Rule Set Based Access Control (RSBAC) - Targets and Requests

# Rule Set Based Access Control (RSBAC) for Linux - Targets and Requests

## Targets

RSBAC restricts access by subjects to objects. The subjects are always processes, acting on behalf of a user with certain attributes, like system_role etc. Objects in RSBAC are called (Access) Targets. They are grouped in Target Types. The following types are defined:

FILE | Files, including device special files. Identified by device and inode number.
DIR | Directories, identified by device and inode number.
DEV | Devices, identified by type (char or block), major and minor number
IPC | InterProcess Communication: Semaphores (sem), Messages (msg), Shared Memory (shm), Sockets (sock) and FiFo (fifo).
SCD | System Control Data: Objects affecting the whole system. This target type is the only one with a fixed number of objects, identified by number (see below).
USER | Users as objects, mostly for access control information (ACI).
PROCESS | Processes as objects.
NONE | No object associated with this request. In some models (RC, ACL) this is internally changed into SCD target "other".
FD | (Only in user space): Let the command line tool decide between types FILE and DIR

System Control Data (SCD) targets are these:

time_strucs | System timer
clock | System time and date
host_id | Host name
net_id | Domain name
ioports | Access Control for direct hardware access
rlimit | Setting process ressource limits
swap | Control of swapping
syslog | System log
rsbac | RSBAC data in /proc
rsbaclog | RSBAC own log
kmem | Direct access to kernel memory via proc or device
other | (only internal in RC and ACL): Substitute for target NONE
auth_administration | (only in RC and ACL): AUTH model administration

## Requests

Before access to a target is granted, a request call to the Access Control Decision facility (ADF) is performed. Based on the request type and the target, access can be granted or denied. RSBAC defines the following requests:

Request | Description | Valid Target Types
--- | --- | ---
ADD_TO_KERNEL | Add a kernel module | NONE
ALTER | Change IPC control information | IPC
APPEND_OPEN | Open to append | FILE, DEV, IPC
CHANGE_GROUP | Change active group | FILE, DIR, IPC, USER, PROCESS, NONE
CHANGE_OWNER | Change owner | FILE, DIR, IPC, PROCESS, NONE
CHDIR | Change working directory | DIR
CLONE | Fork/clone a process | PROCESS
CLOSE | Close opened file etc. Should always be granted. | FILE, DIR, DEV, IPC
CREATE | Create object | DIR (where), IPC
DELETE | Delete object | FILE, DIR, IPC
EXECUTE | Execute a file, library code from a file or other code | FILE, NONE
GET_PERMISSIONS_DATA | Read Unix permissions (mode) | FILE, DIR, IPC, SCD
GET_STATUS_DATA | Get status (stat() etc.) | FILE, DIR, IPC, SCD
LINK_HARD | Hard link | FILE
MODIFY_ACCESS_DATA | Change access information, e.g. time, date | FILE, DIR
MODIFY_ATTRIBUTE | Change an RSBAC attribute value | All target types
MODIFY_PERMISSIONS_DATA | Change Unix permissions | FILE, DIR, IPC, SCD
MODIFY_SYSTEM_DATA | Change system settings | SCD
MOUNT | Mount a filesystem | DIR, DEV
READ | Read from DIR (or socket, MS only) | DIR, IPC
READ_ATTRIBUTE | Read RSBAC attribute value | All target types
READ_OPEN | Open for read | FILE, DEV, IPC
READ_WRITE_OPEN | Open for read and write | FILE, DEV, IPC
REMOVE_FROM_KERNEL | Remove kernel module | NONE
RENAME | Rename | FILE, DIR
SEARCH | Lookup in dir from inside kernel for access with full path | DIR
SEND_SIGNAL | Send a signal | PROCESS
SHUTDOWN | Shutdown/reboot system | NONE
SWITCH_LOG | Change RSBAC log settings | NONE
SWITCH_MODULE | Switch decision module on/off | NONE
TERMINATE | End a process. Should always be granted. | PROCESS
TRACE | Trace a process | PROCESS
TRUNCATE | Truncate | FILE
UMOUNT | Umount a filesystem | DIR, DEV, NONE
WRITE | Write to a dir. Used for object moving to target dir. | DIR, SCD
WRITE_OPEN | Open for write | FILE, DEV, IPC

Please remember that some models (RC, ACL) internally change NONE targets to SCD target "other" for access control.

Questions, tips, etc.

30-Nov-00, -ao