Introduktion
For an additional level of server security, you can use of access control. This publication will describe how to run Apache in a jail with access only to those components that are necessary for the proper functioning of Apache and PHP. This principle can be applied not only to Apache but also to any other stack.
Forberedelse
This method is suitable only for the UFS file system; in this example, ZFS will be used in the main system, while UFS will be used in the jail. First, you need to rebuild the kernel; when installing FreeBSD, make sure to install the source code.
After the system is installed, edit the file:
/usr/src/sys/amd64/conf/GENERIC
You need to add just one line to this file:
options MAC_MLS
The label mls/high will dominate over the label mls/low; applications running with the label mls/low will not be able to access files marked with the label mls/high. More detailed information about all available labels in the FreeBSD system can be found in this .
Next, navigate to the directory /usr/src:
cd /usr/src
To start building the kernel, execute (in the j option specify the number of cores in the system):
make -j 4 buildkernel KERNCONF=GENERIC
After the kernel is built, it needs to be installed:
make installkernel KERNCONF=GENERIC
After installing the kernel, do not rush to reboot the system, as users need to be switched to the login class after configuring it. Edit the file /etc/login.conf, and in this file, you need to modify the default login class to look like this:
default:
:passwd_format=sha512:
:copyright=/etc/COPYRIGHT:
:welcome=/etc/motd:
:setenv=MAIL=/var/mail/$,BLOCKSIZE=K:
:path=/sbin /bin /usr/sbin /usr/bin /usr/local/sbin /usr/local/bin ~/bin:
:nologin=/var/run/nologin:
:cputime=unlimited:
:datasize=unlimited:
:stacksize=unlimited:
:memorylocked=64K:
:memoryuse=unlimited:
:filesize=unlimited:
:coredumpsize=unlimited:
:openfiles=unlimited:
:maxproc=unlimited:
:sbsize=unlimited:
:vmemoryuse=unlimited:
:swapuse=unlimited:
:pseudoterminals=unlimited:
:kqueues=unlimited:
:umtxp=unlimited:
:priority=0:
:ignoretime@:
:umask=022:
:label=mls/equal:
The line :label=mls/equal will allow users who belong to this class to access files marked with any label (mls/low, mls/high). After these modifications, it is necessary to rebuild the database and place the user root (as well as those who need it) in this login class:
cap_mkdb /etc/login.conf
pw usermod root -L default
For the policy to apply only to files, you need to edit the file /etc/mac.conf, leaving only one line in it:
default_labels file ?mls
You also need to add the mac_mls.ko module to auto-start:
echo 'mac_mls_load="YES"' >> /boot/loader.conf
After that, you can safely reboot the system. How to create can be read in one of my publications. But before creating a jail, you need to add a hard drive and create a filesystem on it, and enable multilabel on it, create a ufs2 filesystem with a cluster size of 64kb:
newfs -O 2 -b 64kb /dev/ada1
tunefs -l enable /dev/ada1
After creating the filesystem and adding multilabel, you need to add the hard drive to /etc/fstab, add a line to this file:
/dev/ada1 /jail ufs rw 0 1
In Mountpoint, specify the directory where you will mount the hard drive, in Pass, be sure to specify 1 (the order in which this hard drive will be checked) — this is necessary because the ufs filesystem is sensitive to sudden power outages. After these actions, mount the disk:
mount /dev/ada1 /jail
In this directory, install the jail. After the jail is running, you need to perform the same operations as in the main system with users and files /etc/login.conf, /etc/mac.conf.
