Rule Set Based Access Control (RSBAC) for Linux - Overview
What is RSBAC?
RSBAC is a security extension for current Linux kernels. It is based on the Generalized
Framework for Access Control (GFAC) by Abrams and LaPadula and provides a flexible system
of access control based on several modules.
All security relevant system calls are extended by security enforcement code. This code
calls the central decision component, which in turn calls all active decision modules and
generates a combined decision. This decision is then enforced by the system call
extensions.
Decisions are based on the type of access (request type), the access target and on the
values of attributes attached to the subject calling and to the target to be accessed.
Additional independent attributes can be used by individual modules, e.g. the privacy
module (PM). All attributes are stored in fully protected directories, one on each mounted
device. Thus changes to attributes require special system calls provided.
As all types of access decisions are based on general decision requests, many different
security policies can be implemented as a decision module. In the RSBAC version 1.0.9a,
the following modules are included:
- MAC
- Bell-LaPadula Mandatory Access Control (compartments limited to a number of 64)
- FC
- Functional Control. A simple role based model, restricting access to security
information to security officers and access to system information to administrators.
- SIM
- Security Information Modification. Only security administrators are allowed to modify
data labeled as security information
- PM
- Privacy Model. Simone
Fischer-Hübner's Privacy Model in its first implementation. See our paper on PM implementation (43K) for the National Information
Systems Security Conference (NISSC 98)
- MS
- Malware Scan. Scan all files for malware on execution (optionally on all file read
accesses or on all TCP/UDP read accesses), deny access if infected. Currently the Linux
viruses Bliss.A and Bliss.B and a handfull of others are detected. See our paper on Approaches to Integrated Malware Detection and Avoidance (34K) for
The Third Nordic Workshop on Secure IT Systems (Nordsec'98)
- FF
- File Flags. Provide and use flags for dirs and files, currently execute_only (files),
read_only (files and dirs), search_only (dirs), secure_delete (files) and add_inherited
(files and dirs). Only security officers may modify these flags.
- RC
- Role Compatibility. Defines 64 roles and 64 types for each target type (file, dir, dev,
ipc, scd, process). For each role compatibility to all types and to other roles can be set
individually and with request granularity.
- AUTH
- Authorization enforcement. Controls all CHANGE_OWNER requests for process targets, only
programs/processes with general setuid allowance and those with a capability for the
target user ID may setuid. Capabilities are controlled by other programs/processes.
- ACL
- Access Control Lists. For every object there is an Access Control List, defining which
subjects may access this object with which request types. Subjects can be of type user, RC
role and ACL group. Objects are grouped by their target type, but have individual ACLs. If
there is no ACL entry for a subject at an object, rights are inherited from parent
objects, restricted by an inheritance mask. Direct (user) and indirect (role, group)
rights are accumulated. For each object type there is a default ACL on top of the normal
hierarchy. Group management has been added for version 1.0.9a.
The underlying models are described in an extra text.
A general goal of RSBAC has been to some day reach (obsolete) Orange Book (TCSEC) B1
level. Now it is mostly targeting to be useful as secure and multi-purposed networked
system, with special interest in firewalls.
Questions, tips, etc.
05-Jan-00, -ao