Rough Guide to CerbNG

Table of Contents

• 1  Introduction
• 2  Architecture
• 3  Examples
• 3.1 Ping
• 3.2 NoExec
• 4  CerbNG capabilities
• 5  Sysctls controlling CerbNG
• 6  CerbNG operators and functions
  • 6.1  Operators
  • 6.2  Userland compiler functions
  • 6.3  Kernel CerbNG functions

1 Introduction

UNIX systems historically were not designed to provide extensive security and auditing features. It's notion of superuser who is never stopped from interfering with system's policies and internals is considered, even by it's most dedicated fans, too dangerous. Permission bits for files are often too generous, which is caused not only by lack of standard ACL support in many systems (FreeBSD 4.x included), but also by need for setuid-bit existence in UNIX. In the old days UNIX was used in friendly academic communities where security was never top priority. Now it's widespread commerce, critical data processing and network security uses make enhancements to traditional UNIX security model essential for it's success.

CerbNG is written for FreeBSD operating system. The base OS offers many security enhancements beyond the standard UNIX feature set. Mechanisms like: Jail, ACLs, MACs, securelevels, enhanced file attributes (flags) help making the system more secure but not immune to remote and local security breaches. FreeBSD developers are known for safe coding practices, careful testing of new system features and good design. But very often system administrators and security officers are faced with critical bugs which were not caught despite so many eyes watching. Sometimes checking is not enough. Restricting applications beyond their initial rights, given by UID and GID bits of user running them, is crucial for maintaining system integrity.

Sysadmins can never assert, that the only threat to their systems are so called script kiddies - non-thinking, always boasting, clueless users of readily available exploits; looking for root level access because it sounds cool. What about determined attackers who often spend weeks finding system and application bugs which can be used for privilege elevation? You can't assume they will go public with their findings or notify software vendors before exploiting or sharing found vulnerabilities. Many of them don't. How can we fight the enemy? How can we prevent exploiting bugs we are not aware of?

For sure, many of the conscious FreeBSD users are bothered by generosity of credentials in base installation. Programs like ping(8) or named(8) are setuid root for very basic operations (raw sockets and low port binding respectively). FreeBSD as for version 4, doesn't offer any mechanisms restricting processes running with root UID to performing single operation with elevated credentials.

All of the above issues motivated development of CerbNG.

2 Architecture

CerbNG contains two building blocks. First one, is kernel loadable module, second is userland compiler which translates rules from human readable format to rules and variables used by kernel module. CerbNG is a kind of interface between userland and kernel space. Without CerbNG loaded, all system calls are immediately executed by kernel. After loading CerbNG, all system calls and their arguments are passed through a series of tests defined in configuration rules. Before and after system call execution, system administrator using CerbNG is allowed to perform numerous modifications to running process environment and syscall arguments. Set of changeable parameters contains all the *UID registers permitting privilege elevation of running process. Additional assumptions in design of CerbNG were flexibility and nearly complete transparency. CerbNG can be configured in ways which don't require any changes to program source code and filesystem permissions.

3 Examples

Next we present some examples which uncover some of CerbNG mechanisms for access control. Let's start with securing ping. Ping was chosen as first example for simplicity not it's insecurity.

3.1 Ping

if (syscall == SYS_execve) {
       reg[0] = realpath(arg[0]);
       if (reg[0] == "/sbin/ping") {
              reg[0] = call();
              if (reg[0] == 0 && euid == 0) {
                     setpeuid(ruid);
              }
              return reg[0];
       }
}
if (pname == "ping" && pinode == 123 && pdev == 456) {
       if (syscall == SYS_socket) {
              if (socket_domain == AF_INET &&
                            socket_type == SOCK_RAW &&
                            socket_protocol == IPPROTO_ICMP) {
                     reg[0] = euid;
                     setpeuid(0);
                     reg[1] = call();
                     setpeuid(reg[0]);
                     return reg[1];
              }
       }
}

Explanation

if (syscall == SYS_execve) {

Check if execve(2) was called.

reg[0] = realpath(arg[0]);

Internal register number zero is assigned realpath of program which user owning this syscall is attempting to run (first argument of execve(2)). In other words, register zero will store absolute path of the program which the user is trying to run.

if (reg[0] == "/sbin/ping") {

Check if the program being run is ping(8).

reg[0] = call();

Register zero is assigned return value as the syscall after it's execution (call()).

if (reg[0] == 0 && euid == 0) {

Check if system call succeeded (zero return value), and if effective UID is equal zero (it should be if ping is setuid root).

setpeuid(ruid);

Downgrade credentials of ping(8) to those of user running it.

return reg[0];

Terminate syscall execution returning value stored in register zero.

Purpose of the above fragment was restricting credentials of ping(8) without taking away it's setuid bit.

