NSA的SELinux笔记本：第四版，新增Android支持

需积分: 12 166 浏览量更新于2024-07-21 1 收藏 2.32MB PDF 举报

"《The SELinux Notebook_4th》是由Richard Haines于2014年创作并发布的安全增强型Linux（SELinux）官方文档，是NSA的第四版更新，特别加入了针对Android平台的内容。这份文档旨在促进SELinux的广泛应用和深入研究，遵循GNU Free Documentation License v1.3或更高版本进行授权，并且源代码和脚本遵循GNU General Public License v3或更高版本。文档中包含了用于研究SELinux的实用工具和示例，但不提供任何形式的保证。" SELinux（Security-Enhanced Linux）是美国国家安全局（NSA）开发的一个强制访问控制（MAC）系统，它增强了Linux内核的安全性。SELinux的主要目标是通过严格的策略来限制进程的权限，防止恶意攻击者即使在获得系统某些权限后也能对系统造成破坏。在《The SELinux Notebook_4th》中，读者可以期待学习到以下核心知识点： 1. **SELinux基础**：了解SELinux的基本概念，包括上下文（Context）、类型 Enforcement（TE）、域转换（Domain Transition）和策略模块（Policy Module）。 2. **配置与启用**：如何在系统上安装、配置和启用SELinux，以及如何处理SELinux的相关错误和问题。 3. **策略编写**：学习如何编写和定制SELinux策略，以满足特定应用或服务的需求。 4. **SELinux与Android**：由于Android系统广泛采用了SELinux，这部分内容将详细阐述如何在Android环境中使用和管理SELinux，包括Android的策略和安全增强特性。 5. **审计与调试**：理解如何使用auditd和其他工具来追踪和分析SELinux事件，以便于调试和优化策略。 6. **实用工具**：熟悉如`semanage`、`ausearch`、`chcon`等命令，这些工具在日常管理和维护SELinux系统时非常关键。 7. **文件系统上下文**：学习如何定义和管理文件系统的上下文标签，以控制文件和目录的访问权限。 8. **网络策略**：理解网络服务在SELinux环境下的行为，以及如何配置网络策略以确保安全通信。 9. **进程间通信（IPC）和套接字权限**：探讨如何通过SELinux控制进程间的通信，包括消息队列、信号量和套接字。 10. **应用兼容性**：解决由于SELinux策略导致的软件兼容性问题，确保应用程序能在SELinux环境中正常运行。 11. **案例研究**：通过实际案例，学习如何在不同场景下应用SELinux，提升系统的整体安全性。《The SELinux Notebook_4th》是一份深入且实用的指南，对于希望掌握和利用SELinux提升系统安全性的管理员、开发者和研究人员来说，具有极高的参考价值。通过阅读此书，读者不仅可以理解SELinux的工作原理，还能学会如何在实际环境中有效地部署和管理这一强大的安全机制。

The SELinux Notebook

Object Classes and Permissions - Describes the SELinux object classes and

permissions.

libselinux Functions - Describes the libselinux library functions.

1.2.1 Notebook Source Overview

To demonstrate some of the SELinux capabilities a supporting Notebook source

tarball is available (notebook-source-4.0.tar.gz). The tarball contains

directories and READMEs covering the following:

Building a Basic Policy - Describes how to build monolithic, base and loadable

policy modules using core policy language statements and SELinux commands.

Note that these policies should not to be used in a live environment, they are

examples to show simple policy construction. These can be extended with

additional modules in kernel policy language and CIL.

Example libselinux applications - This contains over 100 samples that use

the libselinux 2.2.1-6 functions. To save typing long context strings it makes

use of a configuration file. There are also some supporting policy modules for the

F-20 targeted policy to show how the functions work.

Example Android emulator device - This replaces the kernel policy language

version with a CIL policy using namespaces. This is built using Android 4.4

AOSP master and will show processes as u:r:kernel.process:s0,

u:r:untrusted_app.process:s0:c512,c768. and files as

u:r:bluetooth.data_file:s0,

u:r:app.data_file:s0:c512,c768 etc..

Page 16

The SELinux Notebook

2. SELinux Overview

2.1 Introduction

SELinux is the primary Mandatory Access Control (MAC) mechanism built into a

number of GNU / Linux distributions. SELinux originally started as the Flux

Advanced Security Kernel (FLASK) development by the Utah university Flux team

and the US Department of Defence. The development was enhanced by the NSA and

released as open source software. The history of SELinux can be found at the Flux

and NSA websites.

