privilege separation in unix (week 4)

Question 1

what are some separation schemes

Answer 1

• type of data (friend lists vs passwords)
• by user (my email vs. your email)
• by bugginess (image resizing vs everything else)
• by exposure to direct attacks (request parsing vs everything else)

Question 2

unix

Answer 2

1st OS that wanted to support multiple users
goal: time sharing
remote access
time-sharing

Question 3

thread model for unix

Answer 3

unix is a multi-user OS (ancestor to MacOS, Linux, BSD)
adversary: other users!
policy: other users shouldn’t access my files, mess with my applications when they are running
UNIX doesn’t reason in terms of users but rather processes

Question 4

processes in UNIX

Answer 4

most basic UNIX tool for keeping programs/data separate

process’s user ID controls many of its privileges

process also has a set of groups GIDs used in file permissions

Question 5

isolation between processes

Answer 5

processes with same UID can send signal, wait for exit, get status, debug, (ptrace) each other

debugging, sending signals: must have same UID

waiting / getting status: must be parent of that process

Question 6

isolation between process memory

Answer 6

a process cannot directly access memory in another process

exeptions: debug mechanisms (ptrace), memory mapped files, shared memory

Question 7

how is a process’s uid and gid set

Answer 7

superuser (UID 0) can call setuid(uid) and setgid(gid)

non-superuser processes can’t change their UID

UID inherited during fork(), exec()

Question 8

least privilege principle

Answer 8

a component should only have access to what it needs and only for as long as it needs it

Question 9

how does unix exercise the least privilege principle during login?

Answer 9

1. check password in /etc/shadow (needs root privilege for this)
2. find user’s UID in /etc/passwd (doesn’t need root privilege)
3. find user’s GID in /etc/group (doesn’t need root privilege)
4. downgrades UID and GID to user’s and spawns shell (calls fork() and exec())

Question 10

how is isolation maintained whenever there’s a system call

Answer 10

there are checks in the kernel that make sure that you have the correct permissions
all system calls come with permission checks to make sure that you’re allowed to open that file or that you’re allowed to spawn that thing or wait…etc

Question 11

central questions for privilege separation in unix for files and diretories:

Answer 11

1. how does unix handle isolating files so that users cannot see each others’ files when not shared
2. allow sharing when users do want to share?

Question 12

operations for files

Answer 12

read, write, execute, change permissions

Question 13

operations for directories

Answer 13

lookup, create, remove, rename, change permissions

Question 14

inode: index node

Answer 14

data structure that describes a file system object: file or directory

metadata:
size
owner UID and GID
times
link and block counts
permissions

points to data!: a bunch of pointers to file blocks

Question 15

inode permissions

Answer 15

3 principals: owner, group, others

each inode has read, write, execute perms for each principal

rwx-rwx-r-x
first three are permissions for owner
second three are perms for group
third three are perms for others

Question 16

octal representation

Answer 16

think of each three rwx as bits
111 = 7
101 = 5
100 = 4

Question 17

What if a directory has execute access but not read?

Answer 17

can access files but not list them

Question 18

what do you need to execute this:

open(“/etc/passwd”)

Answer 18

process must be able to look up “etc” in “/”, “passwd” in “/etc” (x permission)
must be able to open “/etc/passwd” (r or w permission)

Question 19

why is unix RWX not very flexible?

Answer 19

cannot have two owners
cannot have permissions for specific users
cannot express complex policies easily

Question 20

how would you set up a file “hello.txt” that can only be accessed in uid=”ubuntu” and gid=”penn”?

Answer 20

???

Question 21

who can change file permissions

Answer 21

only its owner (UID)

Question 22

how to change file permissions?

Answer 22

chmod changes permissions
chown changes uid and optionally group gid
chgrp change group (gid)

Question 23

unix takeaways

Answer 23

unix allows one to control which users can access a specific file
hard to control the set of files that a specific process can access

Question 24

setuid/setgid

Answer 24

when a process runs, it inherits privileges of parent

how can we run programs that raise their privilege level?
sudo, su, ping, mount, passwd, chsh

setuid/gid binaries execute with privileges of file’s owner or group