A Trusted Path Design and Implementation for Security Enhanced Linux
Total Page:16
File Type:pdf, Size:1020Kb
View metadata, citation and similar papers at core.ac.uk brought to you by CORE provided by Calhoun, Institutional Archive of the Naval Postgraduate School Calhoun: The NPS Institutional Archive Theses and Dissertations Thesis Collection 2004-09 A Trusted Path design and implementation for Security Enhanced Linux Hilchie, Allan T. Monterey, California. Naval Postgraduate School http://hdl.handle.net/10945/9954 NAVAL POSTGRADUATE SCHOOL MONTEREY, CALIFORNIA THESIS A TRUSTED PATH DESIGN AND IMPLEMENTATION FOR SECURITY ENHANCED LINUX by Allan T. Hilchie September 2004 Thesis Advisor: Cynthia E. Irvine Thesis Co-Advisor: David Shifflett Approved for public release; distribution is unlimited THIS PAGE INTENTIONALLY LEFT BLANK REPORT DOCUMENTATION PAGE Form Approved OMB No. 0704-0188 Public reporting burden for this collection of information is estimated to average 1 hour per response, including the time for reviewing instruction, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing this burden, to Washington headquarters Services, Directorate for Information Operations and Reports, 1215 Jefferson Davis Highway, Suite 1204, Arlington, VA 22202-4302, and to the Office of Management and Budget, Paperwork Reduction Project (0704-0188) Washington DC 20503. 1. AGENCY USE ONLY (Leave blank) 2. REPORT DATE 3. REPORT TYPE AND DATES COVERED September 2004 Master’s Thesis 4. TITLE AND SUBTITLE: A Trusted Path Design and Implementation for 5. FUNDING NUMBERS Security Enhanced Linux 6. AUTHOR(S) Allan T. Hilchie 7. PERFORMING ORGANIZATION NAME(S) AND ADDRESS(ES) 8. PERFORMING Naval Postgraduate School ORGANIZATION REPORT Monterey, CA 93943-5000 NUMBER 9. SPONSORING /MONITORING AGENCY NAME(S) AND ADDRESS(ES) 10. SPONSORING/MONITORING N/A AGENCY REPORT NUMBER 11. SUPPLEMENTARY NOTES The views expressed in this thesis are those of the author and do not reflect the official policy or position of the Department of Defense or the U.S. Government. 12a. DISTRIBUTION / AVAILABILITY STATEMENT 12b. DISTRIBUTION CODE Approved for public release; distribution is unlimited 13. ABSTRACT (maximum 200 words) The threat posed by malicious software and networked adversaries to computers has resulted in the development of mechanisms to provide assurance that security sensitive information is not being compromised. One such mechanism is called a Trusted Path. A Trusted Path provides a protected communications channel that permits the computer to authenticate itself to the user and for the user to authenticate to the system. This thesis provides a demonstration implementation of a Trusted Path for Security Enhanced Linux (SELinux) and is used to examine trusted paths, their design and implementation. Additionally, the effectiveness of a Trusted Path for SELinux is analyzed. This research is meant to provide a framework that could be used in combination with other efforts to enhance the security of SELinux. 14. SUBJECT TERMS Linux, Security Enhanced Linux, Trusted Path, Secure Attention Key, 15. NUMBER OF Computer Security PAGES 141 16. PRICE CODE 17. SECURITY 18. SECURITY 19. SECURITY 20. LIMITATION CLASSIFICATION OF CLASSIFICATION OF THIS CLASSIFICATION OF OF ABSTRACT REPORT PAGE ABSTRACT Unclassified Unclassified Unclassified UL NSN 7540-01-280-5500 Standard Form 298 (Rev. 2-89) Prescribed by ANSI Std. 239-18 i THIS PAGE INTENTIONALLY LEFT BLANK ii Approved for public release, distribution is unlimited A TRUSTED PATH DESIGN AND IMPLEMENTATION FOR SECURITY ENHANCED LINUX Allan T. Hilchie Civilian, Department of the Navy B.S., Northern Arizona University, 2000 Submitted in partial fulfillment of the requirements for the degree of MASTER OF SCIENCE IN COMPUTER SCIENCE from the NAVAL POSTGRADUATE SCHOOL September 2004 Author: Allan T. Hilchie Approved by: Cynthia E. Irvine Thesis Advisor David Shifflett Thesis Co-Advisor Peter Denning Chairman, Department of Computer Science iii THIS PAGE INTENTIONALLY LEFT BLANK iv ABSTRACT The threat posed by malicious software and networked adversaries to computers has resulted in the development of mechanisms to provide assurance that security sensitive information is not being compromised. One such mechanism is called a Trusted Path. A Trusted Path provides a protected communications channel that permits the computer to authenticate itself to the user and for the user to authenticate to the system. This thesis provides a demonstration implementation of a Trusted Path for Security Enhanced Linux (SELinux) and is used to examine trusted paths, their design and implementation. Additionally, the effectiveness of a Trusted Path for SELinux is analyzed. This research is meant