Securing Linux
Total Page:16
File Type:pdf, Size:1020Kb
Load more
Recommended publications
-
Software Security for Open-Source Systems
Open-Source Security Software Security for Open-Source Systems Debate over whether open-source software development leads to more or less secure software has raged for years. Neither is in- trinsically correct: open-source software gives both attackers and defenders greater power over system security. Fortunately, several security-enhancing technologies for open-source sys- tems can help defenders improve their security. classify methods that CRISPIN ome people have claimed that open-source ensure and enforce COWAN software is intrinsically more secure than closed the “nothing else” part into three broad categories: WireX source,1 and others have claimed that it’s not.2 Communications Neither case is absolutely true: they are essen- • Software auditing, which prevents vulnerabilities by Stially flip sides of the same coin. Open source gives both searching for them ahead of time, with or without auto- attackers and defenders greater analytic power to do matic analysis something about software vulnerabilities. If the defender • Vulnerability mitigation, which are compile-time tech- does nothing about security, though, open source just niques that stop bugs at runtime gives that advantage away to the attacker. • Behavior management, which are operating system fea- However, open source also offers great advantages to tures that either limit potential damage or block specif- the defender, giving access to security techniques that are ic behaviors known to be dangerous normally infeasible with closed-source software. Closed source forces users to accept the level of security diligence Software auditing that the vendor chooses to provide, whereas open source The least damaging software vulnerability is the one that lets users (or other collectives of people) raise the bar on never happens. -
Jitk: a Trustworthy In-Kernel Interpreter Infrastructure
Jitk: A trustworthy in-kernel interpreter infrastructure Xi Wang, David Lazar, Nickolai Zeldovich, Adam Chlipala, Zachary Tatlock MIT and University of Washington Modern OSes run untrusted user code in kernel In-kernel interpreters - Seccomp: sandboxing (Linux) - BPF: packet filtering - INET_DIAG: socket monitoring - Dtrace: instrumentation Critical to overall system security - Any interpreter bugs are serious! 2/30 Many bugs have been found in interpreters Kernel space bugs - Control flow errors: incorrect jump offset, ... - Arithmetic errors: incorrect result, ... - Memory errors: buffer overflow, ... - Information leak: uninitialized read Kernel-user interface bugs - Incorrect encoding/decoding User space bugs - Incorrect input generated by tools/libraries Some have security consequences: CVE-2014-2889, ... See our paper for a case study of bugs 3/30 How to get rid of all these bugs at once? Theorem proving can help kill all these bugs seL4: provably correct microkernel [SOSP'09] CompCert: provably correct C compiler [CACM'09] This talk: Jitk - Provably correct interpreter for running untrusted user code - Drop-in replacement for Linux's seccomp - Built using Coq proof assistant + CompCert 5/30 Theorem proving: overview specification proof implementation Proof is machine-checkable: Coq proof assistant Proof: correct specification correct implementation Specification should be much simpler than implementation 6/30 Challenges What is the specification? How to translate systems properties into proofs? How to extract a running -
Auditing Overhead, Auditing Adaptation, and Benchmark Evaluation in Linux Lei Zeng1, Yang Xiao1* and Hui Chen2
