Hello everyone! Especially for the students of the course, we have prepared a translation of the official SELinux project's FAQ. We believe that this translation may be useful not only for students, so we are sharing it with you.
We have attempted to answer some of the most frequently asked questions about the SELinux project. Currently, the questions are divided into two main categories. All questions and answers can be found .
Overview
Overview
- What is Security-Enhanced Linux?
Security-Enhanced Linux (SELinux) is a reference implementation of the Flask security architecture for flexible mandatory access control. It was created to demonstrate the usefulness of flexible mandatory access control mechanisms and how such mechanisms can be integrated into an operating system. The Flask architecture was subsequently integrated into Linux and ported to several other systems, including Solaris, FreeBSD, and Darwin kernel, giving rise to a wide range of related work. The Flask architecture provides general support for enforcing various types of mandatory access control policies, including those based on the concepts of Type Enforcement, Role-Based Access Control, and Multi-Level Security. - What does Security-Enhanced Linux provide that standard Linux does not?
The Security-Enhanced Linux kernel establishes mandatory access control policies that limit user programs and system servers to the minimal set of privileges they need to perform their functions. By imposing these limitations, the ability of these user programs and system daemons to cause harm in the event of a compromise (such as from buffer overflow or misconfiguration) is reduced or eliminated. This restriction mechanism operates independently of traditional Linux access control mechanisms. It does not recognize the superuser 'root' and does not share well-known shortcomings of traditional Linux security mechanisms (such as reliance on setuid/setgid binary files).
The security of an unmodified Linux system depends on the correctness of the kernel, all privileged applications, and each of their configurations. A problem in any of these areas can lead to a compromise of the entire system. Conversely, the security of a modified system based on a Linux kernel with enhanced security primarily relies on the correctness of the kernel and its security policy configuration. Although issues with the correctness or configuration of applications may allow limited compromise of individual user programs and system daemons, they do not pose a security risk to other user programs, system daemons, or the overall security of the system. - What is it good for?
New Linux features with enhanced security are designed to ensure information separation based on confidentiality and integrity requirements. They aim to prevent processes from reading data and programs, spoofing data and programs, bypassing application security mechanisms, executing untrusted programs, or interfering with other processes in violation of the system's security policy. They also help limit the potential damage that malicious or faulty programs can cause. Additionally, they should be useful for enabling users with different security clearances to access various types of information with different security requirements without compromising those requirements. - How can I get a copy?
Many Linux distributions include SELinux support already built in as a default feature or as an additional package. The core userland code of SELinux is available at . End users typically need to use the packages provided by their distribution. - What is included in your release?
The NSA SELinux release includes the core userland code of SELinux. SELinux support is already integrated into the main Linux kernel 2.6, available at kernel.org. The main userland code of SELinux consists of a library for manipulating binary policy (libsepol), a policy compiler (checkpolicy), a library for applications providing security (libselinux), a library for policy management tools (libsemanage), and several related policy utilities (policycoreutils).
In addition to the kernel with SELinux support and the core userland code, you will need a policy and some SELinux-compatible user-space packages to utilize SELinux. The policy can be obtained from . - Can I install a hardened Linux on an existing Linux system?
Yes, you can install only the modifications of SELinux on an existing Linux system, or you can install a Linux distribution that already includes SELinux support. SELinux consists of a Linux kernel with SELinux support, a core set of libraries and utilities, some modified user packages, and a policy configuration. To install it on an existing Linux system that lacks SELinux support, you must be able to compile the software and have other necessary system packages. If your Linux distribution already includes SELinux support, you do not need to compile or install the NSA SELinux release. - How compatible is Linux with enhanced security compared to unmodified Linux?
Linux with enhanced security provides binary compatibility with existing Linux applications and existing Linux kernel modules, but some kernel modules may require modifications to interact properly with SELinux. These two categories of compatibility are discussed in detail below:- Application compatibility
SELinux provides binary compatibility with existing applications. We expanded the kernel data structures, incorporating new protection attributes and added new API calls for applications that ensure security. However, we did not alter any data structures visible to applications and did not change the interface of any existing system calls, so existing applications can operate unchanged if the security policy permits their operation. - Kernel Module Compatibility
Initially, SELinux provided source compatibility only for existing kernel modules; it was necessary to recompile such modules against the modified kernel headers to incorporate the new protection fields added to the kernel data structures. Since LSM and SELinux are now integrated into the mainline Linux 2.6 kernel, SELinux now provides binary compatibility with existing kernel modules. However, some kernel modules may interact poorly with SELinux without modifications. For example, if a kernel module directly allocates and initializes a kernel object without using standard initialization functions, the kernel object may lack appropriate security information. Some kernel modules may also lack proper security control over their operations; any existing calls to kernel functions or permission functions will also trigger SELinux permission checks, but compliance with MAC policies may require more detailed or additional controls.
