Security Features Matrix

From FedoraProject

(Difference between revisions)
Jump to: navigation, search
(Updated LVM and eCryptfs)
m (RHEL is back)
 
(24 intermediate revisions by 8 users not shown)
Line 14: Line 14:
  
 
{| class="wikitable"
 
{| class="wikitable"
| Security Features  || RHEL 3              || RHEL 4              || RHEL 5              || RHEL 6              || Fedora 19           || Fedora 20           || Rawhide             
+
| Security Features  || RHEL 3              || RHEL 4              || RHEL 5              || RHEL 6               || RHEL 7               || Fedora 24           || Fedora 25           || Rawhide             
 
|-
 
|-
| [[#Configurable Firewall|Configurable Firewall]]    || style="background:#00dd00" | iptables            || style="background:#00dd00" | iptables            || style="background:#00dd00" | iptables            || style="background:#00dd00" | iptables            || style="background:#00dd00" | firewalld          || style="background:#00dd00" | firewalld          || style="background:#00dd00" | firewalld           
+
| [[#Configurable Firewall|Configurable Firewall]]    || style="background:#00dd00" | iptables            || style="background:#00dd00" | iptables            || style="background:#00dd00" | iptables            || style="background:#00dd00" | iptables            || style="background:#00dd00" | iptables            || style="background:#00dd00" | firewalld          || style="background:#00dd00" | firewalld          || style="background:#00dd00" | firewalld           
 
|-
 
|-
| [[#Signed updates|      Signed updates]]    || style="background:#00dd00" | yum                || style="background:#00dd00" | yum                || style="background:#00dd00" | yum                || style="background:#00dd00" | yum                || style="background:#00dd00" | yum / dnf          || style="background:#00dd00" | yum / dnf          || style="background:#00dd00" | yum / dnf           
+
| [[#Signed updates|      Signed updates]]    || style="background:#00dd00" | yum                || style="background:#00dd00" | yum                || style="background:#00dd00" | yum                || style="background:#00dd00" | yum                || style="background:#00dd00" | yum                || style="background:#00dd00" | yum / dnf          || style="background:#00dd00" | yum / dnf          || style="background:#00dd00" | yum / dnf           
 
|-
 
|-
| [[#SELinux|            SELinux]]    || style="background:#ffff00" | N                  || style="background:#00dd00" | Y                  || style="background:#00dd00" | Y                  || style="background:#00dd00" | Y                  || style="background:#00dd00" | Y                  || style="background:#00dd00" | Y                  || style="background:#00dd00" | Y                   
+
| [[#SELinux|            SELinux]]    || style="background:#ffff00" | N                   || style="background:#00dd00" | Y                   || style="background:#00dd00" | Y                  || style="background:#00dd00" | Y                  || style="background:#00dd00" | Y                  || style="background:#00dd00" | Y                  || style="background:#00dd00" | Y                  || style="background:#00dd00" | Y                   
 
|-
 
|-
| [[#SELinux targeted policy|SELinux targeted policy]]    || style="background:#ffff00" | N                  || style="background:#00dd00" | Y                  || style="background:#00dd00" | Y                  || style="background:#00dd00" | Y                  || style="background:#00dd00" | Y                  || style="background:#00dd00" | Y                  || style="background:#00dd00" | Y                   
+
| [[#SELinux targeted policy|SELinux targeted policy]]    || style="background:#ffff00" | N                   || style="background:#00dd00" | Y                   || style="background:#00dd00" | Y                  || style="background:#00dd00" | Y                  || style="background:#00dd00" | Y                  || style="background:#00dd00" | Y                  || style="background:#00dd00" | Y                  || style="background:#00dd00" | Y                   
 
|-
 
|-
| [[#SELinux Executable Memory Protection|SELinux Executable Memory Protection]]    || style="background:#ffff00" | N                  || style="background:#ffff00" | N                  || style="background:#00dd00" | Y                  || style="background:#00dd00" | Y                  || style="background:#00dd00" | Y                  || style="background:#00dd00" | Y                  || style="background:#00dd00" | Y                   
+
| [[#SELinux Executable Memory Protection|SELinux Executable Memory Protection]]    || style="background:#ffff00" | N                  || style="background:#ffff00" | N                   || style="background:#00dd00" | Y                   || style="background:#00dd00" | Y                  || style="background:#00dd00" | Y                  || style="background:#00dd00" | Y                  || style="background:#00dd00" | Y                  || style="background:#00dd00" | Y                   
 
