Linux Edu Handbook - ironpenguin

admin_capceiling

anonymous@undisclosed.example.com (Anonymous) — Thu, 15 Apr 2010 19:18:59 +0000

capceiling with no arguments will display the current capabilities ceiling capceiling (-|=)[ ]capability [capability...] run program with a reduced capability ceiling The new ceiling is just a space delimited list of capabilities preceeded by either a '-' or '='

admin_fscap

anonymous@undisclosed.example.com (Anonymous) — Thu, 15 Apr 2010 19:18:59 +0000

'fscap'' is used to examine or set capabilities for an executable file. fscap (+|-|=)[ ]forced-capability [forced-capability ...] [(+|-|=)[ ]allowed-capability [allowed-capability ...]] '+': the capability list is added to allready set capabilities

admin_tools

anonymous@undisclosed.example.com (Anonymous) — Thu, 15 Apr 2010 19:18:59 +0000

New system calls are all well and good, but are useless without something to call them. IronPenguin features are utilized through a few new administrative tools: capceiling is used to run a program with a lowered capability ceiling and to see the current ceiling.

capabilities

anonymous@undisclosed.example.com (Anonymous) — Thu, 15 Apr 2010 19:18:58 +0000

POSIX Capabilities is a fundamentally sound idea hobbled by silliness that makes the capability system difficult to understand. The idea behind POSIX capabilities is to replace the old model of root is god and everyone else isn't with the idea of a process having capabilities. Capabilities as defined in the POSIX draft may be seen as sub-divided root powers. For example, in the old model, root (UID 0) can bypass file permissions (that is, root is always permitted). In the capabilities model, if…

capability_notes

anonymous@undisclosed.example.com (Anonymous) — Thu, 15 Apr 2010 19:18:57 +0000

The IronPenguin capability system is almost but not quite the POSIX capability draft. The differences are the result of both a deeper analysis of the security considerations and of practical experiances form various POSIX systems attemption to implement the POSIX draft, including the Linux kernel.

capceiling

anonymous@undisclosed.example.com (Anonymous) — Thu, 15 Apr 2010 19:18:57 +0000

Capceiling is a new system call added by in order to support jail and other security measures. For i386 and x86_64 systems, it is defined as: #define __NR_capceiling 318 _syscall1(int, capceiling, unsigned int *, capceiling); or int capceiling(unsigned int *caps);

dll_hell_for_the_21st_century

anonymous@undisclosed.example.com (Anonymous) — Thu, 15 Apr 2010 19:18:58 +0000

Just to be clear, this is NOT intended to be a rant against the existance of SELinux. There exist security environments where the amount of time and effort involved in properly maintaining an SELinux system is well justified and the various rollout delays are acceptable losses.

jail_syscall

anonymous@undisclosed.example.com (Anonymous) — Thu, 15 Apr 2010 19:18:58 +0000

The jail call is inspired by and somewhat modeled on the jail syscall from FreeBSD. Jail brings together the IronPenguin improvements in chroot, bind mounts, etc and adds signal and process isolation. The primary purpose of jail is to allow the creation of extremely lightweight virtual servers that live in a chroot jail.

open_questions

anonymous@undisclosed.example.com (Anonymous) — Thu, 15 Apr 2010 19:18:57 +0000

The changes introduced in open a few questions for security restrictions in the kernel. * Since the chroot system call can no longer be used to break out of a previous chroot, does it still need to be restricted to processes with CAP_SYS_CHROOT? *

prerequisits

anonymous@undisclosed.example.com (Anonymous) — Thu, 15 Apr 2010 19:18:59 +0000

before you begin Naturally, the first step is to upgrade to the IronPenguin kernel in the usual way. To make full use of capabilities requires fscaps which, in turn, requires the filesystem to be mointed with the user_xattr option. For the usual case of an ext2 or ext3 filesystem,

start

anonymous@undisclosed.example.com (Anonymous) — Thu, 15 Apr 2010 19:18:57 +0000

IronPenguin is a set of modifications to recent Linux kernels aimed at implementing both stronger and more versatile security functionality in Linux systems. IronPenguin is a quick hack that grew considerably in scope as time went on and it became clear just how much could be gained with a few well-considered small changes in the kernel.