1.\" $NetBSD: secmodel_securelevel.9,v 1.5 2008/11/11 00:10:39 reed Exp $ 2.\" 3.\" Copyright (c) 2006 Elad Efrat <elad@NetBSD.org> 4.\" Copyright (c) 2000 Hugh Graham 5.\" All rights reserved. 6.\" 7.\" Redistribution and use in source and binary forms, with or without 8.\" modification, are permitted provided that the following conditions 9.\" are met: 10.\" 1. Redistributions of source code must retain the above copyright 11.\" notice, this list of conditions and the following disclaimer. 12.\" 2. Redistributions in binary form must reproduce the above copyright 13.\" notice, this list of conditions and the following disclaimer in the 14.\" documentation and/or other materials provided with the distribution. 15.\" 3. The name of the author may not be used to endorse or promote products 16.\" derived from this software without specific prior written permission. 17.\" 18.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 19.\" IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 20.\" OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 21.\" IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 22.\" INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 23.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 24.\" DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 25.\" THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 26.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 27.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 28.\" 29.Dd November 10, 2008 30.Dt SECMODEL_SECURELEVEL 9 31.Os 32.Sh NAME 33.Nm secmodel_securelevel 34.Nd securelevel security model 35.Sh DESCRIPTION 36The securelevel mechanism is intended to allow protecting the persistence 37of code and data on the system, or a subset thereof, from modification, even 38by the super-user, by providing convenient means of 39.Dq locking down 40a system to a degree suited to its environment. 41.Pp 42The super-user can raise the securelevel using 43.Xr sysctl 8 , 44but only 45.Xr init 8 46can lower it. 47.Pp 48.Nm 49provides four levels of securelevel, defined as follows: 50.Bl -tag -width flag 51.It \&-1 Em Permanently insecure mode 52.Bl -hyphen -compact 53.It 54Don't raise the securelevel on boot 55.El 56.It \ 0 Em Insecure mode 57.Bl -hyphen -compact 58.It 59The init process (PID 1) may not be traced or accessed by 60.Xr ptrace 2 61or procfs. 62.It 63Immutable and append-only file flags may be changed 64.It 65All devices may be read or written subject to their permissions 66.El 67.It \ 1 Em Secure mode 68.Bl -hyphen -compact 69.It 70All effects of securelevel 0 71.It 72.Pa /dev/mem 73and 74.Pa /dev/kmem 75may not be written to 76.It 77Raw disk devices of mounted file systems are read-only 78.It 79Immutable and append-only file flags may not be removed 80.It 81Kernel modules may not be loaded or unloaded 82.It 83The 84.Va net.inet.ip.sourceroute 85.Xr sysctl 8 86variable may not be changed 87.It 88Adding or removing 89.Xr sysctl 9 90nodes is denied 91.It 92The RTC offset may not be changed 93.It 94Set-id coredump settings may not be altered 95.It 96Attaching the IP-based kernel debugger, 97.Xr ipkdb 4 , 98is not allowed 99.It 100Device 101.Dq pass-thru 102requests that may be used to perform raw disk and/or memory access are denied 103.It 104.Em iopl 105and 106.Em ioperm 107calls are denied 108.It 109Access to unmanaged memory is denied 110.El 111.It \ 2 Em Highly secure mode 112.Bl -hyphen -compact 113.It 114All effects of securelevel 1 115.It 116Raw disk devices are always read-only whether mounted or not 117.It 118New disks may not be mounted, and existing mounts may only be downgraded 119from read-write to read-only 120.It 121The system clock may not be set backwards or close to overflow 122.It 123Per-process coredump name may not be changed 124.It 125Packet filtering and NAT rules may not be altered 126.El 127.El 128.Pp 129Highly secure mode may seem Draconian, but is intended as a last line of 130defence should the superuser account be compromised. 131Its effects preclude 132circumvention of file flags by direct modification of a raw disk device, 133or erasure of a file system by means of 134.Xr newfs 8 . 135Further, it can limit the potential damage of a compromised 136.Dq firewall 137by prohibiting the modification of packet filter rules. 138Preventing 139the system clock from being set backwards aids in post-mortem analysis 140and helps ensure the integrity of logs. 141Precision timekeeping is not 142affected because the clock may still be slowed. 143.Pp 144Normally, the system runs in securelevel 0 while single-user and in 145securelevel 1 while multi-user. 146If a higher securelevel is desired while running multi-user, 147it can be set using the 148.Em securelevel 149keyword in the startup script 150.Pa /etc/rc.conf , 151see 152.Xr rc.conf 5 153for details. 154Lower securelevels require the kernel to be compiled with 155.Sy options INSECURE , 156causing it to always default to securelevel \-1. 157.Pp 158In order for this protection to be effective, the administrator 159must ensure that no program that is run while the security level 160is 0 or lower, nor any data or configuration file used by any such 161program, can be modified while the security level is greater than 1620. 163This may be achieved through the careful use of the 164.Dq immutable 165file flag to define and protect a Trusted Computing Base (TCB) 166consisting of all such programs and data, or by ensuring that all 167such programs and data are on filesystems that are mounted read-only 168and running at security level 2 or higher. 169.Em Particular care must be taken to ensure, if relying upon 170.Em security level 1 and the use of file flags, that the integrity of the 171.Em TCB cannot be compromised through the use of modifications to the 172.Em disklabel or access to overlapping disk partitions, including the 173.Em raw partition . 174.Pp 175Do not overlook the fact that shell scripts (or anything else fed to an 176interpreter, through any mechanism) and the kernel itself are "programs 177that run while the security level is 0" and must be considered part of 178the TCB. 179.Sh SEE ALSO 180.Xr kauth 9 , 181.Xr secmodel 9 , 182.Xr secmodel_bsd44 9 183.Sh AUTHORS 184.An Elad Efrat Aq elad@NetBSD.org 185.Sh BUGS 186Systems without 187.Xr sysctl 8 188behave as though they have security level \-1. 189.Pp 190The security level 2 restrictions relating to TCB integrity protection 191should be enforced at security level 1. 192Restrictions dependent upon security level but not relating to TCB 193integrity protection should be selected by 194.Xr sysctl 8 195settings available only at security level 0 or lower. 196