6.7 Access Control 3

6.7 Access Control 3

1. Least privilege

   • Obviously only privileged accounts should have access to privileged data
     • If you have a privileged user sitting about on the system the whole time running in privileged mode then it is open to malicious abuse
       • this creates an issue whereby the privileged accounts (with UID=0) could be manipulated into doing something they should not and access, display, copy or transmit sensitive data
         • privileged apps are therefore regarded as one of the biggest threats to a system
           • In order to get around the issue of privileged apps being abused its best to run them in provileged mode only when they need to perform a privileged task and then downgrade them to unprivileged once they are complete
             • privileged apps can downgrade to "nobody" (this user cant login) to run apps without using more privileges than necessary
   • Unprivileged apps cannot access privileged data
   • Rule: Applications should only have sufficient privilege for what they need to do at the time they need to do it

2. there are some circumstances where an unprivileged app may need privileged access

   • to enable this a special facility knows as Set User ID or SUID is used
     • If a normal user wants to execute a program it can only execute with the permissions it has unless the SUID is set in its mode
       • SUID allows you to run that one command as though you have the permission of the owner of that command
         • SUID is simply run with the permissions of the owner of the file
           • If SUID is set then permissions are as follows - rws --x --x for example, so the first execute is replaced by the special function s for SUID allowing users to run that command as the owner

3. As with privileged programs SUID is inhernetly dangerous

   • If they dont work properly then having root privileges means they can be exploited
     • and if you can exploit a buffer overflow for example that has root privileges you may be able to do anything you like
       • A way to restrict this vulnerability from getting too much access is by using the chroot command which changes the root directory for some application
         • This defines a root directory in some sub directory and it then cant see anything above that (see page 32)
           • So it can only exploit things that are further down and not get to secure files higher up the directory structure
         • chroot is useful because it provides kernel securty for what may be vulnerable applications