Re: Root-only systems

[Russell Coker <russell@coker.com.au>]

On Tue, 21 Jan 2003 01:31, forrest whitcher wrote:
> I'm actually trying to go the other direction, and remove some of the
> Unix/Posix root concepts. Presently the lsm/selinux checks are run in
> addition to the unix uid/gid checks, failing either can deny the
> privelege.
>
> As a strong tool is in place, why for instance do we still want to
> require UID=0 to bind a low-number network port or access device
> drivers etc?

One really good reason is the way that SE Linux is deployed on running 
servers.

If I have a running machine then I can't entirely rebuild it immediately, so I 
install SE Linux in permissive mode, and apart from the potential of someone 
typing "avc_toggle" at the wrong time it'll keep running as before.

If we allow non-root to bind to low ports (for example) then permissive mode 
would be significantly less secure than a non-SE machine.  If we don't allow 
such operations in permissive mode then permissive and enforcing modes will 
be functionally different.

Also once we have a system running in enforcing mode we know that if the SE 
Linux policy fails us then we still have Unix permissions.  If we weaken the 
standard Unix permissions then new users will not be granted the assurance of 
"the worst security problem it can have is to run like a regular Unix 
system".

> Otoh, I expect the number of places where UID=0 checks have been
> built into both the kernel and userspace tools may make practically
> eliminating root from low-level operations a bit of a stretch.

The issue of binding to low ports is not difficult to fix.  The other big one 
is setuid(), the rest probably don't matter much.

-- 
http://www.coker.com.au/selinux/   My NSA Security Enhanced Linux packages
http://www.coker.com.au/bonnie++/  Bonnie++ hard drive benchmark
http://www.coker.com.au/postal/    Postal SMTP/POP benchmark
http://www.coker.com.au/~russell/  My home page


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.