|-
 
|-
| [[#Password hashing|    Password hashing]]    || style="background:#00dd00" | md5crypt            || style="background:#00dd00" | md5crypt            || style="background:#00dd00" | md5crypt            || style="background:#00dd00" | sha512crypt        || style="background:#00dd00" | sha512crypt        || style="background:#00dd00" | sha512crypt        || style="background:#00dd00" | sha512crypt         
+
| [[#Password hashing|    Password hashing]]    || style="background:#00dd00" | md5crypt            || style="background:#00dd00" | md5crypt            || style="background:#00dd00" | md5crypt            || style="background:#00dd00" | sha512crypt        || style="background:#00dd00" | sha512crypt        || style="background:#00dd00" | sha512crypt        || style="background:#00dd00" | sha512crypt        || style="background:#00dd00" | sha512crypt         
 
|-
 
|-
| [[#Filesystem Capabilities|Filesystem Capabilities]]    || style="background:#ffff00" | --                  || style="background:#98fd98" | kernel              || style="background:#98fd98" | kernel              || style="background:#98fd98" | kernel              || style="background:#98fd98" | kernel              || style="background:#98fd98" | kernel              || style="background:#98fd98" | kernel               
+
| [[#Filesystem Capabilities|Filesystem Capabilities]]    || style="background:#ffff00" | --                  || style="background:#98fd98" | kernel              || style="background:#98fd98" | kernel              || style="background:#98fd98" | kernel              || style="background:#98fd98" | kernel              || style="background:#98fd98" | kernel              || style="background:#98fd98" | kernel              || style="background:#98fd98" | kernel               
 
|-
 
|-
| [[#SELinux user confinement|SELinux user confinement]]    || style="background:#ffff00" | N                  || style="background:#ffff00" | N                  || style="background:#98fd98" | Y                  || style="background:#00dd00" | Y                  || style="background:#00dd00" | Y                  || style="background:#00dd00" | Y                  || style="background:#00dd00" | Y                 
+
| [[#PR_SET_SECCOMP|     PR_SET_SECCOMP]]    || style="background:#ffff00" | --                  || style="background:#ffff00" | --                  || style="background:#ffff00" | --                  || style="background:#ffff00" | --                  || style="background:#98fd98" | kernel              || style="background:#98fd98" | kernel              || style="background:#98fd98" | kernel              || style="background:#98fd98" | kernel             
 
|-
 
|-
| [[#SELinux XACE|       SELinux XACE]]    || style="background:#ffff00" | N                  || style="background:#ffff00" | N                  || style="background:#ffff00" | N                   || style="background:#98fd98" | Y                  || style="background:#98fd98" | Y                  || style="background:#98fd98" | Y                  || style="background:#98fd98" | Y                   
+
| [[#SELinux user confinement|SELinux user confinement]]    || style="background:#ffff00" | N                  || style="background:#ffff00" | N                  || style="background:#98fd98" | Y                   || style="background:#00dd00" | Y                  || style="background:#00dd00" | Y                  || style="background:#00dd00" | Y                  || style="background:#00dd00" | Y                  || style="background:#00dd00" | Y                   
 
|-
 
|-
| [[#SELinux sandbox|     SELinux sandbox]]    || style="background:#ffff00" | N                  || style="background:#ffff00" | N                  || style="background:#ffff00" | N                  || style="background:#00dd00" | Y                  || style="background:#00dd00" | Y                  || style="background:#00dd00" | Y                  || style="background:#00dd00" | Y                   
+
| [[#SELinux XACE|       SELinux XACE]]    || style="background:#ffff00" | N                  || style="background:#ffff00" | N                  || style="background:#ffff00" | N                  || style="background:#98fd98" | Y                  || style="background:#98fd98" | Y                  || style="background:#98fd98" | Y                  || style="background:#98fd98" | Y                  || style="background:#98fd98" | Y                   
 
