上下文linux查看端口占用

安全操作系统中国科学技术大学计算机系陈香兰(0512-87161312)xlanchen@ustc.
edu.
cn助教:裴建国Autumn2008第八章国外知名安全操作系统介绍SE-Linux介绍EROS介绍IntroductiontoSE-LinuxReferenceBookSELinuxNSA'sOpenSourceSecurityEnhancedLinuxByBillMcCartyOctober2004Pages:254声明本部分内容参考了网上搜索到的多个pptDavidQuigley关于SELinux的ppt《SecurityEnhancedLinux》KenduestLee(小州)的《SELinux入门初探》主要内容DefinitionHistoryConceptsArchitectureSELinuxPolicyLanguageUserspace实现使用主要内容DefinitionHistoryConceptsArchitectureSELinuxPolicyLanguageUserspace实现使用Wikipediasays:Security-EnhancedLinux(SELinux)isaLinuxfeaturethatprovidesavarietyofsecuritypolicies,includingU.
S.
DepartmentofDefensestylemandatoryaccesscontrols,throughtheuseofLinuxSecurityModules(LSM)intheLinuxkernel.
ItisnotaLinuxdistribution,butratherasetofmodificationsthatcanbeappliedtoUnix-likeoperatingsystems,suchasLinuxandBSD.
…PrimarilydevelopedbytheUSNationalSecurityAgency…运行示意图主要内容DefinitionHistoryConceptsArchitectureSELinuxPolicyLanguageUserspace实现使用SELinuxTimeline1985:LOCK(earlyTypeEnforcement)1990:DTMach/DTOS1995:UtahFluke/Flask1999:2.
2LinuxKernel(patch)2000:2001:2.
4LinuxKernel(patch)2002:LSM2003:2.
6LinuxKernel(mainline)2006:FullnetworklabelingPresent主要内容DefinitionHistoryConceptsArchitectureSELinuxPolicyLanguageUserspace实现使用ConceptsBasicsecuritymodelsTERBACMLSBasicelementsSubjectsprocessthatarerequestingaccesstoanobjectObjectsitemsinasystemthatareactedupon(files,IPC,sockets,etc….
)ActionsSELinux中对上述几种安全模型的实现AllObjectsandSubjectscontainasecuritycontextSecurityContext(s)arecomposedoffourparts观察linux-2.
6.
26\security\selinux\ss\context.
h中关于安全上下文的定义Securitycontext,安全上下文ThreesecurityattributeUseridentity:与主体或客体相关联的用户id对一个主体,即进程而言,代表了该进程运行所处的账户上下文对一个客体,表明该客体的拥有者注意:与Linux自主访问控制中的UID,是不同的两套概念RoleTypeRole:asetofpermissionausercanbegranted在任意时刻,用户只能处于一个角色newrole命令:使用户从一个角色切换到另一个角色类似linux中的su命令4种标准角色:staff_rUsedforuserspermittedtoenterthesysadm_rrolesysadm_rUsedforthesystemadministratorsystem_rUsedforsystemprocessesandobjectsuser_rUsedforordinaryusersdummyroleforobjectthathavenootherneedofaroleobject_rTypeTE给每个主体和系统中的客体定义了一个类型当一个类型与进程关联时,其type也称为domainType用来将主体和客体划分为不同的组例如sysadm_t安全上下文的格式user:role:type系统中每个文件/目录/网络端口等都被指定一个安全上下文,安全策略则给出各安全上下文之间的作用规则在selinux中查看用户的安全上下文在selinux中查看进程的安全上下文在selinux中查看文件的安全上下文AllSecurityContextcomponentsarecheckedagainstthepolicytoseeifaccessisallowed.
