideshow about 'Toward Automated Authorization Policy Enforcement' - kerry-oliver


An Image/Link below is provided (as is) to download presentation

Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author.While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server.


- - - - - - - - - - - - - - - - - - - - - - - - - - E N D - - - - - - - - - - - - - - - - - - - - - - - - - -
Presentation Transcript
toward automated authorization policy enforcement

Toward Automated Authorization Policy Enforcement

March 1st, 2006

Second Annual Security-enhanced Linux Symposium

Baltimore, Maryland

introduction

Request

Allowed?

Yes/No

Yes/No

Introduction
  • SELinux helps meet information-flow goals
  • Expressive access-control policy language
  • Security-enhanced operating system

User

App

Ganapathy/Jaeger/Jha: Toward Automated Authorization Policy Enforcement

security aware applications

Request

Allowed?

Yes/No

Yes/No

Security-aware Applications
  • Need for security-aware applications
  • Can we build applications that can enforce mandatory access control policies?

User

App

Ganapathy/Jaeger/Jha: Toward Automated Authorization Policy Enforcement

security aware applications1

Request

Allowed?

Allowed?

Yes/No

Yes/No

Yes/No

Security-aware Applications
  • Need for security-aware applications

Client

Server

Ganapathy/Jaeger/Jha: Toward Automated Authorization Policy Enforcement

security aware applications2

Request

Allowed?

Yes/No

Yes/No

Security-aware Applications
  • Need for security-aware applications
  • Our work: How to build security-aware applications?
  • Focus is on mechanism, not policy

Server

Client

Ganapathy/Jaeger/Jha: Toward Automated Authorization Policy Enforcement

motivating example

Remote Client: Alice

Alice

Local

Motivating Example

X Server

Ganapathy/Jaeger/Jha: Toward Automated Authorization Policy Enforcement

motivating example1

Remote Client: Alice

Alice

Motivating Example

Remote Client: Bob

Bob

X Server

Ganapathy/Jaeger/Jha: Toward Automated Authorization Policy Enforcement

motivating example2

Remote Client: Alice

Alice

Motivating Example

Remote Client: Bob

Remote Client: Alice

X Server

Keyboard input

Malicious client can snoop on input

violating Alice’s confidentiality

Ganapathy/Jaeger/Jha: Toward Automated Authorization Policy Enforcement

motivating example3

Remote Client: Alice

Alice

Motivating Example

Remote Client: Bob

Remote Client: Alice

X Server

Malicious client can alter settings

on other client windows

Ganapathy/Jaeger/Jha: Toward Automated Authorization Policy Enforcement

motivating example4

Remote Client: Alice

Alice

Motivating Example

Remote Client: Bob

Remote Client: Alice

X Server

No mechanism to enforce authorization policies on client interactions

Ganapathy/Jaeger/Jha: Toward Automated Authorization Policy Enforcement

motivating example5

Remote Client: Alice

Alice

Motivating Example

Remote Client: Bob

Remote Client: Alice

Goal of the Security enhanced

X server project[Kilpatrick et al., 2003]

Input

Request

X Server

Keyboard input

Disallowed

Ganapathy/Jaeger/Jha: Toward Automated Authorization Policy Enforcement

need for security awareness
Need for Security-awareness
  • More examples: user-space servers
    • Samba
    • Web servers
    • Proxy and cache servers
    • Middleware
  • Common features
    • Manage multiple clients simultaneously
    • Offer shared resourcesto clients
    • Perform services on behalf of their clients

Ganapathy/Jaeger/Jha: Toward Automated Authorization Policy Enforcement

main claim
Main Claim

To effectively meet security-goals,

all applications managing shared resources must be made security-aware

Ganapathy/Jaeger/Jha: Toward Automated Authorization Policy Enforcement

focus of our work

Server

Client

Request

Allowed?

Yes/No

Yes/No

Focus of our work
  • How to build security-aware applications?
  • Focus is on mechanism, not policy
    • Can use tools like Tresys’ SELinux Policy Management Toolkit

Ganapathy/Jaeger/Jha: Toward Automated Authorization Policy Enforcement

security aware applications3
Security-aware Applications

Our work:

Tool support to retrofit legacy servers

for authorization policy enforcement

  • How to build security-aware applications?
  • Proactively design code for security
    • MULTICS project [Corbato et al., 1965]
    • Postfix mail server [Venema]
  • Retrofit existing, legacy code
    • Linux Security Modules project [Wright et al., 2002]
    • Security-enhanced X project [Kilpatrick et al., 2003]
    • Privilege separated OpenSSH [Provos et al., 2003]

Ganapathy/Jaeger/Jha: Toward Automated Authorization Policy Enforcement

our work

Legacy

server

Security-aware

server

Our Work
  • Tools to analyze and retrofit legacy code
  • Two case studies:
    • Retrofitting the X server [IEEE S&P 2006]
    • Retrofitting Linux [ACM CCS 2005]

Ganapathy/Jaeger/Jha: Toward Automated Authorization Policy Enforcement

main goal
Main Goal
  • Tool support to add reference monitoring to user-space servers

Main challenge: Where to place

reference monitor hooks?

