0 Multi Category Security (MCS)

John Johansen edited this page 2020-12-30 05:37:30 +00:00

Table of Contents

• Reference
• Introduction
• Utilities
• Defining categories
• AppArmor 2 & 3
• Dropping categories
• AppArmor 4
• ????
• Base Policy
• Task label using delegated
• Dropping Delegation
• AppArmor 5?
• User Defined Policy

Reference

• Users in AppArmor
• Link to context/label documentation
• Link to policy ???
• Link to pam_apparmor

need to define user/grouping/roles to user ids. Map as variables (possibly auto generated from custom file format).

• user and session info loaded by pam_apparmor
• what of parser? pam_apparmor is only good for logins that go through the pam stack

apparmor uses profiles, variables, and stacking and delegation to achieve what selinux uses selinux users, MLS, MCS and roles.

eg. for the selinux context user_u:object_r:tmp_t:Moonbase_Plans an equivalent apparmor label might be (user_u//&object_r//&tmp_t//)+Moonbase_plans or some such with each part of the text label being its own rule set.

Introduction

AppArmor is capable of providing Multi-category security though how it is done is different than Multi-category security in selinux.

Utilities

• aa-category
• aa-group

Defining categories

need well defined locations so can doc and tools can use

In AppArmor categories are defined by the policy admin. Unless user defined policy is used this means the categories must be defined by the policy admin before they can be used.

category include files

AppArmor 2 & 3

include per category, add new items by editing include and reloading policy

Dropping categories

requires changing profiles

AppArmor 4

AppArmor 4 is compatible with the MCS techniquies used in AppArmor 2 and 3, in addition AppArmor 4 introduces delegation which can be used to provide a more dynamic form of MCS. Delegation extends AppArmor so that the tasks label can express the categories that the task belongs to and allows users and tasks to drop categories without having to change profiles.

????

policy chunk instead of plane include.

Base Policy

needs to include delegation categories and allow delegation of them - won't show up in name

use policy directed delegation or API for rule delegation to setup task in category

Application policy no longer includes category unless it should have access by default, delegation adds the needed accesses.

Exec attachment based delegations profile Example//+private /usr/bin/example {}

Task label using delegated

  Example//+private

Dropping Delegation

AppArmor 5?

Tagging files for categories

User Defined Policy

User defined policy allows users to be admins of their own policy separate from the system policy. Using the same techniques used by system policy the user can define their own categories and policies that restrict the applications the user runs.