TypeisthebasecomponentwhileroleanduserareusedtofurtherrestricttypeenforcementuserroleDomaintypeobjecttype用户、角色、域类型与客体类型的关系图安全标识符SID与安全上文对应系统启动时,这个数据结构将被装载initialSIDs理解:安全上下文,被保存在某种数据结构中,例如表格,使用SID可以在这个数据结构中找到对应的安全上下文对象的生命期根据生命期的不同,linux中的对象分成2种transientobjectsandpersistentobjectstransientobjects通常是一些内核数据结构,例如:进程SELinux使用memory-residenttable进行SID和安全上下文的映射关系persistentobjects例如文件、目录SELinux利用文件系统来存放永久安全描述符PSID例如,利用ext2/ext3的扩展属性在最初安装SELinux时,要为文件创建PSIDlabeling进程利用setfile进行Setfile根据一个称为filecontext的数据库进行Filecontext为一些特殊文件定义了初始安全上下文;为其他文件定义了缺省的安全上下文AccessDecisionsTheSELinuxsecurityservermakestwobasickindsofdecisions:AccessdecisionsTransitiondecisions,alsocalledlabelingdecisionsAccessdecisionsAccessvectorAbitmapassociatedwitheachobjectclassAsimplifiedaccessvectorforthefileclassMaketheaccessdecisionbyconsidering主体的安全上下文客体的安全上下文客体的安全类型Action返回:访问向量3个向量中,允许主体Append/create客体AsimplifiedaccessvectorresultingfromanaccessdecisionTransitiondecisionsFornewlycreatedobjectsProcess(subject)creationFile(object)creation主要内容DefinitionHistoryConceptsArchitectureSELinuxPolicyLanguageUserspace实现使用SELinuxArchitectureSELinuxconsistsofthefollowingmajorcomponents:Kernel-levelcodeTheSELinuxsharedlibrarylibselinux1.
soAsecuritypolicyFromabinarypolicyfile:/etc/security/selinuxToolsLabeledSELinuxfilesystems(optional)关于内核部分,采用了LSMKernelframeworkforsecuritymodulesProvidesasetofhookstoimplementfurthersecuritychecksUsuallyplacedafterexistingDACchecksandbeforeresourceaccessImplicationsSELinuxcheckisnotcallediftheDACfailsMakesauditingdifficultattimes.
SELinuxLSMModuleUserSpaceKernelSpaceSelinuxFilesystemAccessVectorCacheSecurityServer(PolicyRulesandAccessDecisionLogic)LSMHooksVariousKernelObjectManagersCacheMissYesorNoSELinuxLSMModulePolicyManagementInterfaceFiguretakenfromSELinuxbyExample关于用户态库:UserspaceObjectManagersAccessVectorCachelibselinuxUser-SpaceObjectManagerFiguretakenfromSELinuxbyExampleUserSpaceKernelSpaceSelinuxFilesystemPolicyManagementInterfaceAllowaccessYesorNoAccessVectorCacheSecurityServer(PolicyRulesandAccessDecisionLogic)CacheMissYesorNoPolicyServerAccessVectorCachelibselinuxUser-SpaceObjectManagerFiguretakenfromSELinuxbyExampleUserSpaceKernelSpaceSelinuxFilesystemPolicyManagementInterfaceCacheMissYesorNoUser-SpaceSecurityServerPolicyManagementServerLoadUserPolicyPolicyServerAccessVectorCacheSecurityServer(PolicyRulesandAccessDecisionLogic)CacheMissYesorNo关于策略和策略文件PolicyLanguageMake,Scripts,M4,andsoonTypeEnforcementStatements(Types,TERules,Roles,Users)ConstraintsResourcelabelingSpecificationsClassesandPermissionsCheckpolicyBinaryPolicyFileKernelSpaceSelinuxFilesystemAccessVectorCacheSecurityServer(PolicyRulesandAccessDecisionLogic)CacheMissYesorNoSELinuxLSMModuleload_policyPolicySourceModulespolicy.