A security-enhanced Linux system should not create interaction problems with standard Linux systems if all necessary operations are permitted by the security policy configuration.
- Application compatibility
- What are the goals of the security policy configuration example?
At a high level, the goal is to demonstrate the flexibility and security of enforced access control measures and to provide a simple working system with minimal changes to applications. At a lower level, the policy has several goals outlined in the policy documentation. These goals include managing raw access to data, protecting the integrity of the kernel, system software, system configuration information, and system logs, limiting potential damage that may be caused by exploiting a privilege-requiring vulnerability, protecting privileged processes from executing malicious code, safeguarding the administrator role and domain from unauthorized access without user authentication, preventing interference of regular user processes with system or administrator processes, and protecting users and administrators from malicious mobile code exploiting vulnerabilities in their browsers. - Why was Linux chosen as the base platform?
Linux was selected as the platform for the initial proof-of-concept implementation of this work due to its growing success and open development environment. Linux provides an excellent opportunity to demonstrate that this functionality can be successful in a mainstream operating system while simultaneously enhancing the security of a widely used system. The Linux platform also offers a great opportunity for this work to obtain the broadest possible overview and may serve as a foundation for further security research by other enthusiasts. - Why did you undertake this work?
The National Security Agency is responsible for the research and development of technologies necessary for the NSA to provide solutions, products, and services for information security to information infrastructures critical to U.S. national security interests.
Creating a viable secure operating system remains a critical research challenge. Our goal is to develop an efficient architecture that provides the necessary support for security, executes programs largely transparently to users, and is appealing to vendors. We believe that an important step towards achieving this goal is demonstrating how mandatory access control mechanisms can be successfully integrated into the core operating system. - How does this relate to previous NSA OS research?
Researchers from the National Security Agency's Information Assurance Laboratory, along with Secure Computing Corporation (SCC), developed a powerful and flexible mandatory access control architecture based on Type Enforcement, a mechanism first developed for the LOCK system. The NSA and SCC developed two prototypes of this architecture based on Mach: DTMach and DTOS (). The NSA and SCC then collaborated with the Flux research group at the University of Utah to transfer the architecture to the research operating system Fluke. During this transfer, the architecture was refined to provide better support for dynamic security policies. This enhanced architecture was named Flask (). The NSA has now integrated the Flask architecture into the Linux operating system to pass this technology on to a broader community of developers and users. - Is Linux with enhanced security a reliable operating system?
The phrase 'Trusted Operating System' typically refers to an operating system that provides sufficient support for multilevel security and validation of correctness to meet a specific set of government requirements. Security-Enhanced Linux incorporates useful ideas from these systems but focuses on mandatory access control. The original goal of developing Security-Enhanced Linux was to create useful functionality that offers tangible security advantages across a wide range of real-world environments to demonstrate this technology. SELinux itself is not a trusted operating system but provides a critically important security feature—mandatory access control—necessary for a trusted operating system. SELinux has been integrated into Linux distributions that have been evaluated according to the Labeled Security Protection Profile. Information on certified and evaluated products can be found at . - Is it really secure?
The concept of a secure system includes many attributes (such as physical security, personnel security, etc.), and Security-Enhanced Linux addresses only a very narrow set of these attributes (i.e., the mandatory access control elements in the operating system). In other words, a 'secure system' means sufficiently secure to protect some information in the real world from a real adversary against whom the information owner and/or user is warned. Security-Enhanced Linux is intended solely to demonstrate the mandatory controls in a modern operating system like Linux, and therefore, it is unlikely to meet any interesting definition of a secure system. We believe that the technology demonstrated in Security-Enhanced Linux will be beneficial to those creating secure systems. - What have you done to enhance assurance?
The goal of this project was to add access control elements with minimal changes to Linux. This last aim significantly limits what can be done to enhance assurance, so no work was directed towards improving Linux's assurance. On the other hand, enhancements are based on previous work in developing a highly reliable security architecture, and most of these design principles have been carried over to Linux with enhanced security. - Will CCEVS evaluate security-enhanced Linux?
