Grsecurity/Overview

Grsecurity
Overview Terminology


grsecurity is a set of patches for the Linux kernel with an emphasis on enhancing security. Its typical application is in web servers and systems that accept remote connections from untrusted locations, such as systems offering shell access to its users.

Released under the GNU General Public License, grsecurity is free software.

HistoryEdit

Work on grsecurity began in February 2001 as a port of Openwall Project's security-enhancing patches for Linux 2.4. The first release of grsecurity was for Linux 2.4.1.

PaXEdit

A major component bundled with grsecurity is PaX, which is a patch that, amongst other things, flags data memory, such as that on the stack, as non-executable, and program memory as non-writable. The aim is to prevent executable memory pages from being overwritten with injected machine code, which prevents exploitation of many types of security vulnerabilities, such as buffer overflows. PaX also provides address space layout randomization (ASLR), which randomizes important memory addresses to hinder attacks that rely on such addresses being easily known. PaX is not itself developed by the grsecurity developers, and is also available independently from grsecurity [1].

Role-based Access ControlEdit

Another notable component of grsecurity is that it provides a full Role-based access control (RBAC) system. RBAC is intended to restrict access to the system further than what is normally provided by Unix access control lists, with the aim of creating a fully least-privilege system, where users and processes have the absolute minimum privileges to work correctly and nothing more. This way, if the system is compromised, the ability by the attacker to damage or gain sensitive information on the system can be drastically reduced. RBAC works through a collection of "roles". Each role can have individual restrictions on what they can or cannot do, and these roles and restrictions form a "policy" which can be amended as needed.

A list of RBAC features:

  • Domain support for users and groups
  • Role transition tables
  • IP-based roles
  • Non-root access to special roles
  • Special roles that require no authentication
  • Nested subjects
  • Variable support in configuration
  • And, or, and difference set operations on variables in configuration
  • Object mode that controls the creation of setuid and setgid files
  • Create and delete object modes
  • Kernel interpretation of inheritance
  • Real-time regular-expression resolution
  • Ability to deny ptraces to specific processes
  • User and group transition checking and enforcement on an inclusive or exclusive basis
  • /dev/grsec special device for kernel authentication and learning logs
  • Next-generation code that produces least-privilege policies for the entire system with no configuration
  • Policy statistics for gradm
  • Inheritance-based learning
  • Learning configuration file that allows the administrator to enable inheritance-based learning or disable learning on specific paths
  • Full pathnames for offending process and parent process
  • RBAC status function for gradm
  • /proc/<pid>/ipaddr gives the remote address of the person who started a given process
  • Secure policy enforcement
  • Supports read, write, append, execute, view, and read-only ptrace object permissions
  • Supports hide, protect, and override subject flags
  • Supports the PaX flags
  • Shared memory protection feature
  • Integrated local attack response on all alerts
  • Subject flag that ensures a process can never execute trojaned code
  • Full-featured fine-grained auditing
  • Resource, socket, and capability support
  • Protection against exploit bruteforcing
  • /proc/pid filedescriptor/memory protection
  • Rules can be placed on non-existent files/processes
  • Policy regeneration on subjects and objects
  • Configurable log suppression
  • Configurable process accounting
  • Human-readable configuration
  • Not filesystem or architecture dependent
  • Scales well: supports as many policies as memory can handle with the same performance hit
  • No runtime memory allocation
  • SMP safe
  • O(1) time efficiency for most operations
  • Include directive for specifying additional policies
  • Enable, disable, reload capabilities
  • Option to hide kernel processes

Chroot RestrictionsEdit

grsecurity restricts chroot in a variety of ways to prevent a variety of vulnerabilities, privilege escalation attacks, and to add additional checks and balances.

Chroot Modifications:

  • No attaching shared memory outside of chroot
  • No kill outside of chroot
  • No ptrace outside of chroot (architecture independent)
  • No capget outside of chroot
  • No setpgid outside of chroot
  • No getpgid outside of chroot
  • No getsid outside of chroot
  • No sending of signals by fcntl outside of chroot
  • No viewing of any process outside of chroot, even if /proc is mounted
  • No mounting or remounting
  • No pivot_root
  • No double chroot
  • No fchdir out of chroot
  • Enforced chdir("/") upon chroot
  • No (f)chmod +s
  • No mknod
  • No sysctl writes
  • No raising of scheduler priority
  • No connecting to abstract Unix domain sockets outside of chroot
  • Removal of harmful privileges via capabilities

Miscellaneous FeaturesEdit

grsecurity also adds enhanced auditing to the Linux kernel. It can be configured to audit a specific group of users, audit mounts/unmounts of devices, changes to the system time and date, chdir logging, amongst other things. Some of these other things allow the admin to also log denied resource attempts, failed fork attempts, and exec logging with arguments.

Trusted path execution is another optional feature that can be used to prevent users from executing binaries that are not owned by the root user, or are world-writable. This is useful to prevent users from executing their own malicious binaries or accidentally executing system binaries that could have been modified by a malicious user (being world-writable).

grsecurity also hardens the way chroot "jails" work. A chroot jail can be used to isolate a particular process from the rest of the system, which can be used to minimise the potential for damage should the service be compromised. However, there are ways to "break out" of a chroot jail. grsecurity attempts to prevent this.

There are also other features that increase security and prevent users from gaining unnecessary knowledge about the system, such as restricting the dmesg and netstat commands to the root user [2].

List of additional features and security improvements:

  • /proc restrictions that don't leak information about process owners
  • Symlink/hardlink restrictions to prevent /tmp races
  • Hardlink restrictions to prevent users from hardlinking to files they do not own
  • FIFO/Named pipe restrictions
  • dmesg(8) restriction
  • Enhanced implementation of Trusted Path Execution
  • Group-based socket restrictions
  • Nearly all options are sysctl-tunable, with a locking mechanism
  • All alerts and audits support a feature that logs the IP address of the attacker with the log
  • Stream connections across unix domain sockets carry the attacker's IP address with them (on 2.4 kernels only)
  • Detection of local connections: copies attacker's IP address to the other task
  • Automatic deterrence of exploit bruteforcing
  • Pre-defined Low, Medium, High, and Custom security levels
  • Tunable flood-time and burst for logging

Next Page: Terminology

Home: Grsecurity

Last modified on 9 July 2013, at 18:24