[Fwd: [idea] web-application security powered by SELinux]

[Fwd: [idea] web-application security powered by SELinux]

[KaiGai Kohei]

FYI,

I posted a message to open discussion for SELinux support on apache/httpd.
If you like to join the topic, please subscribe the "http-dev" list here.

  http://httpd.apache.org/lists.html#http-dev

-------- Original Message --------
Subject: [idea] web-application security powered by SELinux
Date: Wed, 25 Mar 2009 09:55:06 +0900
From: KaiGai Kohei <kaigai@ak.jp.nec.com>
Reply-To: dev@httpd.apache.org
To: dev@httpd.apache.org

Hello,

Now I have considered the way to work web-applications with restrictive
privileges set based on an identification of the client. It enables to
check and prevent violated actions from (buggy) applications using
features provided by the operating system.

I'm concerned about most of web-application, such as PHP scripts, are
launched as part of web-server process itself. It also means all the
web-application instances share the same privilege set of the server
process, even if these are invoked on the requests come from different
users. In other word, we cannot apply valid access controls on them
(except for ones applied by web-application itself, but it is hard to
ensure they don't have security bugs), because it seems to the operating
system multiple processes/threads with same privileges run simultaneously.

If we can run web-applications with more restrictive privileges set
for each users, groups and so on, the operating system can acquire
any actions from userspace and apply its access control policies.
I assume SELinux as the operating system feature here, but not
limited to SELinux. I guess this discussion can be applied on any
other advanced security features also.

In my opinion, we need the following three facilities:

1. The backend identifies the client and decide what privileges should
   be assigned on the launched web-applications prior to its invocation.
   The existing http-authentication is a candidate, but we don't assume
   a certain method to identify the client.

2. The backend creates a one-time thread or process to handle the given
   requests, and assigns the new privileges, then launches the worker
   thread or process to invoke contents handler.

3. The backend wait for the completion of the worker. The reason why
   we don't use them again is that it is fundamentally danger to allow
   a path to revert the privileges of web-application.

Please note that we don't assume users who want to use this feature
give first priority for performance. It is a kind of security tradeoff.

One idea is to add a security focused MPM which provide above features
and hooks for external modules.
I've actually developed a working example based on the "prefork" MPM.
When it accepts a request from the client, it creates a one-time thread
and assigns a new security context (which is a privileges set in SELinux),
then invokes contents handler.

  http://code.google.com/p/sepgsql/source/browse/misc/httpd-selinux/

However, I don't adhere the current implementation as is.
I would like to have a discussion to brush up the idea to achieve
the goal and to get acceptance in the mainline.

Any comments, questions and others are welcome.

Thanks,
-- 
OSS Platform Development Division, NEC
KaiGai Kohei <kaigai@ak.jp.nec.com>

-- 
OSS Platform Development Division, NEC
KaiGai Kohei <kaigai@ak.jp.nec.com>

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: [Fwd: [idea] web-application security powered by SELinux]

[Jan-Frode Myklebust]

[-- Attachment #1: Type: text/plain, Size: 1414 bytes --]

On Wed, Mar 25, 2009 at 10:08:55AM +0900, KaiGai Kohei wrote:
> 
> One idea is to add a security focused MPM which provide above features
> and hooks for external modules.
> I've actually developed a working example based on the "prefork" MPM.
> When it accepts a request from the client, it creates a one-time thread
> and assigns a new security context (which is a privileges set in SELinux),
> then invokes contents handler.
> 
>   http://code.google.com/p/sepgsql/source/browse/misc/httpd-selinux/
> 
> However, I don't adhere the current implementation as is.
> I would like to have a discussion to brush up the idea to achieve
> the goal and to get acceptance in the mainline.
> 
> Any comments, questions and others are welcome.
> 

I've been patiently hoping you would return to this idea, but it's
not quite tackling my problem. I was hoping for something more
similar to mod_privileges, where each virtual host is running in
a separate selinux domain. That would be very usefull for ISP's
offering virtual hostings to customers, and give the possibility
of giving guest_t shell access to multiple users with unique
namespaces.

It might not be necessary to run everything within the same apache
process, maybe launch one per virtual host would be OK. But full
mod_privileges-like support would be perfect.

Has anybody tackled something like that with selinux ?


