View access control as a matrix Specifying policy Manually filling out matrix would be tedious • Use tools such as groups or role-based access control: •

dir 1

dir 2

Subjects (processes/users) access objects (.g., files) dir 3 • Each cell of matrix has allowed permissions •

1/33 2/33 Two ways to slice the matrix Example: Unix protection

Along columns: Each process has a User ID & one or more group IDs • • - Kernel stores list of who can access object along with object System stores with each file: • - Most systems you’ve used probably do this - User who owns the file and group file is in - Examples: Unix file permissions, Access Control Lists (ACLs) - Permissions for user, any one in file group, and other Along rows: Shown by output of ls -l command: • • - Capability systems do this user group other owner group - More on these later. . . - rw- rw- r-- dm cs140 ... index.html - Eachz}|{ groupz}|{ z}|{ of threez}|{ lettersz }| { specifies a subset of read, write, and execute permissions - User permissions apply to processes with same user ID - Else, group permissions apply to processes in same group - Else, other permissions apply

3/33 4/33 Unix continued Non-file permissions in Unix

Directories have permission bits, too Many devices show up in file system • • - Need write perm. on directory to create or delete a file - E.g., /dev/tty1 permissions just like for files Special user root (UID 0) has all privileges Other access controls not represented in file system • • - E.g., Read/write any file, change owners of files E.g., must usually be root to do the following: • - Required for administration (backup, creating new users, etc.) - Bind any TCP or UDP port number less than 1,024 Example: • - Change the current process’s user or group ID - drwxr-xr-x 56 root wheel 4096 Apr 4 10:08 /etc - Mount or unmount file systems - Directory writable only by root, readable by everyone - Create device nodes (such as /dev/tty1) in the file system - Means non-root users cannot directly delete files in /etc - Change the owner of a file - Execute permission means ability to use pathnames in the - Set the time-of-day clock; halt or reboot machine directory, separate from read permission which allows listing

5/33 6/33 Example: Login runs as root Setuid Unix users typically stored in files in /etc • passwd group shadow master.passwd Some legitimate actions require more privs than UID - Files , , and often or • For each user, files contain: - E.g., how should users change their passwords? • - Textual username (e.g., “dm”, or “root”) - Stored in root-owned /etc/passwd & /etc/shadow files Solution: Setuid/setgid programs - Numeric user ID, and group ID(s) • - One-way hash of user’s password: salt, H(salt, passwd) - Run with privileges of file’s owner or group { } - Other information, such as user’s full name, login shell, etc. - Each process has real and effective UID/GID /usr/bin/login runs as root - real is user who launched setuid program • - Reads username & password from terminal - effective is owner/group of file, used in access checks /etc/passwd Shown as “s” in file listings - Looks up username in , etc. • - Computes H(salt, typed password) & checks that it matches - -rws--x--x 1 root root 38464 Jan 26 14:26 /bin/passwd - If matches, sets group ID & user ID corresponding to username - Obviously need to own file to set the setuid bit - Execute user’s shell with execve system call - Need to own file and be in group to set setgid bit

7/33 8/33 Setuid (continued) Other permissions Examples • When can proc. A send a signal to proc. B w. kill? - E.g., /usr/bin/passwd – changes user’s password • - Allow if sender and receiver have same effective UID - E.g., /bin/su – acquire new user ID with correct password - But need ability to kill processes you launch even if suid - E.g., /usr/bin/netstat – lists network connections (by reading kernel memory on some OSes) - So allow if real UIDs match, as well Have to be very careful when writing setuid code - Can also send SIGCONT w/o UID match if in same session • Debugger system call ptrace - Attackers can run setuid programs any time (no need to wait • for root to run a vulnerable job) - Lets one process modify another’s memory - Attacker controls many aspects of program’s environment - Setuid gives a program more privilege than invoking user Example attacks when running a setuid program - So don’t let process ptrace more privileged process • - Change PATH or IFS if setuid prog calls system(3) - E.g., Require sender to match real & effective UID of target - Set maximum file size to zero (if app rebuilds DB) - Also disable/ignore setuid if ptraced target calls exec - Close fd 2 before running program—may accidentally send - Exception: root can ptrace anyone error message into protected file

9/33 10/33 A security hole An attack

Even without root or setuid, attackers can trick root find/rm Attacker • owned processes into doing things. . . creat (“/tmp/badetc/passwd”) readdir (“/tmp”) “badetc” Example: Want to clear unused files in /tmp → • lstat (“/tmp/badetc”) DIRECTORY Every night, automatically run this command as root: → • readdir (“/tmp/badetc”) “passwd” find /tmp -atime +3 -exec rm -f -- {} \; → rename (“/tmp/badetc” “/tmp/x”) find identifies files not accessed in 3 days → • symlink (“/etc”, “/tmp/badetc”) - executes rm, replacing with file name {} unlink (“/tmp/badetc/passwd”) rm -f -- path deletes file path • - Note “--” prevents path from being parsed as option Time-of-check-to-time-of-use (TOCTTOU) bug • What’s wrong here? - find checks that /tmp/badetc is not symlink • - But meaning of file name changes before it is used

