From Fedora Project Wiki

(Lower Process Capabilities)
Line 3: Line 3:
 
This section highlights various security items from Fedora.
 
This section highlights various security items from Fedora.
  
=== Fingerprint Readers ===
+
=== Lower Process Capabilities ===
  
Fingerprint readers are now better integrated with Fedora 11. GNOME users can easily setup fingerprint authentication using {{command|gnome-about-me}}, and will allow the ability to login from both {{package|gdm}} and {{package|gnome-screensaver}}.
+
Daemons running as root have been reviewed and patched to run with lower process capabilities. This reduces the desirability of using these daemons for privilege escalation. Additionally, the shadow file permissions have been changed to 000 and several directories in $PATH have been set to 555 in order to prevent daemons without DAC_OVERRIDE from being able to access the shadow file or write to the $PATH directories.  
  
=== System Security Services Daemon ===
+
When someone attacks a system, they normally can't do much unless they can escalate privileges. What this feature will do is reduce the number of attack targets that can be used to escalate privileges. If root processes do not have all capabilities, they will be harder to use to subvert the system.
  
The SSSD is intended to provide several key feature enhancements to Fedora. The first being the addition of offline caching for network credentials. Authentication through the SSSD will potentially allow LDAP, NIS, and FreeIPA services to provide an offline mode, to ease the use of centrally managing laptop users.  
+
But if some does successfully attack a root process, can steps be taken to render it hard to take advantage of? The answer is yes. Processes with the root uid can still damage a system. This is because they can write to nearly any file and of course read the /etc/shadow file. But if we harden the system so that root requires the DAC_OVERRIDE capability, then only a limited number of processes can damage the system. This won't affect any admin abilities because they always get full privileges which includes DAC_OVERRIDE.
  
The LDAP features will also add support for connection pooling. All communication to the LDAP server will happen over a single persistent connection, reducing the overhead of opening a new socket for each request. The SSSD will also add support for multiple LDAP/NIS domains. It will be possible to connect to two or more LDAP/NIS servers acting as separate user namespaces.
+
A hardened system would have permissions like: 555 /bin, 555 /lib, 000 /etc/shadow and so on. The current scope is to cover the directories in $PATH variable, library dirs, /boot, and /root. This scheme does not affect selinux in any way and complements it since capabilities are DAC controls and they have first vote on allowing an access.
 
 
=== SHA-2 support ===
 
 
 
Fedora now uses the SHA-256 digest algorithm for data verification and authentication in more places than before, migrating from the weaker SHA-1 and MD5 algorithms. Where possible, the migration was transparent; in other places the default configuration was changed or manual configuration is necessary to use the stronger algorithms.  See [[Hash_algorithm_migration_status#Configuration]] for application-specific instructions.
 

Revision as of 16:27, 5 September 2009

Security

This section highlights various security items from Fedora.

Lower Process Capabilities

Daemons running as root have been reviewed and patched to run with lower process capabilities. This reduces the desirability of using these daemons for privilege escalation. Additionally, the shadow file permissions have been changed to 000 and several directories in $PATH have been set to 555 in order to prevent daemons without DAC_OVERRIDE from being able to access the shadow file or write to the $PATH directories.

When someone attacks a system, they normally can't do much unless they can escalate privileges. What this feature will do is reduce the number of attack targets that can be used to escalate privileges. If root processes do not have all capabilities, they will be harder to use to subvert the system.

But if some does successfully attack a root process, can steps be taken to render it hard to take advantage of? The answer is yes. Processes with the root uid can still damage a system. This is because they can write to nearly any file and of course read the /etc/shadow file. But if we harden the system so that root requires the DAC_OVERRIDE capability, then only a limited number of processes can damage the system. This won't affect any admin abilities because they always get full privileges which includes DAC_OVERRIDE.

A hardened system would have permissions like: 555 /bin, 555 /lib, 000 /etc/shadow and so on. The current scope is to cover the directories in $PATH variable, library dirs, /boot, and /root. This scheme does not affect selinux in any way and complements it since capabilities are DAC controls and they have first vote on allowing an access.