|-
 
|-
| [[#PR_SET_SECCOMP|     PR_SET_SECCOMP]]    || style="background:#ffff00" | --                  || style="background:#ffff00" | --                  || style="background:#ffff00" | --                  || style="background:#ffff00" | --                  || style="background:#98fd98" | kernel              || style="background:#98fd98" | kernel              || style="background:#98fd98" | kernel             
+
| [[#SELinux sandbox|     SELinux sandbox]]    || style="background:#ffff00" | N                  || style="background:#ffff00" | N                  || style="background:#ffff00" | N                  || style="background:#00dd00" | Y                  || style="background:#00dd00" | Y                  || style="background:#00dd00" | Y                  || style="background:#00dd00" | Y                  || style="background:#00dd00" | Y                 
 
|-
 
|-
| [[#SELinux Deny Ptrace| SELinux Deny Ptrace]]    || style="background:#ffff00" | N                  || style="background:#ffff00" | N                  || style="background:#ffff00" | N                  || style="background:#ffff00" | N                  || style="background:#00dd00" | kernel & sysctl    || style="background:#00dd00" | kernel & sysctl    || style="background:#00dd00" | kernel & sysctl   
+
| [[#SELinux Deny Ptrace| SELinux Deny Ptrace]]    || style="background:#ffff00" | N                  || style="background:#ffff00" | N                  || style="background:#ffff00" | N                  || style="background:#ffff00" | N                  || style="background:#98fd98" | Y                  || style="background:#98fd98" | Y                  || style="background:#98fd98" | Y                  || style="background:#98fd98" | Y                 
 
|-
 
|-
| [[#SELinux restricted module loading|SELinux restricted module loading]]    || style="background:#ffff00" | N                  || style="background:#ffff00" | N                  || style="background:#ffff00" | ?                  || style="background:#ffff00" | ?                  || style="background:#98fd98" | Y                  || style="background:#98fd98" | Y                  || style="background:#98fd98" | Y                   
+
| [[#SELinux restricted module loading|SELinux restricted module loading]]    || style="background:#ffff00" | N                  || style="background:#ffff00" | N                  || style="background:#ffff00" | ?                  || style="background:#ffff00" | ?                   || style="background:#98fd98" | Y                   || style="background:#98fd98" | Y                  || style="background:#98fd98" | Y                  || style="background:#98fd98" | Y                   
 
|-
 
|-
| [[#User namespaces|    User namespaces]]    || style="background:#ffff00" | N                  || style="background:#ffff00" | N                  || style="background:#ffff00" | N                  || style="background:#ffff00" | N                  || style="background:#ffff00" | N                  || style="background:#ffff00" | N                  || style="background:#ffff00" | Y                    
+
| [[#User namespaces|    User namespaces]]    || style="background:#ffff00" | N                  || style="background:#ffff00" | N                  || style="background:#ffff00" | N                  || style="background:#ffff00" | N                  || style="background:#ffff00" | N                  || style="background:#ffff00" | N                  || style="background:#ffff00" | N                  || style="background:#ffff00" | N                    
 
|-
 
|-
| [[#/tmp namespace for systemd|/tmp namespace for systemd]]    || style="background:#ffff00" | N                  || style="background:#ffff00" | N                  || style="background:#ffff00" | N                  || style="background:#ffff00" | N                  || style="background:#98fd98" | Y                  || style="background:#98fd98" | Y                  || style="background:#98fd98" | Y                   
+
| [[#/tmp namespace for systemd|/tmp namespace for systemd]]    || style="background:#ffff00" | N                  || style="background:#ffff00" | N                  || style="background:#ffff00" | N                  || style="background:#ffff00" | N                   || style="background:#98fd98" | Y                   || style="background:#98fd98" | Y                  || style="background:#98fd98" | Y                  || style="background:#98fd98" | Y                   
 