to provide a framework that could be used in combination with other efforts to enhance the security of SELinux. v THIS PAGE INTENTIONALLY LEFT BLANK vi TABLE OF CONTENTS I. INTRODUCTION........................................................................................................1 A. OVERVIEW.....................................................................................................1 B. HISTORICAL BACKGROUND....................................................................1 C. PURPOSE OF STUDY....................................................................................3 1. Scope and Assumptions .......................................................................3 2. Research Objectives.............................................................................3 II. OVERVIEW OF SECURITY ENHANCED LINUX...............................................5 A. BACKGROUND ..............................................................................................5 B. SELINUX SECURITY OVERVIEW ............................................................7 C. SELINUX SECURITY CONCEPTS .............................................................8 1. Type.......................................................................................................8 2. Domain..................................................................................................8 3. Identity..................................................................................................8 4. Role........................................................................................................9 5. Security Context...................................................................................9 6. Transition..............................................................................................9 D. SELINUX SECURITY ASSESSMENT.........................................................9 III. COMMON CRITERIA TRUSTED PATH REQUIREMENTS ...........................11 IV. AN ABSTRACT TRUSTED PATH.........................................................................15 A. ASSUMPTIONS.............................................................................................15 B. THREATS ......................................................................................................16 1. Sniffing................................................................................................16 2. Spoofing ..............................................................................................16 3. Denial of Service.................................................................................16 4. Circumvention of the Trusted Path..................................................17 C. SYSTEM GOALS ..........................................................................................17 D. SUBVERTING THE SYSTEM GOALS .....................................................18 E. DESIGN APPROACHES..............................................................................19 V. DESIGN REQUIREMENTS FOR THE SECURITY ENHANCED LINUX TRUSTED PATH ......................................................................................................21 A. COMMON CRITERIA REQUIREMENTS ...............................................21 1. FTP_TRP.1.1......................................................................................21 2. FTP_TRP.1.2......................................................................................21 3. FTP_TRP.1.3......................................................................................21 4. Function Requirement Discussion....................................................22 B. NON-FUNCTIONAL REQUIREMENTS...................................................22 C. REFINING THE FUNCTIONAL REQUIREMENTS ..............................22 1. Functional Sub-Requirements Supporting FTP_TRP.1.1 .............23 2. Functional Sub-Requirements Supporting FTP_TRP.1.2 .............23 vii 3. Functional Sub-Requirements Supporting FTP_TRP.1.3 .............23 4. Additional Functional Sub-Requirements.......................................23 VI. HIGH LEVEL DESIGN FOR THE SECURITY ENHANCED LINUX TRUSTED PATH ......................................................................................................25 A. DESIGN REQUIREMENT DISCUSSION .................................................25 B. ARCHITECTURAL REQUIREMENTS ....................................................25 1. Trusted Path Kernel Module (TP_Kern) ........................................26 2. Trusted Path User Module (TP_User) .............................................26 C. TRUSTED PATH STATES ..........................................................................26