Next part is responsible for granting root credentials to ping only when it opens raw socket. In practice that's the only reason for ping being setuid root.

if (pname == "ping" && pinode == 123 && pdev == 456) {

Check if process name is ping, program inode equals 123 and it's device number equals 456. These values can be precomputed during compilation with functions GET_INODE and GET_DEV. Precise process identification is crucial. We have to make sure that the process being run is system ping, not any other program called as ping.

if (syscall == SYS_socket) {

Check if syscall started by ping is socket(2)

if (socket_domain == AF_INET &&
        socket_type == SOCK_RAW &&
        socket_protocol == IPPROTO_ICMP) {

Set of comparisons of syscall arguments to check is type of opened socket is SOCK_RAW.

reg[0] = euid;

Store process effective UID in register zero.

setpeuid(0);

Set effective UID to zero, to make the syscall succeed.

reg[1] = call();

Run the syscall and store it's return value in register number 1.

setpeuid(reg[0]);

Restore saved credentials

return reg[1];

Return syscall return value.

That's it all for ping

Using techniques shown above we can restrict most critical setuid programs. But CerbNG can do much more. Here is another example..

3.2 NoExec

if (syscall == SYS_execve) {
        if (pruid >= 1000) {
                rmld("LD_*");
                reg[0] = realpath(arg[1]);
                if (reg[0] @ "/usr/home/*" ||
                    reg[0] @ "/tmp/*" ||
                    reg[0] @ "/var/tmp/*") {
                        log(LOG_WARNING, "!WARN! Don't have permission to run "
                            "%s (proc=%s, ruid=%u, rgid=%u, euid=%u, egid=%u)",
                            reg[0], pname, ruid, rgid, euid, egid);
                        return EPERM;
                }
        }
}

The above rule set is equivalent to noexec option to mount. But it can prevent execution on directory basis additionally stopping LD_ tricks by removal of variables starting with "LD_" prefix. Only users with UID>= 1000 are checked which is more flexible than mount approach. Every unsuccessfully attempt of execve call is logged.

Another more secure approach for allowing execve is assigning all users allowed to run their programs to group "exec".

if (syscall == SYS_execve) {
        if (ruid >= 1000) {
                if (tabindex(GET_GID("exec")) < 0) {
                        rmenv("LD_*");
                        if (getouid(arg[1]) >= 1000) {
                                log(LOG_WARNING, "!WARN! Don't have permission "
                                    "to run %s (proc=%s, ruid=%u, rgid=%u, "
                                    "euid=%u, egid=%u)", realpath(arg[1]),
                                    pname, ruid, rgid, euid, egid);
                                return EPERM;
                        }
                }
        }
}

We check if the real UID is not less than 1000, next check tests the membership of group "exec". Similarly to previous example, all LD_ variables are removed. If owner of the file being run with execve is not less than 1000 the the unsuccessful attempt is logged and syscall fails (EPERM is returned).

Not all sysadmins like the ability of their users to create hard links to files they don't own (hardlinked file cannot be removed until the link count goes to 0, which can be used to hold buggy setuid programs in the system without administrator's notice). Let's deal with this too:

if (syscall == SYS_link) {
        if (ruid >= 1000) {
                if (getouid(arg[0]) != ruid) {
                        log(LOG_WARNING, "!WARN! Don't have permission for link"
                            " creation to %s (proc=%s, ruid=%u, rgid=%u, "
                            "euid=%u, egid=%u)", realpath(arg[0]), pname, ruid,
                            rgid, euid, egid);
                        return EPERM;
                }
        }
}

If we care about users' privacy, it's sometimes important to restrict ability of reading the whole /etc/passwd and /etc/pwd.db by any user. It breaks long file listings (ls -l) and some other utilities which use password database for username mapping, but it can be resolved by finer restrictions' tuning. To give users access to only their entries in password databases, we can generate such a file and redirect open to those fake files like this:

if (syscall == SYS_open) {
        if (ruid >= 1000) {
                reg[0] = realpath(arg[0]);
                if (reg[0] == "/etc/passwd") {
                        arg[0] = genstr("/etc/private/%u.passwd", ruid);
                } else {
                        if (reg[0] == "/etc/pwd.db") {
                                arg[0] = genstr("/etc/private/%u.pwd.db", ruid);
                        }
                }
                log(LOG_INFO, "!INFO! Open of file %s was directed to %s "
                    "(proc=%s, ruid=%u, rgid=%u, euid=%u, egid=%u)", reg[0],
                    arg[0], pname, ruid, rgid, euid, egid);
                return call();
        }
}

if (syscall == SYS_setuid) {
	setsyscall(SYS_setuid); 
	call(); 
	setsyscall(SYS_setgid); 
	return call(};

reg[0] = sysctl("name.of.sysctl", <value>);
if (errno != 0) {
    ... handle the error condition ...
}