SECURITY AND COMMUNICATION NETWORKS Security Comm. Networks 2015; 8:3523–3534 Published online 4 June 2015 in Wiley Online Library (wileyonlinelibrary.com). DOI: 10.1002/sec.1277 RESEARCH ARTICLE Auditing overhead, auditing adaptation, and benchmark evaluation in Linux Lei Zeng1, Yang Xiao1* and Hui Chen2 1 Department of Computer Science, The University of Alabama, Tuscaloosa 35487-0290, AL, U.S.A. 2 Department of Mathematics and Computer Science, Virginia State University, Petersburg 23806, VA, U.S.A. ABSTRACT Logging is a critical component of Linux auditing. However, our experiments indicate that the logging overhead can be significant. The paper aims to leverage the performance overhead introduced by Linux audit framework under various us- age patterns. The study on the problem leads to an adaptive audit-logging mechanism. Many security incidents or other im- portant events are often accompanied with precursory events. We identify important precursory events – the vital signs of system activity and the audit events that must be recorded. We then design an adaptive auditing mechanism that increases or reduces the type of events collected and the frequency of events collected based upon the online analysis of the vital-sign events. The adaptive auditing mechanism reduces the overall system overhead and achieves a similar level of protection on the system and network security. We further adopt LMbench to evaluate the performance of key operations in Linux with compliance to four security standards. Copyright © 2015 John Wiley & Sons, Ltd. KEYWORDS logging; overhead; Linux; auditing *Correspondence Yang Xiao, Department of Computer Science, The University of Alabama, 101 Houser Hall, PO Box 870290, Tuscaloosa 35487-0290, AL, U.S.A. -
Hardening Linux
eBooks-IT.org 4444_FM_final.qxd 1/5/05 12:39 AM Page i eBooks-IT.org Hardening Linux JAMES TURNBULL 4444_FM_final.qxd 1/5/05 12:39 AM Page ii eBooks-IT.org Hardening Linux Copyright © 2005 by James Turnbull All rights reserved. No part of this work may be reproduced or transmitted in any form or by any means, electronic or mechanical, including photocopying, recording, or by any information storage or retrieval system, without the prior written permission of the copyright owner and the publisher. ISBN (pbk): 1-59059-444-4 Printed and bound in the United States of America 987654321 Trademarked names may appear in this book. Rather than use a trademark symbol with every occurrence of a trademarked name, we use the names only in an editorial fashion and to the benefit of the trademark owner, with no intention of infringement of the trademark. Lead Editor: Jim Sumser Technical Reviewer: Judith Myerson Editorial Board: Steve Anglin, Dan Appleman, Ewan Buckingham, Gary Cornell, Tony Davis, Jason Gilmore, Chris Mills, Dominic Shakeshaft, Jim Sumser Project Manager: Kylie Johnston Copy Edit Manager: Nicole LeClerc Copy Editor: Kim Wimpsett Production Manager: Kari Brooks-Copony Production Editor: Kelly Winquist Compositor: Linda Weidemann Proofreader: Lori Bring Indexer: Kevin Broccoli Artist: Kinetic Publishing Services, LLC Cover Designer: Kurt Krames Manufacturing Manager: Tom Debolski Distributed to the book trade in the United States by Springer-Verlag New York, Inc., 233 Spring Street, 6th Floor, New York, NY 10013, and outside the United States by Springer-Verlag GmbH & Co. KG, Tiergartenstr. 17, 69112 Heidelberg, Germany. In the United States: phone 1-800-SPRINGER, fax 201-348-4505, e-mail [email protected], or visit http://www.springer-ny.com. -
Chapter 1. Origins of Mac OS X
1 Chapter 1. Origins of Mac OS X "Most ideas come from previous ideas." Alan Curtis Kay The Mac OS X operating system represents a rather successful coming together of paradigms, ideologies, and technologies that have often resisted each other in the past. A good example is the cordial relationship that exists between the command-line and graphical interfaces in Mac OS X. The system is a result of the trials and tribulations of Apple and NeXT, as well as their user and developer communities. Mac OS X exemplifies how a capable system can result from the direct or indirect efforts of corporations, academic and research communities, the Open Source and Free Software movements, and, of course, individuals. Apple has been around since 1976, and many accounts of its history have been told. If the story of Apple as a company is fascinating, so is the technical history of Apple's operating systems. In this chapter,[1] we will trace the history of Mac OS X, discussing several technologies whose confluence eventually led to the modern-day Apple operating system. [1] This book's accompanying web site (www.osxbook.com) provides a more detailed technical history of all of Apple's operating systems. 1 2 2 1 1.1. Apple's Quest for the[2] Operating System [2] Whereas the word "the" is used here to designate prominence and desirability, it is an interesting coincidence that "THE" was the name of a multiprogramming system described by Edsger W. Dijkstra in a 1968 paper. It was March 1988. The Macintosh had been around for four years. -