confFiguretakenfromSELinuxbyExample关于SELinux的一些源文件theSELinuxsourcefilesareoffourmajortypesStandardsourcefilesthatareseldommodifiedbytheSELinuxadministratorSourcefilesthataretypicallymodifiedbytheSELinuxadministratorduringinitialconfigurationofSELinuxType-Enforcement(TE)sourcefilesFileContext(FC)sourcefilesSELinuxToolsSELinuxincludesthreemaincategoriesoftools:SpecialcommandsusedtoadministeranduseSELinuxModifiedversionsofstandardLinuxcommandsandprogramsSupplementarySELinuxtools,usedforpurposessuchaspolicyanalysisanddevelopmentSELinuxcommands例如chconcheckpolicygetenforce/setenforcenewrolerun_initsetfilesavc_enforcingavc_toggleModifiedLinuxcommandsandprograms例如cp,mv,install,andotherbasiccommandsidlspscronloginlogrotatepamsshvariousprogramsthatmodify/etc/passwdor/etc/shadowSupplementarySELinuxtools例如ApolSeAuditSeCmdsSePCuTSeUser主要内容DefinitionHistoryConceptsArchitectureSELinuxPolicyLanguageUserspace实现使用ObjectClassesRepresentsresourcesofacertainkindPolicymustincludedeclarationsforallobjectclassesClassesFilerelated(blk_file,chr_file,dir,fd…)Networkrelated(socket,packet_socket,rawip_socket,…)IPCrelated(ipc,msg,msgq,sem,shm)MiscClasses(capability,process,security,system)PermissionsSpecifictoaparticularObjectClassIncludestraditionalLinuxpermissionsExtendsexistingpermissionstobefinergrainedIncludesSELinuxspecificpermissionsforlabelingTypeEnforcementSeveralmajorkeywordstypeattributetypeattributetypealiasallowdontauditauditallowNeverallow类型的定义type[aliases][attributes];例#httpd_config_t是一个系统管理文件的类型typehttpd_config_t,file_type,sysadmfile;#httpd_port_t是保留的端口,端口号小于1024typehttp_port_t,port_type,reserved_port_type;TE访问向量规则(TEAccessVectorRules):av_kindallow表示允许主体对客体执行允许的操作.
neverallow表示不允许主体对客体执行指定的操作.
auditallow表示允许操作并记录访问决策信息.
dontaudit表示不记录违反规则的决策信息,且违反规则不影响运行.
例#允许域user_t对bin_t类型客体进行类别为file的read等操作allowuser_tbin_t:file{readgetattrlockexecuteioctlexecute_no_trans};#允许域user_t对它自己类型的客体进行process类别的所有操作allowuser_tself:process*;#允许域userdomain对shell_exec_t类型客体进行file类别的read等操作allowuserdomainshell_exec_t:file{readgetattrlockexecuteioctl};#不允许域passwd_t对非bin_t等类型的客体进行file类别的execute_no_trans操作neverallowpasswd_t~{bin_tsbin_tld_so_t}:fileexecute_no_trans;#不允许域domain对非domain类型的客体进行process类别的类型转移操作neverallowdomain~domain:processtransition;TE转移规则类型转移的语法如下:type_transition域转移语法如下:type_transition:\process创建一个新客体时创建一个新进程时例:域转移type_transitionhttpd_thttpd_sys_script_exec_t:process\httpd_sys_script_t;type_transitioninitrc_tsquid_exec_t:processsquid_t;当后台进程httpd以域httpd_t运行类型为httpd_sys_script_exec_t的文件,如:CGI脚本文件,新的进程(如:CGI脚本进程)将赋为httpd_sys_script_t域.

当域为initrc_t的init进程执行squid_exec_t类型的文件时,新进程将赋为squid_t域.

例:类型转移type_transitionnamed_tvar_run_t:sock_filenamed_var_run_t;当在域named_t的一个进程在类型为var_run_t的目录创建一个socket文件时,该socket文件被赋予named_var_run_t类型.

