rsbacl5s.gif (2243 Byte)  

Rule Set Based Access Control (RSBAC) for Linux - Examples


1. Privacy Model Example

This example is described in a separate document.

2. Tampering Protection for Executables

Administration Goal

Protect all executables, e.g. below /sbin, against tampering

Common steps for all models

FF solution

  1. Set ff_flags search_only and read_only for all identified directories. The flag search_only means that you can only access objects in a directory, if you know the exact path, and that you are not allowed to change anything about the directory itself.
  2. Set read_only for all identified separate executables. The flag read_only means that the directory with all its subobjects is set to read-only.
  3. If you need to read the directory contents, remove the search_only flag. The read_only flag is still applied.
  4. If a directory contains binary executables only and no scripts, you can set the flag execute_only for it. This means that all files below may only be executed, but not read (copied) or anything else.

RC solution

  1. Create a new FD type 'Executables'.
  2. Give all roles rights SEARCH and EXECUTE for this type.
  3. If you need to READ_OPEN the files, e.g. scripts, add rights READ_OPEN and CLOSE.
  4. For filename completion in the shell, you need READ right, possibly also GET_STATUS_DATA or GET_PERMISSIONS_DATA.
  5. Set the new FD type 'Executables' for all identified directories and files.
  6. If you want to allow executable modification or installation for one role, e.g. 'Installer', just add the necessary rights to type 'Executables' for this role.

ACL solution

  1. Set the inheritance mask to SEARCH and EXECUTE only for all identified directories and files.
  2. If you need to READ_OPEN the files, e.g. scripts, add rights READ_OPEN and CLOSE.
  3. For filename completion in the shell, you need READ right, possibly also GET_STATUS_DATA or GET_PERMISSIONS_DATA.
  4. As the SUPERVISOR right includes all other rights and can (usually) not be masked out, all subjects with SUPERVISOR on a higher level still have full access. In the standard setup, only user 400 (Security Officer etc.) has this right to the FD default ACL (and thus to all files and directories).
  5. If you want to allow executable modification or installation for a subject, e.g. group 'Installers', just add an entry for this subject with the necessary rights to the directory or file ACL.
  6. If you want to be sure not to miss such entries later, you can find all ACL entries with acl_tlist -r.

3. Protection against unwanted Execution

Administration Goals

  1. Protect against execution of uncontrolled files or libraries

Common steps for all models

FF solution

  1. Remove add_inherited flag for all identified directories.
  2. Remove add_inherited flag for all identified separate executables and libraries
  3. Set no_execute flag on top dir
  4. Without add_inherited, the no_execute flag is not inherited and thus not applied to the identified dirs and separate executables

RC solution

  1. Perform steps 1-5 from RC solution 2. Make a similar setup for library directories and files with another type 'Libraries'.
  2. Remove EXECUTE and MAP_EXEC rights to all types other than 'Executables' and 'Libraries' from all roles. For setup checking, remove the right for your Role Admin last and first try other roles.

ACL solution

  1. Grant rights SEARCH and EXECUTE to group 0 ('Everyone') for all identified directories and files.
  2. If you need to READ_OPEN the files, e.g. libraries or scripts, add rights READ_OPEN and CLOSE.
  3. For filename completion in the shell, you need READ right, possibly also GET_STATUS_DATA or GET_PERMISSIONS_DATA.
  4. Remove right EXECUTE from the inheritance mask of the root dir / or from all entries in the default FD acl.
  5. If you have individual ACL entries at any directory or file other than the identified ones, revoke EXECUTE right from them. You can find all ACL entries with acl_tlist -r.
  6. As the SUPERVISOR right includes all other rights and can (usually) not be masked out, all subjects with SUPERVISOR still have full access. In the standard setup, only user 400 (Security Officer etc.) has this right to the FD default ACL (and thus to all files, fifos and directories).

Questions, tips, etc.

28-May-02, -ao