Title: INTROSEC / access_control
Tags: access_control unix containers_and_virtualization

Q: What is Access Control
A: The decision to permit or deny a subject access to system objects (network, data, application, service, etc.).

Q: What is the Reference Monitor?
A: Component that authorizes / denies access request to the system objects.
Example: Component of the file system in an operating system to regulate access to files.

Q: What are required properties of a Reference Monitor? (3)
A: - non-bypassable
  - all access request to objects must pass through the reference monitor
  - prevents unexpected violations of the enforced security policy
- verifiable
  - monitor should be amenable to analysis and tests
  - it should be verifiable that the monitor correctly enforces the security policy
- tamper-proof
  - correct functioning of the reference monitor cannot be compromised by an attacker

Q: What is a Security Policy?
A: A Security Policy is a set of rules defining which access rights
subjects have on objects.

Q: What are the operational / administrative aspects of a Security Policy?
A: - How and by whom rules can be added / modified / delted
- Delegation: Can a subject with certain access rights propagat them to other subjects?
- Revocation: How can access rights be taken away from a subject?

Q: Describe the Access Control Matrix.
A: - Rows represent subjects, columns represent objects
- Intersection contains the access rights of the subject for the object

Q: Describe Access Control Lists (ACL).
A: Access Control Lists
- Object-centered: associate each object with a list
- Reference monitor checks subject against list of objects they want to access
- Relies on authentication: need to know user

Q: Describe Capabilities.
A: Capabilities
- Subject-centered: Capability is unforgeable ticket (token) that defines the privileges of its holder
  - Usually implemented via random strings (cryptographically protected, e.g., via HMAC) or controlled by the operating system
  - Can be passed from one subject to another
- Reference monitor checks only the validity of the token (No need to identify the subject)

Q: Describe how Delegation and Revocation work in ACL.
A: Delegation
- Ask the owner/admin to grant privileges to objects to the desired subject
- In OS: let the specific processes run by one user act with the priviliges of another user
Revocation
- Modify the access rights stored in the ACLs associated to the resources to which access has to be revoked

Q: Describe how Delegation and Revocation work in Capabilities.
A: Delegation
- Capability can be passed to the desired subject at runtime
Revocation (Only possible in systems with appropriate bookkeeping)
- Reference monitor needs to track all revoked capabilities (until they expire)
- If capability is used for multiple resources, have to revoke all or none

Q: Describe Mandatory Access Control (MAC).
A: Mandatory Access Control (MAC)
- Security policy set and modified centrally by trusted administrator
- Subjects acannot override the policy (e.g., delegate rights if not allowed by policy)

Q: Describe Discretionary Access Control (DAC).
A: Discretionary Access Control (DAC)
Subjects can freely delegate / revoke / modify access rights to objects for which they have certain access rights:
- Objects they own
- Objects for which they have a capability

Q: Describe Role-Based Access Control.
A: Role-Based Access Control
Mostly for systems with a large number of users.
- Define roles (=sets of subjects with similar access rights)
- Assign permissions to roles
- Assign roles to subjects

Q: How can Roles be organized?
A: Roles might be organized in a hierarchy.
- partial ordering is defined over roles
- each role gets all access rights of roles below
- only new access rights are assigned to a role

Q: Where is the Bell-LaPadula Model used and why?
A: The Bell-LaPadula Model is used in government and military applications to ensure data confidentiality.

Q: How doe sthe Bell-LaPadula Model work?
A: Subjects and objects are assigned a security level and a set of categories
- An order is defined over security levels
- A subject can read an object if
  - the object has the same or lower security level compared to the user (“no read up”)
  - the object’s categories are a subset of the categories for which the subject is cleared
- A subject can write an object if
  - the object has the same or higher security level compared to the user (“no write down”, prevents downgrade of information)
  - the object’s categories are a superset of the categories for which the subject is cleared

Q: What are conditional policies?
A: - Temporal policies: e.g. allow access between 10AM and 6PM
- Context-aware policies: allow acess if current location is office

Q: Describe the Biba Model.
A: Biba Model
Dual of Bell-LaPadula Model.
Preservation of data integrity:
- Subject cannot read an object of lower security level
- Subject cannot write an object of higher security level

Q: Describe Access Control for UNIX Files.
A: - Every file has an owner and a group
- File permissions are represented using three triads
  - First triad applies to the file owner
  - Second triad applies to useres belonging to the file group
  - Third triad applies to all the other users
- A triad specifies the access rights assigned to the corresponding subjects (read r, write w, execute x)
- Only the file owner and the superuser can change file permissions

Q: What does every file have regarding Access Controll on a UNIX System?
A: Every file has an owner and a group.

Q: How are file permissions represented on UNIX Systems?
A: File permissions are represented using three triads:
- First triad applies to the file owner
- Second triad applies to useres belonging to the file group
- Third triad applies to all the other users

Q: Who can change file permissions on a UNIX System?
A: Only the file owner and the superuser can change file permissions.

Q: What is the Superuser on UNIX Systems?
A: Superuser
- A special account with full privileges
- Typically called root (user identifier = 0, most systems disallow direct login as root)
- can perform any operation on the file system, irrespectively of permissions

Explain the symbolic permission notation on UNIX file systems.