Each of the sections that follow will describe a component of SELinux, and hopefully

they are is some form of logical order.

Note: When SELinux is installed, there are three well defined directory locations

referenced. Two of these will change with the old and new locations as follows:

Description Old Location New Location

The SELinux filesystem that

interfaces with the kernel

based security server.

The new location has been

available since Fedora 17.

/selinux /sys/fs/selinux

The SELinux configuration

directory that holds the sub-

system configuration files and

policies.

/etc/selinux

No change

The SELinux policy store that

holds policy modules and

configuration details (see

https://github.com/SELinuxPro

ject/selinux/wiki/Policy-Store-

Migration and Policy Store

Migration).

/etc/selinux/

<SELINUXTYPE>/module

/var/lib/selinux/

<SELINUXTYPE>/module

2.1.1 Is SELinux useful

There are many views on the usefulness of SELinux on Linux based systems, this

section gives a brief view of what SELinux is good at and what it is not (because its

not designed to do it).

SELinux is not just for military or high security systems where Multi-Level Security

(MLS) is required (for functionality such as 'no read up' and 'no write down'), as using

the 'type enforcement' (TE) functionality applications can be confined (or contained)

within domains and limited to the mimimum privileges required to do their job, so in

a 'nutshell':

1. If SELinux is enabled, the policy defines what access to resources and

operations on them (e.g. read, write) are allowed (i.e. SELinux stops all access

Page 17

The SELinux Notebook

unless allowed by policy). This is why SELinux is called a 'mandatory access

control' (MAC) system.

2. The policy design, implementation and testing against a defined security

policy or requirements is important, otherwise there could be 'a false sense of

security'.

3. SELinux can confine an application within its own 'domain' and allow it to

have the minimum priviledges required to do its job. Should the application

require access to networks or other applications (or their data), then (as part of

the security policy design), this access would need to be granted (so at least it

is known what interactions are allowed and what are not - a good security

goal).

4. Should an application 'do something' it is not allowed by policy (intentional or

otherwise), then SELinux would stop these actions.

5. Should an application 'do something' it is allowed by policy, then SELinux

may contain any damage that maybe done intentional or otherwise. For

example if an application is allowed to delete all of its data files or database

entries and the bug, virus or malicious user gains these priviledges then it

would be able to do the same, however the good news is that if the policy

'confined' the application and data, all your other data should still be there.

6. User login sessions can be confined to their own domains. This allows clients

they run to be given only the priviledges they need (e.g. admin users, sales

staff users, HR staff users etc.). This again will confine/limit any damage or

leakage of data.

7. Some applications (X-Windows for example) are difficult to confine as they

are generally designed to have total access to all resources. SELinux can

generally overcome these issues by providing sandboxing services.

8. SELinux will not stop memory leaks or buffer over-runs (because its not

designed to do this), however it may contain the damage that may be done.

9. SELinux will not stop all viruses/malware getting into the system (as there are

many ways they could be introduced (including by legitimate users), however

it should limit the damage or leaks they cause.

10. SELinux will not stop kernel vulnerabilities, however it may limit their

effects.

11. It is easy to add new rules to an SELinux policy using tools such as

audit2allow(1) if a user has the relevant permissions, however be aware

that this may start opening holes, so check what rules are really required.

12. Finally, SELinux cannot stop anything allowed by the security policy, so good

design is important.

The following maybe useful in providing a practical view of SELinux:

1. A discussion regarding Apache servers and SELinux that may look negative at

first but highlights the containment points above. This is the initial study:

http://blog.ptsecurity.com/2012/08/selinux-in-practice-dvwa-test.html, and

this is a response to the study: http://danwalsh.livejournal.com/56760.html.

Page 18

The SELinux Notebook

However with careful design and known security goals the SELinux Apache /

SELinux Plus services could be used to build a more secure web service (also

see http://code.google.com/p/sepgsql/wiki/Apache_SELinux_plus).

2. SELinux services have been added to Andriod, producing SE for Android. The

presentation "The Case for Security Enhanced (SE)Android" [20] gives use-

cases and types of Android exploits that SELinux could have overcome. The

presentation and others are available at:

http://seandroid.bitbucket.org/PapersandPresentation.html#3

2.2 Core SELinux Components

Figure 2.1 shows a high level diagram of the SELinux core components that manage

enforcement of the policy and comprise of the following:

1. A subject that must be present to cause an action to be taken by an object

(such as read a file as information only flows when a subject is involved).