RBACAdds2componentstosecuritycontextuserroleAdds3policylanguagekeywordsallow(differentthanAVCallow)role_transition(similartotype_transition)Dominance角色定义roletypes;例:#允许管理者角色访问域ldconfig_trolesysadm_rtypesldconfig_t;角色的继承#master_r继承sysadm_r和user_r角色的权限dominance{rolemaster_r{rolesysadm_r;roleuser_r;}}角色的转移#当一个管理者执行一个$1_exec_t类型的进程时,进程从sysadm_r转移到system_rrole_transitionsysadm_r$1_exec_tsystem_r;角色允许的语法如下:allow;#允许角色user_r转移到新角色allowuser_rsysadm_r;用户定义user{role_list};例:userroot{user_rsysadm_r};特殊用户:system_u、user_ulogin,sshd,和crond命令运行登录时设置安全上下文,默认的安全上下文由下面文件决定:policy/contexts/users/username(per-userdefaults)policy/contexts/default_contexts(systemdefaults)MultilevelSecurity策略对级别和类型进行声明对客体和许可进行限制constrain;表达式主要有:u1opu2u1和u2分别表示操作前后的用户身份r1role_opr2#r1和r2分别表示操作前后的角色t1opt2t1和t2分别表示操作前后的类型u1opuser_set#user_set表示用户身份集u2opuser_setr1oprole_setr2oprole_sett1optype_sett2optype_set表达式中的关键字有not,and,or,=,!
=等,role_op还包括角色继承操作符例constrainprocesstransition(r1==r2ort1==privrole);constraindir_file_class_set{createrelabeltorelabelfrom}(u1==u2ort1==privowner);constrainsocket_class_set{createrelabeltorelabelfrom}(u1==u2ort1==privowner);限制进程域转移的能力,类型转移前后进程的角色一致,或者,进程有类型为privrole.

限制标识客体的能力,即标识客体时,标识前后客体的用户身份一致或者标识前进程的域为privowner给SID定义上下文sidsid_identifiersecurity_context一些策略库预定义的SID在policy/initial_sid_contexts中例:sidkernelsystem_u:system_r:kernel_tsidsecuritysystem_u:object_r:security_tsidunlabeledsystem_u:object_r:unlabeled_t文件系统的标识行为当文件系统被SELinux内核mount上时,安全服务器决定给基于filesystem类型的文件系统里的节点合适的标识行为.
对于有唯一且永久的节点号的传统文件系统fs_use_psidext2;fs_use_psidext3;fs_use_psidreiserfs;永久sid对于代表管道和socket对象的伪文件系统fs_use_taskpipefssystem_u:object_r:fs_t;fs_use_tasksockfssystem:object_r:fs_t;对于代表伪终端和共享内存对象的伪文件系统fs_use_transdevptssystem_u:object_r;devpts_t;fs_use_transtmpfssystem_u:object_r:temfs_t;指定创建进程的上下文给代表对象的节点从创建进程的上下文和与文件系统类型相关的上下文中派生出上下文.
派生出的上下文由配置中的类型转移来决定网络对象上下文例1:定义端口的上下文portcontcp80system_u:object_r:http_port_tportcontcp8080system_u:object_r:http_port_t例2:定义网络接口的上下文:netifconeth0system_u:object_r:netif_eth0_tsystem_u:object_r:netmsg_eth0_t例3:定义节点的上下文nodecon10.
33.
10.
66255.
255.
255.
255system_u:object_r:node_zeus_t;nodecon10.
33.
10.
0255.
255.
255.
0system_u:object_r:node_any_tReferencePolicyMaintainedbyNSAandFCMailingListsCompilesintothreeversionsStrict,Targeted,MLSTargeted除指定的后台外,每个主体和客体都运行在unconfined_t,除了标准的linuxDAC限制外,在unconfined_t域系统上的客体没有任何限制在FedoraCoreLinux中配置的是targeted策略Strict,严格策略每个主体和客体有一个指定的域,复杂主要内容DefinitionHistoryConceptsArchitectureSELinuxPolicyLanguageUserspace实现使用组件checkpolicylibselinuxlibsemanagelibsepolPolicycoreutilslibselinuxUsedbySELinuxawareapplicationsHousesuserspaceAVCContainsfunctionstocalculateAVCsget/set/createcontextsquerypolicyengineAccessVectorCachelibselinuxUser-SpaceObjectManagerlibsemanageUsedtoqueryandconfigurestateofarunningsystemProvidesfunctionstoquery/modifyloginnamesusersnetworkports/interfacesfilecontextsleveltranslationsrolesetc.
