1.\" $NetBSD: secmodel_securelevel.9,v 1.17 2018/04/27 09:33:43 wiz Exp $ 2.\" 3.\" Copyright (c) 2006 Elad Efrat <elad@NetBSD.org> 4.\" Copyright (c) 2000 Hugh Graham 5.\" All rights reserved. 6.\" 7.\" Redistribution and use in source and binary forms, with or without 8.\" modification, are permitted provided that the following conditions 9.\" are met: 10.\" 1. Redistributions of source code must retain the above copyright 11.\" notice, this list of conditions and the following disclaimer. 12.\" 2. Redistributions in binary form must reproduce the above copyright 13.\" notice, this list of conditions and the following disclaimer in the 14.\" documentation and/or other materials provided with the distribution. 15.\" 3. The name of the author may not be used to endorse or promote products 16.\" derived from this software without specific prior written permission. 17.\" 18.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 19.\" IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 20.\" OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 21.\" IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 22.\" INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 23.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 24.\" DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 25.\" THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 26.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 27.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 28.\" 29.Dd April 26, 2018 30.Dt SECMODEL_SECURELEVEL 9 31.Os 32.Sh NAME 33.Nm secmodel_securelevel 34.Nd securelevel security model 35.Sh DESCRIPTION 36The securelevel mechanism is intended to allow protecting the persistence 37of code and data on the system, or a subset thereof, from modification, even 38by the 39.Em super-user , 40by providing convenient means of 41.Dq locking down 42a system to a degree suited to its environment. 43.Pp 44The 45.Em super-user 46can raise the 47.Em securelevel 48using 49.Xr sysctl 8 , 50but only 51.Xr init 8 52can lower it. 53.Pp 54Four security levels are provided: 55.Bl -tag -width flag 56.It \&-1 Em Permanently insecure mode 57.Bl -bullet 58.It 59Do not raise the 60.Em securelevel 61on boot. 62.El 63.It \ 0 Em Insecure mode 64.Bl -bullet 65.It 66The init process (PID 1) may not be traced or accessed by 67.Xr ptrace 2 68or procfs. 69.It 70Immutable and append-only file flags may be changed by 71.Xr chflags 1 72or by other means. 73.It 74All devices may be read or written subject to their permissions. 75.It 76All 77.Xr gpio 4 78pins can be set and device drivers can be attached to them. 79.It 80On architectures that support 81.Xr module 7 , 82kernel modules can be loaded and unloaded. 83.El 84.It \ 1 Em Secure mode 85.Bl -bullet 86.It 87All effects of 88.Em securelevel 890. 90.It 91The 92.Xr x86/kmem 4 93memory files 94.Pa /dev/mem 95and 96.Pa /dev/kmem 97may not be written to. 98.It 99Raw disk devices of mounted file systems are read-only. 100.It 101Immutable and append-only file flags may not be removed. 102.It 103Kernel modules may not be loaded or unloaded. 104.It 105Neither the 106.Va net.inet.ip.sourceroute 107nor the 108.Va vm.user_va0_disable 109.Xr sysctl 8 110variables may be changed. 111.It 112Adding or removing 113.Xr sysctl 9 114nodes is denied. 115.It 116The RTC offset may not be changed. 117.It 118Set-id coredump settings may not be altered. 119.It 120Attaching the IP-based kernel debugger, 121.Xr ipkdb 4 , 122is not allowed. 123.It 124Device 125.Dq pass-thru 126requests that may be used to perform raw disk and/or memory access are denied. 127.It 128The 129.Em iopl 130and 131.Em ioperm 132calls are denied. 133.It 134Access to unmanaged memory is denied. 135.It 136Only GPIO pins that have been set at 137.Em securelevel 1380 can be accessed. 139.It 140SVS (Separate Virtual Space) may not be disabled on platforms that support it. 141.El 142.It \ 2 Em Highly secure mode 143.Bl -bullet 144.It 145All effects of 146.Em securelevel 1471. 148.It 149Raw disk devices are always read-only whether mounted or not. 150.It 151New disks may not be mounted, and existing mounts may only be downgraded 152from read-write to read-only. 153.It 154The system clock may not be set backwards or close to overflow. 