11/33 12/33 xterm command xterm command

Provides a terminal window in X-windows Provides a terminal window in X-windows • • Used to run with setuid root privileges Used to run with setuid root privileges • • - Requires kernel pseudo-terminal (pty) device - Requires kernel pseudo-terminal (pty) device - Required root privs to change ownership of pty to user - Required root privs to change ownership of pty to user - Also writes protected utmp/wtmp files to record users - Also writes protected utmp/wtmp files to record users Had feature to log terminal session to file Had feature to log terminal session to file • if (access (logfile, W_OK) < 0) • if (access (logfile, W_OK) < 0) return ERROR; return ERROR; fd = open (logfile, O_CREAT|O_WRONLY|O_TRUNC, 0666); fd = open (logfile, O_CREAT|O_WRONLY|O_TRUNC, 0666); /* ... */ /* ... */ What’s wrong here? xterm is root, but shouldn’t log to file user can’t write • • access call avoids dangerous security hole • - Does permission check with real, not effective UID

13/33 13/33 xterm command An attack

Provides a terminal window in X-windows xterm Attacker • Used to run with setuid root privileges creat (“/tmp/X”) • - Requires kernel pseudo-terminal (pty) device access (“/tmp/X”) OK → - Required root privs to change ownership of pty to user unlink (“/tmp/X”) - Also writes protected utmp/wtmp files to record users symlink (“/tmp/X” “/etc/passwd”) → Had feature to log terminal session to file open (“/tmp/X”) • if (access (logfile, W_OK) < 0) return ERROR; fd = open (logfile, O_CREAT|O_WRONLY|O_TRUNC, 0666); Attacker changes /tmp/X between check and use /* ... */ • - xterm unwittingly overwrites /etc/passwd xterm is root, but shouldn’t log to file user can’t write - Another TOCTTOU bug • access call avoids dangerous security hole OpenBSD man page: “CAVEATS: access() is a • • - Does permission check with real, not effective UID potential security hole and should never be used.” - Wrong: Another TOCTTOU bug 13/33 14/33 SSH configuration files Trick question: ptrace bug

SSH 1.2.12 – secure login program, runs as root Actually do have more privileges than user! • • - Needs to bind TCP port under 1,024 (privileged operation) - Bound privileged port and read host private key - Needs to read client private key (for host authentication) Dropping privs allows user to “debug” SSH • Also needs to read & write files owned by user - Depends on OS, but at the time several had ptrace • - Read configuration file ~/.ssh/config implementations that made SSH vulerable - Record server keys in ~/.ssh/known hosts Once in debugger • Author wanted to avoid TOCTTOU bugs: - Could use privileged port to connect anywhere • - First binds socket & reads root-owned secret key file - Could read secret host key from memory - Then drops all privileges before accessing user files—real and - Could overwrite local user name to get privs of other user effective user IDs those of invoking user The fix: restructure into 3 processes! • - Idea: avoid using any user-controlled arguments/files until - Perhaps overkill, but really wanted to avoid problems you have no more privileges than the user - What might still have gone wrong?

15/33 16/33

A Linux security hole Editorial

Some programs acquire then release privileges • su user user Previous examples show two limitations of Unix - E.g., is setuid root, becomes if password correct • Consider the following: Many OS security policies subjective not objective • • - A and B unprivileged processes owned by attacker - When can you signal/debug process? Re-bind network port? - A ptraces B - Rules for non-file operations somewhat incoherent - A executes “su user” to its own identity - Even some file rules weird (Creating hard links to files) - While su is superuser, B execs su root Correct code is much harder to write than incorrect • (A is superuser, so this is not disabled) - Delete file without traversing symbolic link - A types password, gets shell, and is attached to su root - Read SSH configuration file (requires 3 processes??) - Can manipulate su root’s memory to get root shell - Write mailbox owned by user in dir owned by root/mail Don’t just blame the application writers • - Must also blame the interfaces they program to

17/33 18/33 Another security problem [Hardy] A confused deputy

Setting: A multi-user time sharing system Attacker could overwrite any files in /sysx • • - This time it’s not Unix - System billing records kept in /sysx/bill got wiped Wanted fortran compiler to keep statistics - Probably command like fort -o /sysx/bill file.f • - Modified compiler /sysx/fort to record stats in /sysx/stat Is this a bug in the compiler fort? • - Gave compiler “home files license”—allows writing to - Original implementors did not anticipate extra rights anything in /sysx (kind of like Unix setuid) - Can’t blame them for unchecked output file What’s wrong here? Compiler is a “confused deputy” • • - Inherits privileges from invoking user (e.g., read file.f) - Also inherits privileges from home files license - Which master is it serving on any given system call? - OS doesn’t know if it just sees open ("/sysx/bill", ...)

19/33 20/33 Recall access control matrix Capabilities

Slicing matrix along rows yields capabilities • - E.g., For each process, store a list of objects it can access - Process explicitly invokes particular capabilities Can help avoid confused deputy problem • - E.g., Must give compiler an argument that both specifies the output file and conveys the capability to write the file (think about passing a file descriptor, not a file name) - So compiler uses no to write file Three general approaches to capabilities: • - Hardware enforced (Tagged architectures like M-machine) - Kernel-enforced (, KeyKOS) - Self-authenticating capabilities (like Amoeba) Good history in [Levy] • 21/33 22/33