1.\" $NetBSD: secmodel_bsd44.9,v 1.7 2006/09/19 19:22:05 elad Exp $ 2.\" 3.\" Copyright (c) 2006 Elad Efrat <elad@NetBSD.org> 4.\" All rights reserved. 5.\" 6.\" Redistribution and use in source and binary forms, with or without 7.\" modification, are permitted provided that the following conditions 8.\" are met: 9.\" 1. Redistributions of source code must retain the above copyright 10.\" notice, this list of conditions and the following disclaimer. 11.\" 2. Redistributions in binary form must reproduce the above copyright 12.\" notice, this list of conditions and the following disclaimer in the 13.\" documentation and/or other materials provided with the distribution. 14.\" 3. All advertising materials mentioning features or use of this software 15.\" must display the following acknowledgement: 16.\" This product includes software developed by Elad Efrat. 17.\" 4. The name of the author may not be used to endorse or promote products 18.\" derived from this software without specific prior written permission. 19.\" 20.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 21.\" IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 22.\" OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 23.\" IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 24.\" INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 25.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 26.\" DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 27.\" THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 28.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 29.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 30.\" 31.Dd September 19, 2006 32.Dt SECMODEL_BSD44 9 33.Os 34.Sh NAME 35.Nm secmodel_bsd44 36.Nd traditional 37.Nx 38security model (based on 39.Bx 4.4 ) 40.Sh SYNOPSIS 41.In secmodel/bsd44/bsd44.h 42.In secmodel/bsd44/securelevel.h 43.In secmodel/bsd44/suser.h 44.Sh DESCRIPTION 45.Nm 46is the default security model in 47.Nx . 48It is the traditional security model based on 49.Bx 4.4 50and is composed of two main concepts, the 51.Em super-user 52and the 53.Em securelevel . 54.Ss Super-user 55The 56.Em super-user 57is the host administrator, considered to have higher privileges than other 58users. 59It is the only entity the kernel recognizes by having an effective user-id 60of zero. 61.Ss Securelevel 62The securelevel mechanism is intended to allow protecting the persistance 63of code and data on the system, or a subset thereof, from modification, even 64by the super-user, by providing convenient means of 65.Dq locking down 66a system to a degree suited to its environment. 67.Pp 68The super-user can raise the securelevel using 69.Xr sysctl 8 , 70but only 71.Xr init 8 72can lower it. 73.Pp 74.Nm 75provides four levels of securelevel, defined as follows: 76.Bl -tag -width flag 77.It \&-1 Em Permanently insecure mode 78.Bl -hyphen -compact 79.It 80Don't raise the securelevel on boot 81.El 82.It \ 0 Em Insecure mode 83.Bl -hyphen -compact 84.It 85The init process (PID 1) may not be traced or accessed by 86.Xr ptrace 2 , 87.Xr systrace 4 , 88or procfs. 89.It 90Immutable and append-only file flags may be changed 91.It 92All devices may be read or written subject to their permissions 93.El 94.It \ 1 Em Secure mode 95.Bl -hyphen -compact 96.It 97All effects of securelevel 0 98.It 99.Pa /dev/mem 100and 101.Pa /dev/kmem 102may not be written to 103.It 104Raw disk devices of mounted file systems are read-only 105.It 106Immutable and append-only file flags may not be removed 107.It 108Kernel modules may not be loaded or unloaded 109.It 110The 111.Va net.inet.ip.sourceroute 112.Xr sysctl 8 113variable may not be changed 114.It 115Adding or removing 116.Xr sysctl 9 117nodes is denied 118.It 119The RTC offset may not be changed 120.It 121Set-id coredump settings may not be altered 122.El 123.It \ 2 Em Highly secure mode 124.Bl -hyphen -compact 125.It 126All effects of securelevel 1 127.It 128Raw disk devices are always read-only whether mounted or not 129.It 130New disks may not be mounted, and existing mounts may only be downgraded 131from read-write to read-only 132.It 133The system clock may not be set backwards or close to overflow 134.It 135Per-process coredump name may not be changed 136.It 137Packet filtering and NAT rules may not be altered 138.El 139.El 140.Pp 141Highly secure mode may seem Draconian, but is intended as a last line of 142defence should the superuser account be compromised. 143Its effects preclude 144circumvention of file flags by direct modification of a raw disk device, 145or erasure of a file system by means of 146.Xr newfs 8 . 147Further, it can limit the potential damage of a compromised 148.Dq firewall 149by prohibiting the modification of packet filter rules. 150Preventing 151the system clock from being set backwards aids in post-mortem analysis 152and helps ensure the integrity of logs. 153Precision timekeeping is not 154affected because the clock may still be slowed. 155.Pp 156Normally, the system runs in securelevel 0 while single-user and in 157securelevel 1 while multi-user. 158If a higher securelevel is desired while running multi-user, 159it can be set using the 160.Em securelevel 161keyword in the startup script 162.Pa /etc/rc.conf , 163see 164.Xr rc.conf 5 165for details. 166Lower securelevels require the kernel to be compiled with 167.Sy options INSECURE , 168causing it to always default to securelevel \-1. 169.Pp 170In order for this protection to be effective, the administrator 171must ensure that no program that is run while the security level 172is 0 or lower, nor any data or configuration file used by any such 173program, can be modified while the security level is greater than 1740. 175This may be achieved through the careful use of the 176.Dq immutable 177file flag to define and protect a Trusted Computing Base (TCB) 178consisting of all such programs and data, or by ensuring that all 179such programs and data are on filesystems that are mounted read-only 180and running at security level 2 or higher. 181.Em Particular care must be taken to ensure, if relying upon 182.Em security level 1 and the use of file flags, that the integrity of the 183.Em TCB cannot be compromised through the use of modifications to the 184.Em disklabel or access to overlapping disk partitions, including the 185.Em raw partition . 186.Pp 187Do not overlook the fact that shell scripts (or anything else fed to an 188interpreter, through any mechanism) and the kernel itself are "programs 189that run while the security level is 0" and must be considered part of 190the TCB. 191.Sh SEE ALSO 192.Xr kauth 9 , 193.Xr secmodel 9 194.Sh AUTHORS 195.An Elad Efrat Aq elad@NetBSD.org 196.Sh BUGS 197Systems without 198.Xr sysctl 8 199behave as though they have security level \-1. 200.Pp 201The security level 2 restrictions relating to TCB integrity protection 202should be enforced at security level 1. 203Restrictions dependent upon security level but not relating to TCB 204integrity protection should be selected by 205.Xr sysctl 8 206settings available only at security level 0 or lower. 207