Operating Systems 2019F Lecture 20

Video

The video for the lecture given on November 20, 2019 is now available.

Notes

Lecture 20
----------
Assignment 3 is now due Nov. 24th, not the 22nd

operating system security

What does it mean to keep an operating system secure?

Conventionally, it means
 - prevent the operating system code from being compromised
   (controlled by an unauthorized party)
 - enforce system security policy (e.g., follow access contro policy)

Security policy in practice is not that variable, and really we should be more specific in our operating system security requirements (and newer systems are more specific)

TCB = trusted computing base
      portion of a system that enforces security policy
      as long as it stays secure, policy is enforced

Classic OS design says we need a "minimal" TCB
 - so we can check it and make sure it doesn't have any bugs

What is the TCB for UNIX/Linux?
 - not so clear...


What do you need to "lock down" to make sure a Linux system stays secure?  How can each be compromised?

1. kernel (running in supervisor mode on the CPU)
   - normally, hard to get to since userspace programs can't directly do anything to it, including code running as root
   - but, if you have module support, it is possible to load arbitrary code
     into the kernel
   - system calls may have coding flaws
   - CPU may have privilege separation flaws
   - defenses: signed kernel modules, vulnerability analysis of kernel,
     CPU firmware updates

2. common libraries (e.g. C library)
   - included in many programs, including ones running as root
   - if compromised, can do anything as the user running the program
   - defenses: signed libraries, vulnerability analysis of library

3. system daemons (background processes)
   - provide critical functions, run with high privilege
   - can sign, do vuln analysis

4. setuid binaries
   - provide critical functions, run with high privilege
   - can sign, do vuln analysis

5. common applications (web browsers)
   - everyone runs them! so can compromise arbitrary users
   - sign, vuln analysis

TCB of a Linux system is almost everything installed
   - you can compromise someone even with ls or whoami

Some systems limit the privileges of root, such as SELinux and AppArmor
 - known as mandatory access control (MAC)
 - means root can't change security policy
 - have to reboot to change policy, go into special mode
 - not so good for developer workstations, but may be good for
   embedded systems or servers

classic Linux has discretionary access control (DAC), meaning root can change it at any time.

What are systems that you use that are really "locked down" - you can't make them run arbitrary code, they can only run code authorized by the manufacturers.
 * iOS, Android devices
 * game consoles
 * many IoT devices
 * cars

Most of this "locking down" happens through code signing, but it is very elaborate.
 - "trusted computing" - code is verified from first boot, and every subsequent program is also checked so you get a chain of trust from the bootloader to the application
    - necessary because any untrusted code in this chain can mess everything up

 - "locked bootloader" -> trusted computing, code signing

When an iOS device is "jailbroken" it is made so arbitrary code can be run on it, not just code authorized by Apple.
  - but the term means something more


Modern OS and application security is based around another key concept
**sandboxing**

A sandbox for code isolates the code from the rest of the system
 - limits its access
 - allows for running untrusted code safely

BSD has application "jails"
 - processes in a jail can't escape, they can only access resources inside of the jail

By default, on iOS all applications run inside jails.
 - this is why applications on iOS are limited in their functionality

Android doesn't do jails, instead they have fine-grained application permissions
 - system applications just have more privileges
 - this approach is inherently more flexible and less secure

Jails provide analogous functionality to the JavaScript sandbox for web pages, but the implementation is completely different
 - enforced by hardware, OS kernel rather than web browser, language runtime

Language-level sandboxes are inherently safer than OS-level jails
 - see the restrictions on app stores versus the openness of the web

WebAssembly may bridge this gap


Rootkits
--------
 - code designed to hide attacker behavior from regular users and even
   administrators of a system
 - if a rootkit is installed, you can never trust the system because
   you can't trust anything it does - it will lie to you
 - you fix by reinstalling, but if they compromised firmware you may
   have to throw the computer out

Key goals
 - hide processes
 - hide files
 - ensure access

One aspect of a rootkit is a "back door" - an unauthorized way to gain access to a system
 - e.g. Joshua from WarGames
 - classic: special password that always work

Rootkits don't compromise a system, they are used after a compromise.

You can do a pure userspace rootkit
 - change ls, ps, other utilities
 - but it is a pain to truly hide things

normally, need to run code as root to truly hide things
 - so you do it with a kernel module or similar mechanism
 - change how system calls work
   - hide files, processes normally
   - show hidden files & processes when given special arguments

Not a rootkit, but gives you an idea: fakeroot