Security-Event

Server

Reference

Monitor

Yes/No

Ganapathy/Jaeger/Jha: Toward Automated Authorization Policy Enforcement

authorization policies
Authorization Policies
  • Access-control matrix[Lampson’71]
  • Three entities: ‹subject, object, operation›
    • Subject (user or process)
    • Object (resource, such as file or socket)
    • Security-sensitive operation (access vectors)

Ganapathy/Jaeger/Jha: Toward Automated Authorization Policy Enforcement

main goal1
Main Goal
  • Analysis techniques to find where server performs security-sensitive operations

Security-Event

Server

Reference

Monitor

Yes/No

Ganapathy/Jaeger/Jha: Toward Automated Authorization Policy Enforcement

key insight fingerprints
Key Insight: Fingerprints
  • Each security-sensitive operation has a fingerprint
  • Intuition:Denotes key code-level steps to achieve the operation

Ganapathy/Jaeger/Jha: Toward Automated Authorization Policy Enforcement

examples of fingerprints
Examples of Fingerprints
  • Three access vectors from SELinux
  • DIR_WRITE :-
    • Setinode->i_ctime &
    • Calladdress_space_ops->prepare_write()
  • DIR_RMDIR :-
    • Setinode->i_size TO 0 &
    • Decrementinode->i_nlink
  • SOCKET_BIND :-
    • Callsocket->proto_ops->bind()

Ganapathy/Jaeger/Jha: Toward Automated Authorization Policy Enforcement

examples of fingerprints1
Examples of Fingerprints
  • Access vectors for the X server
  • WINDOW_MAP:-
    • SetWindowPtr->mappedTOTRUE&
    • SetxEvent->typeTOMapNotify
  • WINDOW_ENUMERATE:-
    • ReadWindowPtr->firstChild &
    • ReadWindowPtr->nextSib &
    • CompareWindowPtr ≠ 0

Ganapathy/Jaeger/Jha: Toward Automated Authorization Policy Enforcement

key insight fingerprints1
Key Insight: Fingerprints
  • How to find fingerprints?
  • How to use fingerprints to place hooks?

Ganapathy/Jaeger/Jha: Toward Automated Authorization Policy Enforcement

using fingerprints an example
Using Fingerprints: An Example
  • X server function MapSubWindows

MapSubWindows(Window *pParent, Client *pClient) {

xEvent event;

Window *pWin;

pWin = pParent->firstChild; …

for (;pWin != 0; pWin=pWin->nextSib) {

pWin->mapped = TRUE;

event.type = MapNotify;

}

}

Ganapathy/Jaeger/Jha: Toward Automated Authorization Policy Enforcement

examples of fingerprints2
Examples of Fingerprints
  • Access vectors for the X server
  • WINDOW_MAP:-
    • SetWindowPtr->mappedTOTRUE&
    • SetxEvent->typeTOMapNotify
  • WINDOW_ENUMERATE:-
    • ReadWindowPtr->firstChild &
    • ReadWindowPtr->nextSib &
    • CompareWindowPtr ≠ 0

Ganapathy/Jaeger/Jha: Toward Automated Authorization Policy Enforcement

using fingerprints an example1
Using Fingerprints: An Example
  • X server function MapSubWindows

MapSubWindows(Window *pParent, Client *pClient) {

xEvent event;

Window *pWin;

pWin = pParent->firstChild; …

for (;pWin != 0; pWin=pWin->nextSib) {

pWin->mapped = TRUE;

event.type = MapNotify;

}

}

Performs

Window_Map

Ganapathy/Jaeger/Jha: Toward Automated Authorization Policy Enforcement

examples of fingerprints3
Examples of Fingerprints
  • Access vectors for the X server
  • WINDOW_MAP:-
    • SetWindowPtr->mappedTOTRUE&
    • SetxEvent->typeTOMapNotify
  • WINDOW_ENUMERATE:-
    • ReadWindowPtr->firstChild &
    • ReadWindowPtr->nextSib &
    • CompareWindowPtr ≠ 0

