Security Officer and System Administrator Separation of Duties

Security Officer and System Administrator Separation of Duties

[Fleischman, Eric]

I am a complete newcomer to SELinux but I did not notice any answer to my question on the Mail List Archives (though I didn't look at every entry). 

I hope to be able to configure SELinux so that it would have policies that correspond to the traditional DoD Separation of Duties with Least Privilege practice of establishing different roles/functions for Network Administrators than for Security Officers. Specifically, I'd like the Security Officer to be solely able to establish/modify accounts and passwords, establish group memberships, establish user role memberships, etc. However, the Security Officer must not be able to perform any other traditional sysadm_r:sysadm_t functions. Similarly, I want the sysadm_r:sysadm_t to no longer be able to perform the functionalities that have now become within the sole auspices of the Security Officer. Is this possible to do? If so, how can I do this? 

Thank you for your attention to this request.

--Eric


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: Security Officer and System Administrator Separation of Duties

[Tom]

On Thu, Oct 02, 2003 at 03:42:30PM -0700, Fleischman, Eric wrote:
> I hope to be able to configure SELinux so that it would have policies that correspond to the traditional DoD Separation of Duties with Least Privilege practice of establishing different roles/functions for Network Administrators than for Security Officers. Specifically, I'd like the Security Officer to be solely able to establish/modify accounts and passwords, establish group memberships, establish user role memberships, etc. However, the Security Officer must not be able to perform any other traditional sysadm_r:sysadm_t functions. Similarly, I want the sysadm_r:sysadm_t to no longer be able to perform the functionalities that have now become within the sole auspices of the Security Officer. Is this possible to do? If so, how can I do this? 

This should be possible, in theory. In a practical implementation,
there are possibly a lot of holes that might be used to elevate
priviledges.

The most obvious example is, of course, that if the security officer
can modify the policy, he can grant himself additional rights.


What you certainly can do is create a sysadm_r that is limited in the
respect you wish, i.e. can not add/edit users or modify the policy.

-- 
http://web.lemuria.org/pubkey.html
pub  1024D/2D7A04F5 2002-05-16 Tom Vogt <tom@lemuria.org>
     Key fingerprint = C731 64D1 4BCF 4C20 48A4  29B2 BF01 9FA1 2D7A 04F5

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: Security Officer and System Administrator Separation of Duties

[Russell Coker]

On Fri, 3 Oct 2003 10:55, Tom wrote:
> This should be possible, in theory. In a practical implementation,
> there are possibly a lot of holes that might be used to elevate
> priviledges.
>
> The most obvious example is, of course, that if the security officer
> can modify the policy, he can grant himself additional rights.

What we need are some utilities with domain_auto_trans() rules to modify the 
policy, they would restrict themselves to modifying the users file.

> What you certainly can do is create a sysadm_r that is limited in the
> respect you wish, i.e. can not add/edit users or modify the policy.

To so that we need to have the package management system check package 
signatures and only install files in types such as fsadm_exec_t if they are 
from signed packages from the distribution (not local packages).  Then we 
need to make sure that the administrator does not get write access to any 
such files (if they can replace fsck then they can get direct file system 
access and modify /etc/shadow etc).

Of course if the machine gets damaged in some way such that it can't boot then 
someone will have to fix it, and neither of the two described roles will have 
the necessary privs.

-- 
http://www.coker.com.au/selinux/   My NSA Security Enhanced Linux packages
http://www.coker.com.au/bonnie++/  Bonnie++ hard drive benchmark
http://www.coker.com.au/postal/    Postal SMTP/POP benchmark
http://www.coker.com.au/~russell/  My home page


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: Security Officer and System Administrator Separation of Duties

[Tom]

On Fri, Oct 03, 2003 at 04:55:06PM +1000, Russell Coker wrote:
> > What you certainly can do is create a sysadm_r that is limited in the
> > respect you wish, i.e. can not add/edit users or modify the policy.
> 
> To so that we need to have the package management system check package 
> signatures and only install files in types such as fsadm_exec_t if they are 
> from signed packages from the distribution (not local packages).  Then we 
> need to make sure that the administrator does not get write access to any 
> such files (if they can replace fsck then they can get direct file system 
> access and modify /etc/shadow etc).

For starters, I would simply disallow the sysadm_r write access to
these tools. Yes, that means only the secadm_r can update the policy
tools, but I'd consider that a feature, not a bug.



