Rule Set Based Access Control (RSBAC) - Examples

| # Rule Set Based Access Control (RSBAC) for Linux - Examples

## 1. Privacy Model Example

This example is described in a separate document.

## 2. Tampering Protection for Executables

### Administration Goal

Protect all executables, e.g. below /sbin, against tampering

### Common steps for all models

- Identify all directories containing executables and all single executables in other directories. As long as the most important directories, e.g. /sbin, /bin, /usr/sbin, /usr/bin, are included, you can find the rest with trial and error later.

### FF solution

1. Set ff_flags search_only and read_only for all identified directories. The flag search_only means that you can only access objects in a directory, if you know the exact path, and that you are not allowed to change anything about the directory itself.
2. Set read_only for all identified separate executables. The flag read_only means that the directory with all its subobjects is set to read-only.
3. If you need to read the directory contents, remove the search_only flag. The read_only flag is still applied.
4. If a directory contains binary executables only and no scripts, you can set the flag execute_only for it. This means that all files below may only be executed, but not read (copied) or anything else.

### RC solution

1. Create a new FD type 'Executables'.
2. Give all roles rights SEARCH and EXECUTE for this type.
3. If you need to READ_OPEN the files, e.g. scripts, add rights READ_OPEN and CLOSE.
4. For filename completion in the shell, you need READ right, possibly also GET_STATUS_DATA or GET_PERMISSIONS_DATA.
5. Set the new FD type 'Executables' for all identified directories and files.
6. If you want to allow executable modification or installation for one role, e.g. 'Installer', just add the necessary rights to type 'Executables' for this role.

### ACL solution

1. Set the inheritance mask to SEARCH and EXECUTE only for all identified directories and files.
2. If you need to READ_OPEN the files, e.g. scripts, add rights READ_OPEN and CLOSE.
3. For filename completion in the shell, you need READ right, possibly also GET_STATUS_DATA or GET_PERMISSIONS_DATA.
4. As the SUPERVISOR right includes all other rights and can (usually) not be masked out, all subjects with SUPERVISOR on a higher level still have full access. In the standard setup, only user 400 (Security Officer etc.) has this right to the FD default ACL (and thus to all files and directories).
5. If you want to allow executable modification or installation for a subject, e.g. group 'Installers', just add an entry for this subject with the necessary rights to the directory or file ACL.
6. If you want to be sure not to miss such entries later, you can find all ACL entries with acl_tlist -r.

## 3. Protection against unwanted Execution

### Administration Goals

1. Protect against execution of uncontrolled files or libraries

### Common steps for all models

- Identify all directories containing executables and all single executables in other directories. Also, identify all directories containing dynamically linked libraries and all such single library files in other directories. As long as the most important directories, e.g. /sbin, /bin, /usr/sbin, /usr/bin, and files, e.g. /lib/*.so* and /usr/lib/*.so* are included, you can find the rest with trial and error later.

- Attention: If you miss an important directory or file during identification or attribute setting, the system might become unaccessible, because important programs cannot be executed or important libraries cannot be mmapped for execution!

### FF solution

1. Remove add_inherited flag for all identified directories.
2. Remove add_inherited flag for all identified separate executables and libraries
3. Set no_execute flag on top dir
4. Without add_inherited, the no_execute flag is not inherited and thus not applied to the identified dirs and separate executables

### RC solution

1. Perform steps 1-5 from RC solution 2. Make a similar setup for library directories and files with another type 'Libraries'.
2. Remove EXECUTE and MAP_EXEC rights to all types other than 'Executables' and 'Libraries' from all roles. For setup checking, remove the right for your Role Admin last and first try other roles.

### ACL solution

1. Grant rights SEARCH and EXECUTE to group 0 ('Everyone') for all identified directories and files.
2. If you need to READ_OPEN the files, e.g. libraries or scripts, add rights READ_OPEN and CLOSE.
3. For filename completion in the shell, you need READ right, possibly also GET_STATUS_DATA or GET_PERMISSIONS_DATA.
4. Remove right EXECUTE from the inheritance mask of the root dir / or from all entries in the default FD acl.
5. If you have individual ACL entries at any directory or file other than the identified ones, revoke EXECUTE right from them. You can find all ACL entries with acl_tlist -r.
6. As the SUPERVISOR right includes all other rights and can (usually) not be masked out, all subjects with SUPERVISOR still have full access. In the standard setup, only user 400 (Security Officer etc.) has this right to the FD default ACL (and thus to all files, fifos and directories).

Questions, tips, etc.

28-May-02, -ao