FreeBSD 使用手冊
Prev | Chapter 16 Mandatory Access Control | Next

# 16.14 Implementing a Secure Environment with MAC

The following demonstration will implement a secure environment using various MAC modules with properly configured policies. This is only a test and should not be considered the complete answer to everyone's security woes. Just implementing a policy and ignoring it never works and could be disastrous in a production environment.

Before beginning this process, the `multilabel` option must be set on each file system as stated at the beginning of this chapter. Not doing so will result in errors.

## 16.14.1 Create an insecure User Class

Begin the procedure by adding the following user class to the `/etc/login.conf` file:

    insecure:\
    :copyright=/etc/COPYRIGHT:\
    :welcome=/etc/motd:\
    :setenv=MAIL=/var/mail/$,BLOCKSIZE=K:\
    :path=~/bin:/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/sbin:/usr/local/bin
    :manpath=/usr/share/man /usr/local/man:\
    :nologin=/usr/sbin/nologin:\
    :cputime=1h30m:\
    :datasize=8M:\
    :vmemoryuse=100M:\
    :stacksize=2M:\
    :memorylocked=4M:\
    :memoryuse=8M:\
    :filesize=8M:\
    :coredumpsize=8M:\
    :openfiles=24:\
    :maxproc=32:\
    :priority=0:\
    :requirehome:\
    :passwordtime=91d:\
    :umask=022:\
    :ignoretime@:\
    :label=partition/13,mls/5:

And adding the following line to the default user class:

    :label=mls/equal,biba/equal,partition/15:

Once this is completed, the following command must be issued to rebuild the database:

    # cap_mkdb /etc/login.conf

## 16.14.2 Boot with the Correct Modules

Add the following lines to `/boot/loader.conf` so the required modules will load during system initialization:

    mac_biba_load="YES"
    mac_mls_load="YES"
    mac_seeotheruids_load="YES"
    mac_partition_load="YES"

## 16.14.3 Set All Users to Insecure

All user accounts that are not `root` or system users will now require a login class. The login class is required otherwise users will be refused access to common commands such as vi(1). The following `sh` script should do the trick:

    # for x in `awk -F: '($3 >= 1001) && ($3 != 65534) { print $1 }' \
        /etc/passwd`; do pw usermod $x -L insecure; done;

The `cap_mkdb` command will need to be run on `/etc/master.passwd` after this change.

## 16.14.4 Complete the Configuration

A contexts file should now be created; the following example was taken from Robert Watson's example policy and should be placed in `/etc/policy.contexts`.

    # This is the default BIBA/MLS policy for this system.

    .*                              biba/high,mls/high
    /sbin/dhclient                  biba/high(low),mls/high(low)
    /dev(/.*)?                      biba/equal,mls/equal
    # This is not an exhaustive list of all "privileged" devices.
    /dev/mdctl                      biba/high,mls/high
    /dev/pci                        biba/high,mls/high
    /dev/k?mem                      biba/high,mls/high
    /dev/io                         biba/high,mls/high
    /dev/agp.*                      biba/high,mls/high
    (/var)?/tmp(/.*)?               biba/equal,mls/equal
    /tmp/\.X11-unix                 biba/high(equal),mls/high(equal)
    /tmp/\.X11-unix/.*              biba/equal,mls/equal
    /proc(/.*)?                     biba/equal,mls/equal
    /mnt.*                          biba/low,mls/low
    (/usr)?/home                    biba/high(low),mls/high(low)
    (/usr)?/home/.*                 biba/low,mls/low
    /var/mail(/.*)?                 biba/low,mls/low
    /var/spool/mqueue(/.*)?         biba/low,mls/low
    (/mnt)?/cdrom(/.*)?             biba/high,mls/high
    (/usr)?/home/(ftp|samba)(/.*)?  biba/high,mls/high
    /var/log/sendmail\.st           biba/low,mls/low
    /var/run/utmp                   biba/equal,mls/equal
    /var/log/(lastlog|wtmp)         biba/equal,mls/equal

This policy will enforce security by setting restrictions on both the downward and upward flow of information with regards to the directories and utilities listed on the left.

This can now be read into our system by issuing the following command:

    # setfsmac -ef /etc/policy.contexts /
    # setfsmac -ef /etc/policy.contexts /usr

> Note: The above file system layout may be different depending on environment.

The `/etc/mac.conf` file requires the following modifications in the main section:

    default_labels file ?biba,?mls
    default_labels ifnet ?biba,?mls
    default_labels process ?biba,?mls,?partition
    default_labels socket ?biba,?mls

## 16.14.5 Testing the Configuration

Add a user with the `adduser` command and place that user in the `insecure` class for these tests.

The examples below will show a mix of `root` and regular user tests; use the prompt to distinguish between the two.

### 16.14.5.1 Basic Labeling Tests

    % getpmac
    biba/15(15-15),mls/15(15-15),partition/15
    # setpmac partition/15,mls/equal top

> Note: The top process will be killed before we start another top process.