SELinuxfsInterfacebetweenuserspaceandkernelUsedbylibselinuxandlibsemanagetocommunicaterequestswiththekernelProvidesaquickandeasyinterfaceforhumansUsuallynotuseddirectlyfromprogramsPolicycoreutilsSELinuxManagementandpolicyanalysistoolsaudit2allowaudit2whyload_policynewrolerestoreconsemanagesemodulesestatussetbooletc.
.
.
主要内容DefinitionHistoryConceptsArchitectureSELinuxPolicyLanguageUserspace实现使用实现观察selinux在Linux2.
6.
26中的位置了解目录信息大概了解selinux的源代码规模使用sourcelinecounter,了解selinux的代码量结合LSM架构,理解SELinuxSELinuxsecuritydatastructuresforkernelobjects观察linux-2.
6.
26\security\selinux\include\objsec.
hSELinux提供的各种钩子函数观察linux-2.
6.
26\security\selinux\hooks.
c中selinux_opsSELinux的初始化selinux_init是在根文件系统挂载后,被调用的,因此可以直接从根文件系统中获得配置数据观察linux-2.
6.
26\security\selinux\hooks.
c中selinux_initselinuxfspseudofilesystemforexportingthesecuritypolicyAPI观察selinux文件系统主要内容DefinitionHistoryConceptsArchitectureSELinuxPolicyLanguageUserspace实现使用DistributionsFedoraCore3andlaterDebianGNU/LinuxGentooLinuxSuSeSE-BSDSE-MACHDemoSystemshttp://selinux.
dev.
gentoo.
orgGentoohttp://www.
coker.
com.
au/selinux/play.
htmlaFedoraCoresystemadministeredbyRussellCokerhttp://selinux.
simplyaquatics.
comDebianUsingandAdministeringSELinuxSystemModesandSELinuxTuningControllingSELinuxRoutineSELinuxSystemUseandAdministrationMonitoringSELinuxTroubleshootingSELinuxSystemModesandSELinuxTuning系统运行模式DisabledPermissive模式编译选项:NSASELinuxDevelopmentsupportEnforcement模式违反策略之后,…ControllingSELinuxSwitchingtheSELinuxmode启动时切换:修改启动参数运行时切换角色:sysadm_r修改/selinux/enforce为1或者0利用各种命令或工具Loadingasecuritypolicy参考相关手册Labelingfiles参考相关手册RoutineSELinuxSystemUseandAdministrationEnteringarolenewroleViewingsecuritycontextsid;ls;ps(--context;--lcontext;--scontext;-Z)AddingusersandgroupsuseraddStartingandcontrollingdaemonsTuningSELinuxMonitoringSELinuxSELinuxLogMessageFormatavc:result{operation}forpid=pidexe=exepath=opathdev=devno:ptnoino=nodescontext=sourcetcontext=targettclass=classResult:granted或者deniedExe:可执行文件Opath:对象路径Devno和Ptno:对象所在块设备号和分区号Node:对象索引节点号Source:进程的安全上下文Target:对象的安全上下文Class:对象的类型举例:Jan1419:10:04hostnamekernel:audit(1105758604.
519:420):\avc:denied{getattr}forpid=5962exe=/usr/sbin/httpd\path=/home/auser/public_htmldev=hdb2ino=921135\scontext=root:system_r:httpd_t\tcontext=user_u:object_r:user_home_ttclass=dir时间戳主机名内核审计log消息的指针,()中依次是时间戳组成的当前时间的未格式化长整数,毫秒的短整数和序列数,帮助从多个消息进行审核跟踪.