|-
 
|-
| [[#per-user temp folder|per-user temp folder]]    || style="background:#ffff00" | --                  || style="background:#ffff00" | --                  || style="background:#ffff00" | --                  || style="background:#ffff00" | --                  || style="background:#ffff00" | --                  || style="background:#ffff00" | --                  || style="background:#ffff00" | --                 
+
| [[#Polyinstantiate /tmp, /var/tmp and user home folders|Polyinstantiate /tmp, /var/tmp and user home folders]]    || style="background:#ffff00" | N                  || style="background:#ffff00" | N                  || style="background:#ffff00" | N                  || style="background:#98fd98" | Y                  || style="background:#98fd98" | Y                  || style="background:#98fd98" | Y                  || style="background:#98fd98" | Y                  || style="background:#98fd98" | Y                 
 
|-
 
|-
| [[#Encrypted LVM|      Encrypted LVM]]    || style="background:#ffff00" | ?                  || style="background:#ffff00" | ?                  || style="background:#98fd98" | Y                  || style="background:#98fd98" | Standard Installer  || style="background:#98fd98" | Standard Installer  || style="background:#98fd98" | Standard Installer  || style="background:#98fd98" | Standard Installer   
+
| [[#Encrypted LVM|      Encrypted LVM]]    || style="background:#ffff00" | ?                  || style="background:#ffff00" | ?                  || style="background:#98fd98" | Y                  || style="background:#98fd98" | Standard Installer  || style="background:#98fd98" | Standard Installer  || style="background:#98fd98" | Standard Installer  || style="background:#98fd98" | Standard Installer  || style="background:#98fd98" | Standard Installer   
 
|-
 
|-
| [[#eCryptfs|            eCryptfs]]    || style="background:#ffff00" | N                  || style="background:#ffff00" | N                  || style="background:#98fd98" | Y                  || style="background:#98fd98" | Y                  || style="background:#98fd98" | Optional Package    || style="background:#98fd98" | Optional Package    || style="background:#98fd98" | Optional Package     
+
| [[#eCryptfs|            eCryptfs]]    || style="background:#ffff00" | N                  || style="background:#ffff00" | N                   || style="background:#98fd98" | Y                   || style="background:#98fd98" | Y                  || style="background:#98fd98" | Y                  || style="background:#98fd98" | Optional Package    || style="background:#98fd98" | Optional Package    || style="background:#98fd98" | Optional Package     
 
|-
 
|-
| [[#Non-Executable Memory (NX)|Non-Executable Memory (NX)]]    || style="background:#00dd00" | Y (since 9/2004)    || style="background:#00dd00" | Y                  || style="background:#00dd00" | Y                  || style="background:#00dd00" | Y                  || style="background:#00dd00" | Y                  || style="background:#00dd00" | Y                  || style="background:#00dd00" | Y                   
+
| [[#Non-Executable Memory (NX)|Non-Executable Memory (NX)]]    || style="background:#00dd00" | Y (since 9/2004)    || style="background:#00dd00" | Y                  || style="background:#00dd00" | Y                  || style="background:#00dd00" | Y                  || style="background:#00dd00" | Y                  || style="background:#00dd00" | Y                  || style="background:#00dd00" | Y                  || style="background:#00dd00" | Y                   
 
|-
 
|-
| [[#Built as PIE|        Built as PIE]]    || style="background:#00dd00" | package list (since 9/2004)|| style="background:#00dd00" | package list        || style="background:#00dd00" | package list        || style="background:#00dd00" | package list        || style="background:#00dd00" | package list        || style="background:#00dd00" | package list        || style="background:#00dd00" | package list       
+
| [[#Built as PIE|        Built as PIE]]    || style="background:#00dd00" | package list (since 9/2004)|| style="background:#00dd00" | package list        || style="background:#00dd00" | package list        || style="background:#00dd00" | package list        || style="background:#00dd00" | package list        || style="background:#00dd00" | Y                  || style="background:#00dd00" | Y                  || style="background:#00dd00" | Y                 
 