### 16.14.5.2 MAC Seeotheruids Tests

    % ps Zax
    biba/15(15-15),mls/15(15-15),partition/15  1096 #C:  S      0:00.03 -su (bash)
    biba/15(15-15),mls/15(15-15),partition/15  1101 #C:  R+     0:00.01 ps Zax

We should not be permitted to see any processes owned by other users.

### 16.14.5.3 MAC Partition Test

Disable the MAC `seeotheruids` policy for the rest of these tests:

    # sysctl security.mac.seeotheruids.enabled=0
    % ps Zax
    LABEL                                                   PID  TT  STAT      TIME COMMAND
      biba/equal(low-high),mls/equal(low-high),partition/15  1122 #C:  S+     0:00.02 top
      biba/15(15-15),mls/15(15-15),partition/15              1096 #C:  S      0:00.05 -su (bash)
      biba/15(15-15),mls/15(15-15),partition/15              1123 #C:  R+     0:00.01 ps Zax

All users should be permitted to see every process in their partition.

### 16.14.5.4 Testing Biba and MLS Labels

    # setpmac partition/15,mls/equal,biba/high\(high-high\) top
    % ps Zax
    LABEL                                                   PID  TT  STAT    TIME   COMMAND
      biba/high(high-high),mls/equal(low-high),partition/15   1251 #C:  S+     0:00.02 top
      biba/15(15-15),mls/15(15-15),partition/15               1096 #C:  S      0:00.06 -su (bash)
      biba/15(15-15),mls/15(15-15),partition/15               1157 #C:  R+     0:00.00 ps Zax

The Biba policy allows us to read higher-labeled objects.

    # setpmac partition/15,mls/equal,biba/low top
    % ps Zax
    LABEL                                       PID  TT  STAT      TIME COMMAND
      biba/15(15-15),mls/15(15-15),partition/15  1096 #C:  S      0:00.07 -su (bash)
      biba/15(15-15),mls/15(15-15),partition/15  1226 #C:  R+     0:00.01 ps Zax

The Biba policy does not allow lower-labeled objects to be read; however, MLS does.

    % ifconfig bge0 | grep maclabel
    maclabel biba/low(low-low),mls/low(low-low)
    % ping -c 1 192.0.34.166
    PING 192.0.34.166 (192.0.34.166): 56 data bytes
    ping: sendto: Permission denied

Users are unable to ping `example.com`, or any domain for that matter.

To prevent this error from occurring, run the following command:

    # sysctl security.mac.biba.trust_all_interfaces=1

This sets the default interface label to insecure mode, so the default Biba policy label will not be enforced.

    # ifconfig bge0 maclabel biba/equal\(low-high\),mls/equal\(low-high\)
    % ping -c 1 192.0.34.166
    PING 192.0.34.166 (192.0.34.166): 56 data bytes
    64 bytes from 192.0.34.166: icmp_seq=0 ttl=50 time=204.455 ms
    --- 192.0.34.166 ping statistics ---
    1 packets transmitted, 1 packets received, 0% packet loss
    round-trip min/avg/max/stddev = 204.455/204.455/204.455/0.000 ms

By setting a more correct label, we can issue `ping` requests.

Now to create a few files for some read and write testing procedures:

    # touch test1 test2 test3 test4 test5
    # getfmac test1
    test1: biba/equal,mls/equal
    # setfmac biba/low test1 test2; setfmac biba/high test4 test5; \
      setfmac mls/low test1 test3; setfmac mls/high test2 test4
    # setfmac mls/equal,biba/equal test3 && getfmac test?
    test1: biba/low,mls/low
    test2: biba/low,mls/high
    test3: biba/equal,mls/equal
    test4: biba/high,mls/high
    test5: biba/high,mls/equal
    # chown testuser:testuser test?

All of these files should now be owned by our `testuser` user. And now for some read tests:

    % ls
    test1   test2   test3   test4   test5
    % ls test?
    ls: test1: Permission denied
    ls: test2: Permission denied
    ls: test4: Permission denied
    test3   test5

We should not be permitted to observe pairs; e.g.: `(biba/low,mls/low)`, `(biba/low,mls/high)` and `(biba/high,mls/high)`. And of course, read access should be denied. Now for some write tests:

    % for i in `echo test*`; do echo 1 > $i; done
    -su: test1: Permission denied
    -su: test4: Permission denied
    -su: test5: Permission denied

Like with the read tests, write access should not be permitted to write pairs; e.g.: `(biba/low,mls/high)` and `(biba/equal,mls/equal)`.

    % cat test?
    cat: test1: Permission denied
    cat: test2: Permission denied
    1
    cat: test4: Permission denied

And now as `root`:

    # cat test2
    1

Prev | Home | Next
The MAC LOMAC Module | Up | Another Example: Using MAC to Constrain a Web Server

本文及其他文件，可由此下載：ftp://ftp.FreeBSD.org/pub/FreeBSD/doc/。

若有 FreeBSD 方面疑問，請先閱讀 FreeBSD 相關文件，如不能解決的話，再洽詢 <questions@FreeBSD.org>。
關於本文件的問題，請洽詢 <doc@FreeBSD.org>。