DAC (Discretionary Access Control)
Table of Contents
1 Discretionary Access Control (DAC)
- "Trusted Computer System Evaluation Criteria" TCSEC, US DoD Standard 5200.28-STD.
- My opinion: "Discretionary", "Mandatory" both misleading names.
- Generally speaking: The security model of Linux is DAC
- Concepts
- Entities: Users, Files, Processes, …
- Ownership
- Permissions: read, write, execute, …
- Granting of permissions
- Android inherits from Linux all of DAC.
2 Authentication
- Machines
- Users
- Services/Servers
2.1 User Authentication Approaches
- What You Know
- What You Have
- What You Are
2.2 Passwords
- Passwords on a Linux System
- Cracking the Passwords
- Current consensus: Given enough time, any password can be cracked.
- Prevention of Password Cracking
3 Set User ID (suid)
- Privilege Acqusition Mechanism
- Invoke a program (file) that has suid set.
- Expected to be invoked by non-root users.
- suid can be set to non-root owner.
- The created process runs with the privileges of the owner, not the invoker
3.1 suid examples
-rwsr-xr-x 1 root root 34888 Aug 14 06:15 /bin/mount -rwsr-xr-x 1 root root 64424 Mar 9 2017 /bin/ping -rwsr-xr-x 1 root root 40168 Aug 20 19:56 /bin/su -rwsrw-r-- 1 pmateti pmateti 23097 Jan 21 2015 turnin
3.2 suid root
- Discover
find / -user root -perm -4000 -type f -exec ls -ld {} \; - An attacker arrives with non-root privileges.
- Exploits an suid-root process to spawn a root owned shell.
- The classsic "buffer overflow attack" injects the shellcode onto the stack.
4 Android UID setup
5 References
- Prabhaker Mateti, Password Cracking, 2013. Skip the Lab experiment. Required Reading.
- https://en.wikipedia.org/wiki/Discretionary_access_control Required Reading.
- P. A. Loscocco, S. D. Smalley, P. A. Muckelbauer, R. C. Taylor, S. J. Turner, and J. F. Farrell. "The Inevitability of Failure: The Flawed Assumption of Security in Modern Computing Environments." In Proceedings of the 21st National Information Systems Security Conference, pp. 303–14, Oct. 1998. A classic paper. Recommended Reading
- http://faculty.cs.nku.edu/~waldenj/classes/2014/spring/cit380/lectures/AccessControl.pdf Slides. Required Reading.
- Karim Yaghmour, ./android-security-yaghmour-2014.pdf Android Security, From the Ground Up, ELCE 2014. Required Reading.
- Secuirty features in Ubuntu https://wiki.ubuntu.com/Security/Features Required Reading.