|-
 
|-
| [[#Pointer Obfuscation| Pointer Obfuscation]]    || style="background:#ffff00" | N                  || style="background:#ffff00" | N                  || style="background:#00dd00" | Y                  || style="background:#00dd00" | Y                  || style="background:#00dd00" | glibc              || style="background:#00dd00" | glibc              || style="background:#00dd00" | glibc               
+
| [[#Pointer Obfuscation| Pointer Obfuscation]]    || style="background:#ffff00" | N                  || style="background:#ffff00" | N                   || style="background:#00dd00" | Y                   || style="background:#00dd00" | Y                  || style="background:#00dd00" | Y                  || style="background:#00dd00" | glibc              || style="background:#00dd00" | glibc              || style="background:#00dd00" | glibc               
 
|-
 
|-
| [[#Heap Protector|      Heap Protector]]    || style="background:#ffff00" | N                  || style="background:#00dd00" | glibc              || style="background:#00dd00" | glibc              || style="background:#00dd00" | glibc              || style="background:#00dd00" | glibc              || style="background:#00dd00" | glibc              || style="background:#00dd00" | glibc               
+
| [[#Heap Protector|      Heap Protector]]    || style="background:#ffff00" | N                  || style="background:#00dd00" | glibc              || style="background:#00dd00" | glibc              || style="background:#00dd00" | glibc              || style="background:#00dd00" | glibc              || style="background:#00dd00" | glibc              || style="background:#00dd00" | glibc              || style="background:#00dd00" | glibc               
 
|-
 
|-
| [[#Built with Fortify Source|Built with Fortify Source]]    || style="background:#ffff00" | N                  || style="background:#98fd98" | Y                  || style="background:#00dd00" | Y                  || style="background:#00dd00" | Y                  || style="background:#00dd00" | Y                  || style="background:#00dd00" | Y                  || style="background:#00dd00" | Y                   
+
| [[#Built with Fortify Source|Built with Fortify Source]]    || style="background:#ffff00" | N                  || style="background:#98fd98" | Y                  || style="background:#00dd00" | Y                  || style="background:#00dd00" | Y                  || style="background:#00dd00" | Y                  || style="background:#00dd00" | Y                  || style="background:#00dd00" | Y                  || style="background:#00dd00" | Y                   
 
|-
 
|-
| [[#Stack Protector|    Stack Protector]]    || style="background:#ffff00" | N                  || style="background:#ffff00" | N                  || style="background:#00dd00" | Y                  || style="background:#00dd00" | Y                  || style="background:#00dd00" | Y                  || style="background:#00dd00" | Y                  || style="background:#00dd00" | Y                   
+
| [[#Stack Protector|    Stack Protector]]    || style="background:#ffff00" | N                  || style="background:#ffff00" | N                   || style="background:#00dd00" | Y                   || style="background:#00dd00" | Y                  || style="background:#00dd00" | Y                  || style="background:#00dd00" | Y                  || style="background:#00dd00" | Y                  || style="background:#00dd00" | Y                   
 
|-
 
|-
| [[#Stack ASLR|          Stack ASLR]]    || style="background:#00dd00" | Y (since 9/2004)    || style="background:#00dd00" | kernel              || style="background:#00dd00" | kernel              || style="background:#00dd00" | kernel              || style="background:#00dd00" | kernel              || style="background:#00dd00" | kernel              || style="background:#00dd00" | kernel               
+
| [[#Stack ASLR|          Stack ASLR]]    || style="background:#00dd00" | Y (since 9/2004)    || style="background:#00dd00" | kernel              || style="background:#00dd00" | kernel              || style="background:#00dd00" | kernel              || style="background:#00dd00" | kernel              || style="background:#00dd00" | kernel              || style="background:#00dd00" | kernel              || style="background:#00dd00" | kernel               
 
|-
 
|-
| [[#Libs/mmap ASLR|      Libs/mmap ASLR]]    || style="background:#00dd00" | kernel (since 9/2004)|| style="background:#00dd00" | kernel              || style="background:#00dd00" | kernel              || style="background:#00dd00" | kernel              || style="background:#00dd00" | kernel              || style="background:#00dd00" | kernel              || style="background:#00dd00" | kernel               
+
| [[#Libs/mmap ASLR|      Libs/mmap ASLR]]    || style="background:#00dd00" | kernel (since 9/2004)|| style="background:#00dd00" | kernel              || style="background:#00dd00" | kernel              || style="background:#00dd00" | kernel              || style="background:#00dd00" | kernel              || style="background:#00dd00" | kernel              || style="background:#00dd00" | kernel              || style="background:#00dd00" | kernel               
 