Indstillinger
Before installing the necessary labels, I recommend installing all the required packages; in my case, the labels will be set according to these packages:
mod_php73-7.3.4_1 PHP Scripting Language
php73-7.3.4_1 PHP Scripting Language
php73-ctype-7.3.4_1 Den delte ctype-udvidelse for php
php73-curl-7.3.4_1 Den delte curl-udvidelse for php
php73-dom-7.3.4_1 Den delte dom-udvidelse for php
php73-extensions-1.0 "meta-port" til installation af PHP-udvidelser
php73-filter-7.3.4_1 Den delte filter-udvidelse for php
php73-gd-7.3.4_1 Den delte gd-udvidelse for php
php73-gettext-7.3.4_1 Den delte gettext-udvidelse for php
php73-hash-7.3.4_1 Den delte hash-udvidelse for php
php73-iconv-7.3.4_1 Den delte iconv-udvidelse for php
php73-json-7.3.4_1 Den delte json-udvidelse for php
php73-mysqli-7.3.4_1 Den delte mysqli-udvidelse for php
php73-opcache-7.3.4_1 Den delte opcache-udvidelse for php
php73-openssl-7.3.4_1 Den delte openssl-udvidelse for php
php73-pdo-7.3.4_1 Den delte pdo-udvidelse for php
php73-pdo_sqlite-7.3.4_1 Den delte pdo_sqlite-udvidelse for php
php73-phar-7.3.4_1 Den delte phar-udvidelse for php
php73-posix-7.3.4_1 Den delte posix-udvidelse for php
php73-session-7.3.4_1 Den delte session-udvidelse for php
php73-simplexml-7.3.4_1 Den delte simplexml-udvidelse for php
php73-sqlite3-7.3.4_1 Den delte sqlite3-udvidelse for php
php73-tokenizer-7.3.4_1 Den delte tokenizer-udvidelse for php
php73-xml-7.3.4_1 Den delte xml-udvidelse for php
php73-xmlreader-7.3.4_1 Den delte xmlreader-udvidelse for php
php73-xmlrpc-7.3.4_1 Den delte xmlrpc-udvidelse for php
php73-xmlwriter-7.3.4_1 Den delte xmlwriter-udvidelse for php
php73-xsl-7.3.4_1 Den delte xsl-udvidelse for php
php73-zip-7.3.4_1 Den delte zip-udvidelse for php
php73-zlib-7.3.4_1 Den delte zlib-udvidelse for php
apache24-2.4.39
I dette eksempel vil mærkerne blive tildelt med hensyntagen til afhængighederne af de pågældende pakker. Man kan selvfølgelig vælge en simplere tilgang ved at tildele mærkerne mls/low for mappen /usr/local/lib og de filer, der ligger i denne katalog, så kan efterfølgende installerede pakker (f.eks. yderligere udvidelser til php) få adgang til bibliotekerne i denne mappe, men jeg mener, det er bedre kun at give adgang til de filer, der er nødvendige. Stop jail og tildel mls/high mærker til alle filer:
setfmac -R mls/high /jail
Når mærkerne tildeles, vil processen blive stoppet, hvis setfmac støder på hårde links. I mit eksempel fjernede jeg de hårde links i følgende kataloger:
/var/db/etcupdate/current/
/var/db/etcupdate/current/etc
/var/db/etcupdate/current/usr/share/openssl/man/en.ISO8859-15
/var/db/etcupdate/current/usr/share/man/en.ISO8859-15
/var/db/etcupdate/current/usr/share/man/en.UTF-8
/var/db/etcupdate/current/usr/share/nls
/etc/ssl
/usr/local/etc
/usr/local/etc/fonts/conf.d
/usr/local/openssl
Når mærkerne er tildelt, er det nødvendigt at tildele mls/low mærker til apache; først skal det klarlægges, hvilke filer der er nødvendige for at starte apache:
ldd /usr/local/sbin/httpd
Når denne kommando udføres, vises afhængighederne på skærmen, men det vil ikke være tilstrækkeligt at angive de nødvendige etiketter for disse filer, da de mapper, som disse filer findes i, har etiketten mls/high. Derfor skal etiketten mls/low også angives for disse mapper. Ved opstart af Apache vil den også vise de filer, der er nødvendige for dens opstart, og for PHP kan disse afhængigheder findes i httpd-error.log.