Security-enhanced Linux alone is not intended to address the full set of security issues presented by the protection profile. While it would be possible to evaluate only its current functionality, we believe such an evaluation would have limited value. However, we have worked with others to include this technology in Linux distributions that have been evaluated and distributions currently under evaluation. Information about evaluated and certified products can be found at . - Have you tried to fix any vulnerabilities?
No, we did not search for or find any vulnerabilities during our work. We only made the minimum necessary changes to add our new mechanisms. - Is this system approved for government use?
Security-enhanced Linux has no special or additional approval for government use over any other version of Linux. Security-enhanced Linux does not have special or additional clearance for government use compared to any other version of Linux. - How does this differ from other initiatives?
Security-enhanced Linux has a clearly defined architecture for flexible access control, which has been empirically validated through several prototype systems (DTMach, DTOS, Flask). Detailed studies have been conducted on the architecture's ability to support a wide range of security policies and are available at and .
The architecture provides detailed control over many kernel abstractions and services that are not controlled by other systems. Some of the distinctive features of security-enhanced Linux include:- A clear separation between policy and enforcement rights.
- Clearly defined policy interfaces
- Independence from specific policies and policy languages
- Independence from specific formats and security label content
- Separate labels and controls for core objects and services
- Caching access decisions for efficiency
- Support for policy changes
- Control over process initialization, inheritance, and program execution
- Management of file systems, directories, files, and open file descriptors
- Management of sockets, messages, and network interfaces
- Control over the use of 'Capabilities'
- What are the licensing restrictions on this system?
All source code found on the site , is distributed under the same conditions as the original source codes. For example, patches for the Linux kernel and fixes for many existing utilities available here are released under the terms . - Is there export control?
For Linux with enhanced security, there are no additional export controls compared to any other version of Linux. - Does the NSA plan to use it domestically?
For obvious reasons, the NSA does not comment on operational use. - Does the statement of guarantees from July 26, 2002 by Secure Computing Corporation change the NSA's position that SELinux was provided under the GNU General Public License?
The NSA's position has not changed. The NSA still believes that the terms and conditions of the GNU General Public License govern the use, copying, distribution, and modification of SELinux. See. . - Does the NSA support open source software?
The NSA's initiatives to enhance software security encompass both proprietary and open-source software, and we have successfully leveraged both proprietary and open models in our research activities. The NSA's work on improving software security is motivated by one simple consideration: to utilize our resources as effectively as possible to provide NSA clients with the best possible security options in the most widely used products. The goal of the NSA's research program is to develop technological advancements to share with the software development community through various dissemination mechanisms. The NSA does not endorse or promote any specific software product or business model. Rather, the NSA facilitates the enhancement of security. - Does the NSA support Linux?
As noted above, the NSA does not endorse or promote any specific software product or platform; the NSA only facilitates security enhancements. The Flask architecture demonstrated in the reference implementation of SELinux has been ported to several other operating systems, including Solaris, FreeBSD, and Darwin, ported to the Xen hypervisor, and applied to applications such as the X Window System, GConf, D-BUS, and PostgreSQL. The concepts of the Flask architecture are widely applicable to a broad range of systems and environments.
Collaboration
- How do we plan to engage with the Linux community?
We have , which will serve as our primary means of disseminating information about Linux with enhanced security. If you are interested in Linux with enhanced security, we encourage you to join the developers' mailing list, review the source code, and provide your feedback (or code). To join the developers' mailing list, see. . - Who can help?
SELinux is now supported and developed by the open-source Linux software development community. - Does the NSA fund any further work?
Currently, the NSA is not considering proposals for further work. - What type of support is available?
We intend to address issues through the mailing list selinux@tycho.nsa.gov, but we may not be able to answer all questions related to specific websites. - Who helped? What did they do?
A Linux prototype with enhanced security was developed by the NSA in collaboration with research partners from NAI Labs, Secure Computing Corporation (SCC), and MITER Corporation. Following the initial public release, many other materials have been published. . - How can I learn more?
We recommend visiting our web pages, reading the documentation and past research papers, as well as participating in our mailing list at selinux@vger.kernel.org.
Do you find the translation helpful? Leave your comments!
Source: habr.com