|-
 
|-
| [[#Exec ASLR|          Exec ASLR]]    || style="background:#00dd00" | (since 9/2004)      || style="background:#00dd00" | Y                  || style="background:#00dd00" | y                  || style="background:#00dd00" | Y                  || style="background:#00dd00" | Y                  || style="background:#00dd00" | Y                  || style="background:#00dd00" | Y                   
+
| [[#Exec ASLR|          Exec ASLR]]    || style="background:#00dd00" | (since 9/2004)      || style="background:#00dd00" | Y                  || style="background:#00dd00" | y                   || style="background:#00dd00" | Y                   || style="background:#00dd00" | Y                  || style="background:#00dd00" | Y                  || style="background:#00dd00" | Y                  || style="background:#00dd00" | Y                   
 
|-
 
|-
| [[#brk ASLR|            brk ASLR]]    || style="background:#ffff00" | N                  || style="background:#ffff00" | N                  || style="background:#ffff00" | ?                  || style="background:#00dd00" | Y                  || style="background:#00dd00" | Y                  || style="background:#00dd00" | Y                  || style="background:#00dd00" | Y                   
+
| [[#brk ASLR|            brk ASLR]]    || style="background:#ffff00" | N                  || style="background:#ffff00" | N                  || style="background:#ffff00" | ?                   || style="background:#00dd00" | Y                   || style="background:#00dd00" | Y                  || style="background:#00dd00" | Y                  || style="background:#00dd00" | Y                  || style="background:#00dd00" | Y                   
 
|-
 
|-
| [[#VDSO ASLR|          VDSO ASLR]]    || style="background:#00dd00" | no vDSO            || style="background:#00dd00" | kernel              || style="background:#00dd00" | kernel              || style="background:#00dd00" | kernel              || style="background:#00dd00" | kernel              || style="background:#00dd00" | kernel              || style="background:#00dd00" | kernel               
+
| [[#VDSO ASLR|          VDSO ASLR]]    || style="background:#00dd00" | no vDSO            || style="background:#00dd00" | kernel              || style="background:#00dd00" | kernel              || style="background:#00dd00" | kernel              || style="background:#00dd00" | kernel              || style="background:#00dd00" | kernel              || style="background:#00dd00" | kernel              || style="background:#00dd00" | kernel               
 
|-
 
|-
| [[#Built with RELRO|    Built with RELRO]]    || style="background:#ffff00" | --                  || style="background:#ffff00" | --                  || style="background:#ffff00" | --                  || style="background:#ffff00" | --                  || style="background:#00dd00" | gcc patch          || style="background:#00dd00" | gcc patch          || style="background:#00dd00" | gcc patch         
+
| [[#Built with RELRO|    Built with RELRO]]    || style="background:#ffff00" | --                  || style="background:#ffff00" | --                  || style="background:#ffff00" | --                  || style="background:#ffff00" | --                  || style="background:#00dd00" | gcc patch          || style="background:#00dd00" | Y                  || style="background:#00dd00" | Y                  || style="background:#00dd00" | Y                 
 
|-
 
|-
| [[#Built with BIND_NOW| Built with BIND_NOW]]    || style="background:#ffff00" | N                  || style="background:#98fd98" | ?                  || style="background:#00dd00" | package list        || style="background:#00dd00" | package list        || style="background:#00dd00" | package list        || style="background:#00dd00" | package list        || style="background:#00dd00" | package list       
+
| [[#Built with BIND_NOW| Built with BIND_NOW]]    || style="background:#ffff00" | N                  || style="background:#98fd98" | ?                  || style="background:#00dd00" | package list        || style="background:#00dd00" | package list        || style="background:#00dd00" | package list        || style="background:#00dd00" | Y                  || style="background:#00dd00" | Y                  || style="background:#00dd00" | Y                 
 