Australian Open Source Industry & Community Report 2008
The Australian Open Source Industry & Community Report 2008 Sponsors & Industry Community Map of Education & Supporters Respondents Skills 5 9 11 12 15 Careers & Innovation The Market Business Opinion Employment Development 17 19 19 21 23 Methodology. The Australian Open Source Industry & Community Report was Promotion commissioned and executed by Waugh Partners, with the financial support of sponsors, NICTA, IBM and Fujitsu. The Census was directly promoted through a national roadshow which traveled to every capital city, on several mailing lists including Linux We worked closely with psychometricians and statisticians provided by Australia, Open Source Industry Australia and user groups around the NICTA, our primary research partner, to ensure the end-to-end quality country, and through direct contact with Open Source community of the research. While our sponsors and supporters provided feedback members and companies. Indirect promotion included blogging, media at numerous points throughout the project lifecycle, this report is the coverage, and notification to members of the Australia Computer result of independent analysis by Waugh Partners. It is based on data Society, AIIA, OzZope and numerous other organisations. collected through a pair of online surveys held between October and December 2007. Projections Community We have been very careful to make conservative projections, particularly related to industry revenue. The community survey was aimed at “individuals who contribute to Open Source projects and communities in any capacity, not just Our projected industry and export revenue figures are based upon software development”, and received 315 complete and legitimate the projected industry size and spread of companies compared to the responses, with 66 incomplete. -
Packet Capture Procedures on Cisco Firepower Device
Packet Capture Procedures on Cisco Firepower Device Contents Introduction Prerequisites Requirements Components Used Steps to Capture Packets Copy a Pcap File Introduction This document describes how to use the tcpdump command in order to capture packets that are seen by a network interface of your Firepower device. It uses Berkeley Packet Filter (BPF) syntax. Prerequisites Requirements Cisco recommends that you have knowledge of the Cisco Firepower device and the virtual device models. Components Used This document is not restricted to specific software and hardware versions. The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, make sure that you understand the potential impact of any command. Warning: If you run tcpdump command on a production system, it can impact network performance. Steps to Capture Packets Log in to the CLI of your Firepower device. In versions 6.1 and later, enter capture-traffic. For example, > capture-traffic Please choose domain to capture traffic from: 0 - eth0 1 - Default Inline Set (Interfaces s2p1, s2p2) In versions 6.0.x.x and earlier, enter system support capture-traffic. For example, > system support capture-traffic Please choose domain to capture traffic from: 0 - eth0 1 - Default Inline Set (Interfaces s2p1, s2p2) After you make a selection, you will be prompted for options: Please specify tcpdump options desired. (or enter '?' for a list of supported options) Options: In order to capture sufficient data from the packets, it is necessary to use the -s option in order to set the snaplength correctly. -
Adecuándose a La Norma ISO/IEC 1799 Mediante Software Libre