Q: Explain the octal permission notation on UNIX file systems.
A: Each digit represents a permission triad, sum of the numbers represents allowed permissions:
- \(4 =\text{read}\)
- \(2 =\text{write}\)
- \(1 =\text{execute}\)

Q: What is the resolution order for permissions on UNIX file systems?
A: - If the user is the file owner, apply owner permissions
- Otherwise, if the user belongs to the file group, apply group permissions
- Otherwise, apply the permission for all the other users
If the user is the owner and belongs to the file group, owner permissions are used; even if they are more restrictive than the group permissions! However, the owner can change the permissions at their will

Q: -rwxr-x--- 1 mauro sp 43416 Sep 5 2019 foo
Which access rights has the user mauro on the file foo?
A: read, write, execute

Q: -rwxr-x--- 1 mauro sp 43416 Sep 5 2019 foo
Which access rights has a user belonging to the group sp (not mauro) on the file foo?
A: read, execute

Q: -rwxr-x--- 1 mauro sp 43416 Sep 5 2019 foo
Which access rights has a user who is neither mauro nor belongs to the group sp on the file foo?
A: No access rights

Q: Name the three user identifiers of processes in UNIX.
A: - Real user ID (RUID)
- Effective user ID (EUID)
- Saved user ID (SUID)

Q: Describe the Real user ID (RUID).
A: - determines the user who started the process
- initialized with the RUID of the parent process

Q: Describe the effective user ID (EUID).
A: - determines the permissions of the process (used for access control checks)
- initialized with the UID of the parent, unless the setuid bit is set on the executed porgram

Q: Describe the saved user ID (SUID).
A: - contains the previous EUID in case it is changed at runtime
- initialized with the SUID of the parent process

Q: What are setuid and setgid bits and what are they used for?
A: setuid and setgid bits can be used to implement delegation.
When the setuid bit is set on an executable file, the file will run with the privileges of the file's owner rather than the user who executes it.
Similar to setuid, when the setgid bit is set on an executable file, the file will run with the privileges of the file's group rather than the user's default group.

Q: How are setuid and setgid bits represented in the symbolic notation?
A: - File has setuid bit if the third element of the owner triad is s or S
- File has setgid bit if the third element of the group triad is s or S
s = bit is set + file is executable
S = bit is set, but file is not executable

Q: How can the user IDs be accessed or modified dynamically?
A: retrieve the current user ID:
- getuid (only RUID)
- geteuid (only EUID)
- getresuid (all thre IDS)
change user ID
- seteuid(newId) changes the effective user ID
- setuid(newId) similar to seteuid, but once root privilages are dropped, they can't be reqauired
and more...

Q: How can programs request OS operations?
A: Through system calls (syscalls)

Q: What are the components of an OS?
A: Components of an OS
- A kernel that manages memory access, performs access control and mediates storage access
- Userspace programs that provide the user interface to access the OS functionality (e.g. the shell)

Q: How does a Linux container differ from a regular process?
A: - separate namespace
- separate root directory (chroot)
- resource constrained (cgroups)
- filtered syscalls (seccomp)
- potentially subject to additional restrictions (capabilities, user namespaces, SELinux, …)

Q: What is a namespace?
A: A namespace creates a virtual environment for processes, making them
believe they have their own isolated version of a system resource. Any
changes made to this resource are visible to processes within the
namespace but hidden from processes outside of it.

Q: What is chroot?
A: - hroot changes the root directory of the calling process [...].
- This directory will be used for pathnames beginning with /
- The root directory is inherited by all children of the calling process
- Creates a chroot jail
- superuse can escape the chroot jail

Q: What are cgroups?
A: - Cgroups allocate CPU time, system memory, network bandwidth, or combinations of these among user-defined groups of tasks.
- Cgroups can be created by accessing the cgroup virtual filesystem (cgroupfs).
  - Or by using the utilities provided by libcgroup (cgcreate, cgexec, …).

Q: What is Seccomp?
A: Seccomp (short for secure computing) allows a process to make a one-way transition into a secure state where it cannot make any system call except those that are explicitly allowed.

Q: What is the difference between privileged and unprivliged processes in Linux?
A: Privileged processes bypass all kernel permission checks.

Q: Explain Virtualization.
A: Virtualization allows to run multiple unmodified guest OSs in isolation.
- Virtual machine monitors (or hypervisors) simulate or mediate hardware access transparently.
- In hardware-assisted virtualization, the hardware (e.g., the CPU via custom instructions) provides facilities to support the hypervisor (Example: Intel VT-X or AMD-V).

Q: Explain the privilege rings.
A: Ring 3: least privileged (userspace code)
Ring 2: mostly not used
Ring 1: mostly not used
Ring 0: most privileged, allows access to the physical hardware (e.g. CPU control)
Ring -1: for hypervisor to control Ring 0

Q: What is the difference between Type 1 Hypervisor and Type 2 Hypervisor?
A: Type 1
Also called bare-metal hypervisor, runs directly on the hardware and manages guest OS access
Type 2
Also called hosted hypervisor, runs as a regular process on the host