Re: AppArmor Security Goal

[John Johansen <jjohansen@suse.de>]

[-- Attachment #1: Type: text/plain, Size: 3378 bytes --]

On Sat, Nov 10, 2007 at 01:24:46PM -0800, Crispin Cowan wrote:
> Andi Kleen wrote:
> > Crispin Cowan <crispin@crispincowan.com> writes:
> >
> > The document should be a good base for a merge.
> >
> >   
> >>     * A confined process can operate on a file descriptor passed to it
> >>       by an unconfined process, even if it manipulates a file not in the
> >>       confined process's profile. To block this attack, confine the
> >>       process that passed the file descriptor.
> >>     
> >
> > That is the only thing that tripped me up a bit while reading the document.
> > Can you expand a bit on the reasons why the fd is not rechecked in
> > the context of the target process? Best do it in a new version of the
> > document.
> >   
> The reason is a disgusting implementation problem, so instead of going
> into lots of detail, I just disclaimed it.
> 
Well perhaps a little disgusting but it isn't the reason.  We discussed
this on the rewrite with the vfsmnt passed through the vfs.  We could
have changed the implementation but in the end decided to to leave it
in place for the time being.

> The excuse :) is that UNIX/Linux already has an object-capability
> orientation with respect to passing file descriptors around; you can
> pass an FD to a process that doesn't have access to the file, and DAC
> (user ownership & such) won't check it either.
> 
yep, the discussion really did come down to object capability and
unconfined processes.

> This aspect of the semantics is not my favorite, but it is at least
> consistent with the AppArmor view that unconfined processes can do
> absolutely anything and AppArmor won't try to stop them.
> 
and the the other major point surfaces

> The actual reason: FDs that are passed from some other *confined*
> process actually are checked, because the FD has data structures on it
> that we can use to hook for checking. The problem is that an FD from a
> completely unconfined process has no such data structures. To fix this,
> we would have to check access on every single read and write, and that
> would make performance suck.
> 
Not so, we can add that, and I have prototyped code to do so.  The issue
really is about how unconfined processes should interact with confined
processes.

> If there is a clean way to close this issue, I would be interested.
> 
What is considered a clean way to change this has been an on and
off again discussion, its been about 9 months since we last discussed
it so I am not surprised Crispin has paged it out.

The issue really does come down to how to express the interaction of
confined and unconfined tasks in policy.  The discussion always comes
back to object capabilities, unconfined's behavior, and how to
best express it.

> On the other hand, there is a fairly passionate community of Object
> Capability fans who really want access rights to be delegable, and the
> other way to go is to remove all checking on passed FDs.
> 
> There are advantages to going both ways, and I don't believe that
> AppArmor is locked in stone, so either one could be chosen in the
> future. See this interesting thread on LSM
> http://marc.info/?t=119464929300003&r=1&w=2
> 
No it isn't, the behavior was intended to be revisited when we
had IPC, and or a prototype for expressing which file objects can be
passed.

[-- Attachment #2: Type: application/pgp-signature, Size: 194 bytes --]