Adecu´andose a la norma ISO/IEC 1799 mediante software libre * Jose Fernando Carvajal Vi´on Grupo de Inter´esen Seguridad de ATI (ATI-GISI) <[email protected]> Javier Fern´andez-Sanguino Pe˜na Grupo de Inter´esen Seguridad de ATI (ATI-GISI) <[email protected]> 28 de octubre de 2002 Resumen Este art´ıculo muestra la forma de adecuar a la norma ISO/IEC 17999 un sistema de informaci´onimplementado en un servidor cuyo software de sistema operativo se basa en alguna alternativa de software Libre y c´odigo abierto. La utilizaci´onde una distribuci´onDebian GNU/Linux sirve como base a la que a˜nadir las utilidades y paquetes necesarios para conseguir el objetivo. ´Indice 1. Introducci´on 1 2. Objetivo y Asunciones 2 3. Cumplimiento de la Norma ISO/IEC 17799 en GNU/Linux 4 4. Conclusiones 4 5. Referencias 5 6. Referencias de herramientas 7 7. Referencias Generales 11 *Copyright (c) 2002 Jose Fernando Carvajal y Javier Fern´andez-Sanguino. Se otorga permiso para copiar, distribuir y/o modificar este documento bajo los t´erminos de la Licencia de Documen- taci´onLibre GNU, Versi´on1.1 o cualquier otra versi´onposterior publicada por la Free Software Foundation. Puede consultar una copia de la licencia en: http://www.gnu.org/copyleft/fdl.html 1 1. Introducci´on De forma general para mantener la seguridad de los activos de informaci´on se deben preservar las caracter´ısticas siguientes [1]. 1. Confidencialidad: s´oloel personal o equipos autorizados pueden acceder a la informaci´on. 2. Integridad: la informaci´on y sus m´etodos de proceso son exactos y completos. -
Ebpf-Based Content and Computation-Aware Communication for Real-Time Edge Computing
eBPF-based Content and Computation-aware Communication for Real-time Edge Computing Sabur Baidya1, Yan Chen2 and Marco Levorato1 1Donald Bren School of Information and Computer Science, UC Irvine e-mail: fsbaidya, [email protected] 2America Software Laboratory, Huawei, e-mail: [email protected] Abstract—By placing computation resources within a one-hop interference constraints on IoT data streams and facilitate their wireless topology, the recent edge computing paradigm is a key coexistence. enabler of real-time Internet of Things (IoT) applications. In In this paper, we propose a computation-aware commu- the context of IoT scenarios where the same information from a sensor is used by multiple applications at different locations, the nication control framework for real-time IoT applications data stream needs to be replicated. However, the transportation generating high-volume data traffic processed at the network of parallel streams might not be feasible due to limitations in the edge. Driven by QoC requirements, the framework provides capacity of the network transporting the data. To address this real-time user-controlled packet replication and forwarding issue, a content and computation-aware communication control inside the in-kernel Virtual Machines (VM) using an extended framework is proposed based on the Software Defined Network (SDN) paradigm. The framework supports multi-streaming using Berkeley Packet Filter (eBPF) [9]. The implementation uses the extended Berkeley Packet Filter (eBPF), where the traffic flow the concepts of SDN and NFV to achieve highly program- and packet replication for each specific computation process is able and dynamic packet replication. Resource allocation is controlled by a program running inside an in-kernel Virtual Ma- semantic and content-aware, and, in the considered case, chine (VM). -
Building Embedded Linux Systems ,Roadmap.18084 Page Ii Wednesday, August 6, 2008 9:05 AM
Building Embedded Linux Systems ,roadmap.18084 Page ii Wednesday, August 6, 2008 9:05 AM Other Linux resources from O’Reilly Related titles Designing Embedded Programming Embedded Hardware Systems Linux Device Drivers Running Linux Linux in a Nutshell Understanding the Linux Linux Network Adminis- Kernel trator’s Guide Linux Books linux.oreilly.com is a complete catalog of O’Reilly’s books on Resource Center Linux and Unix and related technologies, including sample chapters and code examples. ONLamp.com is the premier site for the open source web plat- form: Linux, Apache, MySQL, and either Perl, Python, or PHP. Conferences O’Reilly brings diverse innovators together to nurture the ideas that spark revolutionary industries. We specialize in document- ing the latest tools and systems, translating the innovator’s knowledge into useful skills for those in the trenches. Visit con- ferences.oreilly.com for our upcoming events. Safari Bookshelf (safari.oreilly.com) is the premier online refer- ence library for programmers and IT professionals. Conduct searches across more than 1,000 books. Subscribers can zero in on answers to time-critical questions in a matter of seconds. Read the books on your Bookshelf from cover to cover or sim- ply flip to the page you need. Try it today for free. main.title Page iii Monday, May 19, 2008 11:21 AM SECOND EDITION Building Embedded Linux SystemsTomcat ™ The Definitive Guide Karim Yaghmour, JonJason Masters, Brittain Gilad and Ben-Yossef, Ian F. Darwin and Philippe Gerum Beijing • Cambridge • Farnham • Köln • Sebastopol • Taipei • Tokyo Building Embedded Linux Systems, Second Edition by Karim Yaghmour, Jon Masters, Gilad Ben-Yossef, and Philippe Gerum Copyright © 2008 Karim Yaghmour and Jon Masters. -