Ganapathy/Jaeger/Jha: Toward Automated Authorization Policy Enforcement

using fingerprints an example2
Using Fingerprints: An Example
  • X server function MapSubWindows

MapSubWindows(Window *pParent, Client *pClient) {

xEvent event;

Window *pWin;

pWin = pParent->firstChild; …

for (;pWin != 0; pWin=pWin->nextSib) {

// Code to map window on screen

pWin->mapped = TRUE;

event.type = MapNotify;

}

}

Performs

Window_Enumerate

Ganapathy/Jaeger/Jha: Toward Automated Authorization Policy Enforcement

using fingerprints
Using Fingerprints
  • Fingerprints located using static analysis
  • Key advantage: statically find all locations where fingerprints occur
  • Can add hooks to all these locations

Ganapathy/Jaeger/Jha: Toward Automated Authorization Policy Enforcement

adding hooks an example
Adding Hooks: An Example
  • X server function MapSubWindows

MapSubWindows(Window *pParent, Client *pClient) {

xEvent event;

Window *pWin;

// Code to enumerate child windows

avc_has_perm(pClient, pParent, WINDOW_ENUMERATE);

pWin = pParent->firstChild; …

for (;pWin != 0; pWin=pWin->nextSib) {

// Code to map window on screen

avc_has_perm(pClient, pWin, WINDOW_MAP);

pWin->mapped = TRUE;

event.type = MapNotify;

}

}

Ganapathy/Jaeger/Jha: Toward Automated Authorization Policy Enforcement

key insight fingerprints2
Key Insight: Fingerprints
  • How to find fingerprints?
  • How to use fingerprints to place hooks?

Ganapathy/Jaeger/Jha: Toward Automated Authorization Policy Enforcement

finding fingerprints
Finding Fingerprints
  • Using analysis of runtime traces
  • Key Insight:
    • If server does a security-sensitive operation its fingerprint must be in the trace
  • Example:
    • Get X server to perform WINDOW_MAP

SetWindowPtr->mapped

TOTRUE

  • SetxEvent->type
  • TOMapNotify

Ganapathy/Jaeger/Jha: Toward Automated Authorization Policy Enforcement

finding fingerprints1
Finding Fingerprints
  • Main challenge:
    • Locating fingerprints in the runtime trace
  • Key insight:
    • Compare several runtime traces

SetWindowPtr->mapped

TOTRUE

  • SetxEvent->type
  • TOMapNotify

“DIFF”

Trace 1: Server does not perform WINDOW_MAP

Ganapathy/Jaeger/Jha: Toward Automated Authorization Policy Enforcement

finding fingerprints2
Finding Fingerprints
  • Main challenge:
    • Locating fingerprints in the runtime trace
  • Key insight:
    • Compare several runtime traces

SetWindowPtr->mapped

TOTRUE

  • SetxEvent->type
  • TOMapNotify

“DIFF”

Trace 2: Server does not perform WINDOW_MAP

Ganapathy/Jaeger/Jha: Toward Automated Authorization Policy Enforcement

key insight fingerprints3
Key Insight: Fingerprints
  • How to find fingerprints?
  • How to use fingerprints to place hooks?

Ganapathy/Jaeger/Jha: Toward Automated Authorization Policy Enforcement

results
Results
  • Retrofitted version of X server
  • Fingerprint-finding technique is effective:
    • Fewer than 10 functions to be examined to write fingerprints
    • In comparison, each trace exercises several hundred distinct X server functions
  • Details in upcoming IEEE S&P 2006 paper

Ganapathy/Jaeger/Jha: Toward Automated Authorization Policy Enforcement

examples of fingerprints4
Examples of fingerprints

Ganapathy/Jaeger/Jha: Toward Automated Authorization Policy Enforcement

slide to take home
Slide to take home
  • Goal: Placing authorization hooks in servers
  • Key insight: Security-sensitive operations have fingerprints
  • Finding fingerprints: Using “diff” of runtime traces
  • Placing hooks: By statically locating fingerprints

Ganapathy/Jaeger/Jha: Toward Automated Authorization Policy Enforcement

questions

Questions?

Toward Automated Authorization Policy Enforcement

http://www.cs.wisc.edu/~vg

http://www.cse.psu.edu/~tjaeger

http://www.cs.wisc.edu/~jha