Re: TALPA - a threat model? well sorta.

On Wed, Aug 13, 2008 at 12:36:15PM -0400, Eric Paris wrote:

I miss a clear answer to the question: is this
supposed to protect against malware injected as root or not?

Assuming it wants to protect against root:

think we hear claim more grandious things. But from what I've seen they
aren't the real deal. Most of the security model descriptions that
people on list want actually are framed under the belief that these
products need to or attempt to completely block some class of attacks.
They don't. If you think they do you need to fix your frame of
reference. The only class of attacks this interface is supposed to
address is those that can be found by scanning files. This is NOT an
LSM.

But you need some LSM like protections to be able to protect the file
scanner? Like the block device or kernel memory protection.

The real goal is to get files into to some userspace scanner and let
them do whatever they want. Remember, this isn't a new LSM. The goal
isn't to provide perfect security. The goal isn't to stop already
running malicious programs. The one and only goal is to scan files. We
should not be considering timing attacks, we should not be considering
processes actively trying to get around the system for small periods of
time. We should certainly not be considering root processes being able
to sneak things by.

This means you need significant LSM components simply to protect
the integrity of the file scanner against root. It's even
unclear it's possible in the general case (e.g. X server doing
arbitary DMA and no IOMMU -- how do you protect the file scanner?)

The idea is that a file exists on disk and we want
some userspace program to give a best effort at scanning it. Yes, we

Ok so you're implying it's ok to not protect against root?

In the later case that means that you don't have to scan anything
that only root can touch and you can trust file permissions,
which makes a lot of things easier.

I would suggest again to clarify this important point first. It has
significant impact on the whole design.

Personally I would think not protecting against root would be quite
limiting (e.g. it would mean that e.g. if some worm trojans rpms
people download then they wouldn't be caught because rpms are
installed as root), but on the other hand if you protect against
root you need most of selinux/aa/other lsm functionality simply
to guarantee the integrity of the scanner. Also it has impact
on some apps, e.g. X server running as root would be usually out due to
the arbitary DMA issue. Also protect block devices could theoretically
have significant impact on some sysadmin tasks.

-Andi
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

Relevant Pages

  • Re: [malware-list] TALPA - a threat model? well sorta.
    ... I honestly don't think we should worry about root. ... scanner for file servers ... "how do we protect the file scanner", ... Complete rootkit protection is a whole other area not ...
    (Linux-Kernel)
  • Re: TALPA - a threat model? well sorta.
    ... I honestly don't think we should worry about root. ... Sure, if the AV scanner ... But you need some LSM like protections to be able to protect the file ...
    (Linux-Kernel)
  • Re: TALPA - a threat model? well sorta.
    ... protections against maliciously attacking programs be they root or not. ... happen is that the scanner is going to scan the trojan.rpm when yum ... Stop thinking this is an LSM or as a new security model. ... But you need some LSM like protections to be able to protect the file ...
    (Linux-Kernel)
  • Re: Regarding sudo
    ... A normal user cannot damage the critical system files. ... etc.) The root account is capable of causing great damage ... Protect system backups. ...
    (comp.os.linux.setup)
  • Re: UPDATE: Missing South Carolina/Hilton Head Couple
    ...  looked at every year to protect  against this happening? ...  With a scanner and a printer, ... are not a means of uncovering fraud. ... accounts have much lower balances than the doctored statements indicate).. ...
    (alt.true-crime)