Praise for the Official Ubuntu Book
Praise for The Official Ubuntu Book “The Official Ubuntu Book is a great way to get you started with Ubuntu, giving you enough information to be productive without overloading you.” —John Stevenson, DZone Book Reviewer “OUB is one of the best books I’ve seen for beginners.” —Bill Blinn, TechByter Worldwide “This book is the perfect companion for users new to Linux and Ubuntu. It covers the basics in a concise and well-organized manner. General use is covered separately from troubleshooting and error-handling, making the book well-suited both for the beginner as well as the user that needs extended help.” —Thomas Petrucha, Austria Ubuntu User Group “I have recommended this book to several users who I instruct regularly on the use of Ubuntu. All of them have been satisfied with their purchase and have even been able to use it to help them in their journey along the way.” —Chris Crisafulli, Ubuntu LoCo Council, Florida Local Community Team “This text demystifies a very powerful Linux operating system . in just a few weeks of having it, I’ve used it as a quick reference a half dozen times, which saved me the time I would have spent scouring the Ubuntu forums online.” —Darren Frey, Member, Houston Local User Group This page intentionally left blank The Official Ubuntu Book Sixth Edition This page intentionally left blank The Official Ubuntu Book Sixth Edition Benjamin Mako Hill Matthew Helmke Amber Graner Corey Burger With Jonathan Jesse, Kyle Rankin, and Jono Bacon Upper Saddle River, NJ • Boston • Indianapolis • San Francisco New York • Toronto • Montreal • London • Munich • Paris • Madrid Capetown • Sydney • Tokyo • Singapore • Mexico City Many of the designations used by manufacturers and sellers to distinguish their products are claimed as trademarks. -
Security Bugs in Embedded Interpreters
Security bugs in embedded interpreters The MIT Faculty has made this article openly available. Please share how this access benefits you. Your story matters. Citation Haogang Chen, Cody Cutler, Taesoo Kim, Yandong Mao, Xi Wang, Nickolai Zeldovich, and M. Frans Kaashoek. 2013. Security bugs in embedded interpreters. In Proceedings of the 4th Asia-Pacific Workshop on Systems (APSys '13). ACM, New York, NY, USA, Article 17, 7 pages. As Published http://dx.doi.org/10.1145/2500727.2500747 Publisher Edition Open Access Version Author's final manuscript Citable link http://hdl.handle.net/1721.1/86887 Terms of Use Creative Commons Attribution-Noncommercial-Share Alike Detailed Terms http://creativecommons.org/licenses/by-nc-sa/4.0/ Security bugs in embedded interpreters Haogang Chen Cody Cutler Taesoo Kim Yandong Mao Xi Wang Nickolai Zeldovich M. Frans Kaashoek MIT CSAIL Abstract Embedded interpreters raise interesting security con- Because embedded interpreters offer flexibility and per- cerns. First, many real-world systems do not adopt sand- formance, they are becoming more prevalent, and can be boxing techniques such as process isolation [20] or soft- found at nearly every level of the software stack. As one ware fault isolation [28] for embedded interpreters, possi- example, the Linux kernel defines languages to describe bly due to performance considerations. Consequently, a packet filtering rules and uses embedded interpreters to compromise of the interpreter is likely to lead to a com- filter packets at run time. As another example, theRAR promise of the host system as well. Second, embedded in- archive format allows embedding bytecode in compressed terpreters often validate untrusted bytecode using ad-hoc files to describe reversible transformations for decompres- rules, which is error-prone.