SystemsSec 2016W Lecture 4
Topics & Readings
- chroot jails
- MULTICS
- Trent Jaeger's Operating Systems Security textbook
- TCP IP Illustrated
Class Notes
Jails
A chroot jail isolates a single process from the rest of the system, and should be used by non-root users.
- BSD mechanism, not really a Linux thing
- limiting hierarchy to make a non-root dir seem like the root dir, forces hierarchy to be duplicated so that nothing seems weird
- fake root user gets ‘jailed’ into subset of hierarchy, and doesn’t really have real root privileges
- process has a different root dir in kernel, but to the fake root user it still seems like the root dir
- one kernel space, multiple user spaces
- kind of like OS virtualization
DD-WRT
DD-WRT is firmware for routers. LinkSys used to make a router models that came with a Linux kernel on them, the WRT54G series.
Proxy vs VPN tunneling
- proxies are for HTTP specifically
- VPN is for any internet traffic
If you're having a hard time understanding networking, TCP IP illustrated , look into reading these 3 volumes. They are highly recommended by Anil.
(Complex Security) Policies
"Suck, don’t make them." - Anil, 2016. We can’t approximate how humans approach information with logic systems, so we shouldn't try.
MULTICS
Multiplexed Information and Computing Service
- supposed to be a “grown up” OS
- first OS to take security seriously
- took a "shotgun approach" to security, too much generality
- implemented a ring system which was overly complicated
UNIX
Our favourite open sourced OS. All praise to the GNU.
- simplest security mechanisms, most usable
SELinux
Security Enhanced Linux
A set of kernel modifications whose goals are to make the Linux kernel more secure. These mainly include implementing and enforcing security policies.
Reference Monitor
- software that mediates all security decisions
- MULTICS designed to have a reference monitor, which was their ring system
- UNIX doesn’t really have one, processes (kind of) moderate security decisions together
Important Questions
Jails
- What is an OS jail?
- What would happen if a user broke out of a jail?
MULTICS
- What is it?
- What was good/bad about MULTICS?
- How did MULTICS affect UNIX?
Reference Monitor
- What is it?
- What is it's role in an OS?
- How is it implemented in UNIX and MULTICS?