2. An Object Manager that knows the actions required of the particular resource

(such as a file) and can enforce those actions (i.e. allow it to write to a file if

permitted by the policy).

3. A Security Server that makes decisions regarding the subjects rights to

perform the requested action on the object, based on the security policy rules.

4. A Security Policy that describes the rules using the SELinux policy language.

5. An Access Vector Cache (AVC) that improves system performance by

caching security server decisions.

Figure 2.1: High Level Core SELinux Components - Decisions by the Security

Server are cached in the AVC to enhance performance of future requests. Note that it

is the kernel and userspace Object Managers that enforce the policy.

Page 19

Object Manager

Knows what objects it

manages, so queries if the

action is allowed and then

enforces the security

policy decision.

Access Vector

Cache

Stores decisions

made by the

Security Server.

Q u e ry

pe rm i ssi ons

An swer from

C ach e

If ans we r n ot

in cache , ask

secu ri ty serve r

Add answe r

to cache

Security Server

Makes decisions

based on the

security policy.

Security Policy

Subject

Requests access.

The SELinux Notebook

Figure 2.2: High Level SELinux Architecture - Showing the major supporting services

Page 20

Reference Policy

Headers

Reference Policy

Source

Custom Policy

Source

Security

Server

SELinux

Kernel

Services

libselinux (supports security policy, xat t r file attribute and process APIs)

Policy Object

Files

checkmodule

Compiles the policy

source int o

int ermediat e format .

semodule

Manages the policy store by installing, loading, updating

and removing modules and their supporting configuration

files. Also builds the binary policy file.

semanage

Configures elements of

the policy such as login,

users, and port s.

SELinux Policy

---- Policy Store -----

/var/lib/selinux/<SELINUXTYPE>/

modules:

semanage.read.LOCK

semanage.trans.LOCK

modules/active:

base.pp

commit_num

file_contexts

file_contexts.homedirs

file_contexts.template

homedir_template

netfilter_contexts

seusers.final

users_extra

modules/active/modules:

amavis.pp

amtu.pp

...

zabbix.pp

---- Active Policy ----

/etc/selinux/<SELINUXTYPE>/

setrans.conf

policy:

policy.29

contexts:

dbus_contexts

netfilter_contexts

contexts/files:

file_contexts

file_contexts.homedirs

-----------------------

SELinux Configuration Files

/etc/selinux/config

/etc/selinux/semanage.conf

/etc/selinux/restorecond.conf

/etc/sestatus

SELinux Use r

Space Se rvice s

semodule_package

Package the policy modules

with optional configuration

files.

File Labeling Utilities

Utilities that initialise or update

file security contexts, such as

setfiles and restorecon.

/selinux or /sys/fs/selinux (selinuxfs)

Audit Log

Labeled File

Systems

(xattr)

Linux Kernel

Services

policycoreutils

SElinux utilities, such as secon,

audit2allow and system-

config-selinux.

Linux commands

Linux commands modified to

support SELinux, such as ls,

ps, pam.

SELinux-aware Applications

Userspace Object Managers

T hese may use the

libselinux AVC

services or build their

own.

Acce ss

Ve ctor

C ach e

Access

Vector Cache

Loaded

Policy

Policy Files

Optional

Configuration

Files

libselinux

T hese libraries

are linked int o

SELinux aware

applicat ions as

required.

Network, USB etc.

Connectivity

/proc/self/task/

Audit

Services

T hese libraries

are linked int o

SELinux aware

applicat ions as

required.

剩余394页未读，继续阅读

大江之舞

粉丝: 8
资源: 3

NSA的SELinux笔记本：第四版，新增Android支持

selinux中文教程

SELinux中文.pdf

SELinux Notebook 是一本关于 SELinux 的开源书籍，最初由 Richard Haines创建并捐赠给 SE

The_SELinux_Notebook-4th_Edition.zip_SELinux_selinux pdf downloa

The SELinux Notebook 4th Edition

The SELinux Notebook 4thEdition

selinux_internal.rar_SELinux_The First

深入理解SELinux SEAndroid_改.docx

selinux-example_SELinux_

cheat_sheet_selinux_v2_cheat_V2_

最新资源