-- 
http://web.lemuria.org/pubkey.html
pub  1024D/2D7A04F5 2002-05-16 Tom Vogt <tom@lemuria.org>
     Key fingerprint = C731 64D1 4BCF 4C20 48A4  29B2 BF01 9FA1 2D7A 04F5

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: Security Officer and System Administrator Separation of Duties

[Russell Coker]

On Fri, 3 Oct 2003 20:19, Tom wrote:
> On Fri, Oct 03, 2003 at 04:55:06PM +1000, Russell Coker wrote:
> > To so that we need to have the package management system check package
> > signatures and only install files in types such as fsadm_exec_t if they
> > are from signed packages from the distribution (not local packages). 
> > Then we need to make sure that the administrator does not get write
> > access to any such files (if they can replace fsck then they can get
> > direct file system access and modify /etc/shadow etc).
>
> For starters, I would simply disallow the sysadm_r write access to
> these tools. Yes, that means only the secadm_r can update the policy
> tools, but I'd consider that a feature, not a bug.

I think that perhaps you misunderstood my message.  My point is that anyone 
who can write to programs such as fsck and run them in their usual context 
can trivially bypass any other security restrictions.

Upgrading fsck if necessary is an occasional job for the administrator, 
running it is a regular chore.

If you use policy to enforce a split of duties between sys-admin and security 
admin then it will be somewhat difficult, and there will be times when a user 
needs a set of access rights greater than the sum of sys-admin and security 
admin is required.

-- 
http://www.coker.com.au/selinux/   My NSA Security Enhanced Linux packages
http://www.coker.com.au/bonnie++/  Bonnie++ hard drive benchmark
http://www.coker.com.au/postal/    Postal SMTP/POP benchmark
http://www.coker.com.au/~russell/  My home page


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: Security Officer and System Administrator Separation of Duties

[Tom]

On Fri, Oct 03, 2003 at 09:32:33PM +1000, Russell Coker wrote:
> I think that perhaps you misunderstood my message.  My point is that anyone 
> who can write to programs such as fsck and run them in their usual context 
> can trivially bypass any other security restrictions.

I get you.

Yes, it appears that a good configuration will need a third role for
software updates and machine-level configurations.


-- 
http://web.lemuria.org/pubkey.html
pub  1024D/2D7A04F5 2002-05-16 Tom Vogt <tom@lemuria.org>
     Key fingerprint = C731 64D1 4BCF 4C20 48A4  29B2 BF01 9FA1 2D7A 04F5

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: Security Officer and System Administrator Separation of Duties

[Russell Coker]

On Sat, 4 Oct 2003 00:53, Tom wrote:
> On Fri, Oct 03, 2003 at 09:32:33PM +1000, Russell Coker wrote:
> > I think that perhaps you misunderstood my message.  My point is that
> > anyone who can write to programs such as fsck and run them in their usual
> > context can trivially bypass any other security restrictions.
>
> I get you.
>
> Yes, it appears that a good configuration will need a third role for
> software updates and machine-level configurations.

If that is the case then we need to fix the policy to allow multiple 
admin_domain() entries.

Currently no-one has written any policy that has more than one admin_domain, 
so the chances of that working are quite small.

-- 
http://www.coker.com.au/selinux/   My NSA Security Enhanced Linux packages
http://www.coker.com.au/bonnie++/  Bonnie++ hard drive benchmark
http://www.coker.com.au/postal/    Postal SMTP/POP benchmark
http://www.coker.com.au/~russell/  My home page


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: Security Officer and System Administrator Separation of Duties

[Stephen Smalley]

On Thu, 2003-10-02 at 18:42, Fleischman, Eric wrote:
> I am a complete newcomer to SELinux but I did not notice any answer 
> to my question on the Mail List Archives (though I didn't look at every entry). 
> 
> I hope to be able to configure SELinux so that it would have policies 
> that correspond to the traditional DoD Separation of Duties with Least
>  Privilege practice of establishing different roles/functions for Network 
> Administrators than for Security Officers. Specifically, I'd like the Security
>  Officer to be solely able to establish/modify accounts and passwords, 
> establish group memberships, establish user role memberships, etc. However, 
> the Security Officer must not be able to perform any other traditional 
> sysadm_r:sysadm_t functions. Similarly, I want the sysadm_r:sysadm_t to no 
> longer be able to perform the functionalities that have now become within the 
> sole auspices of the Security Officer. Is this possible to do? If so, how can 
> I do this? 

This has come up several times in the past on the mailing list, e.g. see
http://marc.theaimsgroup.com/?l=selinux&m=105457887918050&w=2
http://marc.theaimsgroup.com/?l=selinux&m=101965643900447&w=2
http://marc.theaimsgroup.com/?l=selinux&m=100799744813965&w=2

It is possible to do, but you need to give it some careful thought to
provide any real security benefit (see the discussions referenced
above).  However, I do think that this would be worthwhile to do.

-- 
Stephen Smalley <sds@epoch.ncsc.mil>
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.