setfmac mls/low /
setfmac mls/low /usr/local/lib/libpcre.so.1
setfmac mls/low /usr/local/lib/libaprutil-1.so.0
setfmac mls/low /usr/local/lib/libdb-5.3.so.0
setfmac mls/low /usr/local/lib/libgdbm.so.6
setfmac mls/low /usr/local/lib/libexpat.so.1
setfmac mls/low /usr/local/lib/libapr-1.so.0
setfmac mls/low /lib/libcrypt.so.5
setfmac mls/low /lib/libthr.so.3
setfmac mls/low /lib/libc.so.7
setfmac mls/low /usr/local/lib/libintl.so.8
setfmac mls/low /var
setfmac mls/low /var/run
setfmac mls/low /var/log
setfmac mls/low /var/log/httpd-access.log
setfmac mls/low /var/log/httpd-error.log
setfmac mls/low /var/run/httpd.pid
setfmac mls/low /lib
setfmac mls/low /lib/libcrypt.so.5
setfmac mls/low /usr/local/lib/db5/libdb-5.3.so.0
setfmac mls/low /usr/local/lib/db5/libdb-5.3.so.0.0.0
setfmac mls/low /usr/local/lib/db5
setfmac mls/low /usr/local/lib
setfmac mls/low /libexec
setfmac mls/low /libexec/ld-elf.so.1
setfmac mls/low /dev
setfmac mls/low /dev/random
setfmac mls/low /usr/local/libexec
setfmac mls/low /usr/local/libexec/apache24
setfmac mls/low /usr/local/libexec/apache24/*
setfmac mls/low /etc/pwd.db
setfmac mls/low /etc/passwd
setfmac mls/low /etc/group
setfmac mls/low /etc/
setfmac mls/low /usr/local/etc
setfmac -R mls/low /usr/local/etc/apache24
setfmac mls/low /usr
setfmac mls/low /usr/local
setfmac mls/low /usr/local/sbin
setfmac mls/low /usr/local/sbin/*
setfmac -R mls/low /usr/local/etc/rc.d/
setfmac mls/low /usr/local/sbin/htcacheclean
setfmac mls/low /var/log/httpd-access.log
setfmac mls/low /var/log/httpd-error.log
setfmac -R mls/low /usr/local/www
setfmac mls/low /usr/lib
setfmac mls/low /tmp
setfmac -R mls/low /usr/local/lib/php
setfmac -R mls/low /usr/local/etc/php
setfmac mls/low /usr/local/etc/php.conf
setfmac mls/low /lib/libelf.so.2
setfmac mls/low /lib/libm.so.5
setfmac mls/low /usr/local/lib/libxml2.so.2
setfmac mls/low /lib/libz.so.6
setfmac mls/low /usr/lib/liblzma.so.5
setfmac mls/low /usr/local/lib/libiconv.so.2
setfmac mls/low /usr/lib/librt.so.1
setfmac mls/low /lib/libthr.so.3
setfmac mls/low /usr/local/lib/libpng16.so.16
setfmac mls/low /usr/lib/libbz2.so.4
setfmac mls/low /usr/local/lib/libargon2.so.0
setfmac mls/low /usr/local/lib/libpcre2-8.so.0
setfmac mls/low /usr/local/lib/libsqlite3.so.0
setfmac mls/low /usr/local/lib/libgd.so.6
setfmac mls/low /usr/local/lib/libjpeg.so.8
setfmac mls/low /usr/local/lib/libfreetype.so
setfmac mls/low /usr/local/lib/libfontconfig.so.1
setfmac mls/low /usr/local/lib/libtiff.so.5
setfmac mls/low /usr/local/lib/libwebp.so.7
setfmac mls/low /usr/local/lib/libjbig.so.2
setfmac mls/low /usr/lib/libssl.so.8
setfmac mls/low /lib/libcrypto.so.8
setfmac mls/low /usr/local/lib/libzip.so.5
setfmac mls/low /etc/resolv.conf
Denne liste angiver etiketterne mls/low for alle filer, der er nødvendige for korrekt drift af kombinationen af Apache og PHP (for de pakker, der er installeret i mit eksempel).
Det sidste trin vil være at konfigurere opstart af jail på niveauet mls/equal og Apache på niveauet mls/low. For at starte jail skal der foretages ændringer i scriptet /etc/rc.d/jail, find funktionen jail_start i dette script, og ændr variablen command til:
command="setpmac mls/equal $jail_program"
Kommandoen setpmac starter den udførbare fil på det nødvendige mandatsniveau, i dette tilfælde mls/equal, for at få adgang til alle labels. I Apache er det nødvendigt at redigere startscriptet /usr/local/etc/rc.d/apache24. Foretag ændringer i funktionen apache24_prestart:
apache24_prestart() {
apache24_checkfib
apache24_precmd
eval "setpmac mls/low" ${command} ${apache24_flags}
}
I I vejledningen er der angivet et andet eksempel, men jeg kunne ikke bruge det, da der konstant opstod en fejlmeddelelse om, at det var umuligt at bruge kommandoen setpmac.
Output
Denne måde at tildele adgang på vil tilføje et ekstra lag af sikkerhed til Apache (selvom denne metode kan anvendes til enhver anden stak), som derudover kører i jail, samtidig med at alt dette foregår gennemsigtigt og uset for administratoren.
Listen over kilder, der hjalp mig med at skrive dette indlæg:
Kilde: habr.com