  -jf

[-- Attachment #2: Type: application/pgp-signature, Size: 189 bytes --]

Re: [Fwd: [idea] web-application security powered by SELinux]

[KaiGai Kohei]

Jan-Frode Myklebust wrote:
> On Wed, Mar 25, 2009 at 10:08:55AM +0900, KaiGai Kohei wrote:
>> One idea is to add a security focused MPM which provide above features
>> and hooks for external modules.
>> I've actually developed a working example based on the "prefork" MPM.
>> When it accepts a request from the client, it creates a one-time thread
>> and assigns a new security context (which is a privileges set in SELinux),
>> then invokes contents handler.
>>
>>   http://code.google.com/p/sepgsql/source/browse/misc/httpd-selinux/
>>
>> However, I don't adhere the current implementation as is.
>> I would like to have a discussion to brush up the idea to achieve
>> the goal and to get acceptance in the mainline.
>>
>> Any comments, questions and others are welcome.
>>
> 
> I've been patiently hoping you would return to this idea, but it's
> not quite tackling my problem. I was hoping for something more
> similar to mod_privileges, where each virtual host is running in
> a separate selinux domain. That would be very usefull for ISP's
> offering virtual hostings to customers, and give the possibility
> of giving guest_t shell access to multiple users with unique
> namespaces.
> 
> It might not be necessary to run everything within the same apache
> process, maybe launch one per virtual host would be OK. But full
> mod_privileges-like support would be perfect.

Yes, it seems to me your problem consciousness is also worthfull
to achieve separation in virtual-host granularity, although its
goal is different from what I want to do.

The purpose of my efforts is to work every web-applications with
individual security context based on the client's identification.
We can also say it as a mapping between a web-user and a security
context.

> Has anybody tackled something like that with selinux ?

Sorry, my effort (currently) don't help to solve your problem.

Thanks,
-- 
OSS Platform Development Division, NEC
KaiGai Kohei <kaigai@ak.jp.nec.com>

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: [Fwd: [idea] web-application security powered by SELinux]

[Daniel J Walsh]

On 03/26/2009 10:45 PM, KaiGai Kohei wrote:
> Jan-Frode Myklebust wrote:
>> On Wed, Mar 25, 2009 at 10:08:55AM +0900, KaiGai Kohei wrote:
>>> One idea is to add a security focused MPM which provide above features
>>> and hooks for external modules.
>>> I've actually developed a working example based on the "prefork" MPM.
>>> When it accepts a request from the client, it creates a one-time thread
>>> and assigns a new security context (which is a privileges set in SELinux),
>>> then invokes contents handler.
>>>
>>>    http://code.google.com/p/sepgsql/source/browse/misc/httpd-selinux/
>>>
>>> However, I don't adhere the current implementation as is.
>>> I would like to have a discussion to brush up the idea to achieve
>>> the goal and to get acceptance in the mainline.
>>>
>>> Any comments, questions and others are welcome.
>>>
>> I've been patiently hoping you would return to this idea, but it's
>> not quite tackling my problem. I was hoping for something more
>> similar to mod_privileges, where each virtual host is running in
>> a separate selinux domain. That would be very usefull for ISP's
>> offering virtual hostings to customers, and give the possibility
>> of giving guest_t shell access to multiple users with unique
>> namespaces.
>>
>> It might not be necessary to run everything within the same apache
>> process, maybe launch one per virtual host would be OK. But full
>> mod_privileges-like support would be perfect.
> 
> Yes, it seems to me your problem consciousness is also worthfull
> to achieve separation in virtual-host granularity, although its
> goal is different from what I want to do.
> 
> The purpose of my efforts is to work every web-applications with
> individual security context based on the client's identification.
> We can also say it as a mapping between a web-user and a security
> context.
> 
>> Has anybody tackled something like that with selinux ?
> 
> Sorry, my effort (currently) don't help to solve your problem.
> 
> Thanks,
You could do something very similar to what we are doing with svirt.
Take advantage of the MCS fields, for separation.  With  the
virtual-host separation, you really want each user/application to have
the exact same privledge but be totally isolated from all of the other
virtual hosts.  The way we are doing this with svirt is by using MCS
labels on both the process and the virtual image, So that when the
virtual image starts up it runs with the same access but only to one
particular mcs label.



--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.