155.It 156Per-process coredump name may not be changed. 157.It 158Packet filtering and NAT rules may not be altered. 159.It 160CPU ucode loading is denied on platforms that support it. 161.El 162.El 163.Pp 164Highly secure mode may seem Draconian, but is intended as a last line of 165defence should the 166.Em super-user 167account be compromised. 168Its effects preclude 169circumvention of file flags by direct modification of a raw disk device, 170or erasure of a file system by means of 171.Xr newfs 8 . 172Further, it can limit the potential damage of a compromised 173.Dq firewall 174by prohibiting the modification of packet filter rules. 175Preventing 176the system clock from being set backwards aids in post-mortem analysis 177and helps ensure the integrity of logs. 178Precision timekeeping is not 179affected because the clock may still be slowed. 180.Pp 181Normally, the system runs in 182.Em securelevel 1830 while single-user and in 184.Em securelevel 1851 while multi-user. 186If a higher 187.Em securelevel 188is desired while running multi-user, 189it can be set using the 190.Sy securelevel 191keyword in the startup script 192.Pa /etc/rc.conf , 193see 194.Xr rc.conf 5 195for details. 196Lower securelevels require the kernel to be compiled with 197.Sy options INSECURE , 198causing it to always default to 199.Em securelevel 200\-1. 201.Pp 202In order for this protection to be effective, the administrator 203must ensure that no program that is run while the security level 204is 0 or lower, nor any data or configuration file used by any such 205program, can be modified while the security level is greater than 2060. 207This may be achieved through the careful use of the 208.Dq immutable 209file flag to define and protect a Trusted Computing Base (TCB) 210consisting of all such programs and data, or by ensuring that all 211such programs and data are on filesystems that are mounted read-only 212and running at security level 2 or higher. 213.Em Particular care must be taken to ensure, if relying upon 214.Em security level 1 and the use of file flags, that the integrity of the 215.Em TCB cannot be compromised through the use of modifications to the 216.Em disklabel or access to overlapping disk partitions, including the 217.Em raw partition . 218.Pp 219Do not overlook the fact that shell scripts (or anything else fed to an 220interpreter, through any mechanism) and the kernel itself are "programs 221that run while the security level is 0" and must be considered part of 222the TCB. 223.Pp 224The following 225.Xr sysctl 3 226variables are exported: 227.Bl -tag -width compact 228.It security.models.securelevel.securelevel 229The system security level. 230This level may be raised by processes with appropriate privilege. 231It may only be lowered by process 1 (init). 232.El 233.Sh FUNCTIONS 234.Nm 235exposes a 236.Xr secmodel_eval 9 237evaluation routine 238to test whether the current 239.Em securelevel 240is above a certain threshold level or not. 241.Pp 242The parameters to 243.Xr secmodel_eval 9 244are: 245.Bl -tag -compact -width xxxxx 246.It id 247the unique identifier of 248.Nm : 249.Qo Dv org.netbsd.secmodel.securelevel Qc . 250.It what 251a string, 252.Qo Dv is-securelevel-above Qc . 253.It arg 254a reference to an 255.Dv int 256representing the threshold level. 257.It ret 258a boolean, set by 259.Nm 260to 261.Dv true 262when the 263.Em securelevel 264is strictly above 265the threshold level, 266.Dv false 267otherwise. 268.El 269.Sh RETURN TYPES 270If successful, the evaluation returns 0 with the 271.Fa ret 272argument being either 273.Dv true 274or 275.Dv false . 276.Sh SEE ALSO 277.Xr kauth 9 , 278.Xr secmodel 9 , 279.Xr secmodel_bsd44 9 , 280.Xr secmodel_eval 9 281.Sh AUTHORS 282.An Elad Efrat Aq Mt elad@NetBSD.org 283.Sh BUGS 284Systems without 285.Xr sysctl 8 286behave as though they have security level \-1. 287.Pp 288The security level 2 restrictions relating to TCB integrity protection 289should be enforced at security level 1. 290Restrictions dependent upon security level but not relating to TCB 291integrity protection should be selected by 292.Xr sysctl 8 293settings available only at security level 0 or lower. 294