|-
 
|-
| [[#/proc/$pid/maps protection|/proc/$pid/maps protection]]    || style="background:#ffff00" | --                  || style="background:#ffff00" | --                  || style="background:#ffff00" | --                  || style="background:#ffff00" | --                  || style="background:#00dd00" | kernel             || style="background:#00dd00" | kernel             || style="background:#00dd00" | kernel            
+
| [[#/proc/$pid/maps protection|/proc/$pid/maps protection]]    || style="background:#ffff00" | --                  || style="background:#ffff00" | --                  || style="background:#ffff00" | --                  || style="background:#ffff00" | --                  || style="background:#00dd00" | kernel & sysctl    || style="background:#00dd00" | kernel & sysctl    || style="background:#00dd00" | kernel & sysctl    || style="background:#00dd00" | kernel & sysctl   
 
|-
 
|-
| [[#Symlink restrictions|Symlink restrictions]]    || style="background:#ffff00" | N                  || style="background:#ffff00" | N                  || style="background:#ffff00" | N                  || style="background:#ffff00" | N                  || style="background:#98fd98" | kernel              || style="background:#98fd98" | kernel              || style="background:#98fd98" | kernel               
+
| [[#Symlink restrictions|Symlink restrictions]]    || style="background:#ffff00" | N                  || style="background:#ffff00" | N                  || style="background:#ffff00" | N                  || style="background:#ffff00" | N                   || style="background:#98fd98" | Y                   || style="background:#98fd98" | kernel              || style="background:#98fd98" | kernel              || style="background:#98fd98" | kernel               
 
|-
 
|-
| [[#Hardlink restrictions|Hardlink restrictions]]    || style="background:#ffff00" | N                  || style="background:#ffff00" | N                  || style="background:#ffff00" | N                  || style="background:#ffff00" | N                  || style="background:#98fd98" | kernel              || style="background:#98fd98" | kernel              || style="background:#98fd98" | kernel               
+
| [[#Hardlink restrictions|Hardlink restrictions]]    || style="background:#ffff00" | N                  || style="background:#ffff00" | N                  || style="background:#ffff00" | N                  || style="background:#ffff00" | N                   || style="background:#98fd98" | Y                   || style="background:#98fd98" | kernel              || style="background:#98fd98" | kernel              || style="background:#98fd98" | kernel               
 
|-
 
|-
| [[#ptrace scope|        ptrace scope]]    || style="background:#ffff00" | --                  || style="background:#ffff00" | --                  || style="background:#ffff00" | --                  || style="background:#ffff00" | --                  || style="background:#00dd00" | kernel              || style="background:#00dd00" | kernel              || style="background:#00dd00" | kernel             
+
| [[#ptrace scope|        ptrace scope]]    || style="background:#ffff00" | N                  || style="background:#ffff00" | N                  || style="background:#ffff00" | N                  || style="background:#ffff00" | N                  || style="background:#ffff00" | N                  || style="background:#ffff00" | N                  || style="background:#ffff00" | N                  || style="background:#ffff00" | N                 
 
|-
 
|-
| [[#0-address protection|0-address protection]]    || style="background:#00dd00" | Y (since 11/2009)  || style="background:#00dd00" | Y (since 9/2009)    || style="background:#00dd00" | Y (since 5/2008)    || style="background:#00dd00" | Y                  || style="background:#00dd00" | Y                  || style="background:#00dd00" | Y                  || style="background:#00dd00" | Y                   
+
| [[#Overflow checking in new operator|Overflow checking in new operator]]    || style="background:#ffff00" | N                  || style="background:#ffff00" | N                  || style="background:#ffff00" | N                  || style="background:#ffff00" | N                  || style="background:#98fd98" | Y                  || style="background:#98fd98" | Y                  || style="background:#98fd98" | Y                  || style="background:#98fd98" | Y                   
 
|-
 
|-
| [[#Block module loading|Block module loading]]    || style="background:#00dd00" | Y                  || style="background:#00dd00" | Y                  || style="background:#00dd00" | Y                  || style="background:#00dd00" | Y                  || style="background:#00dd00" | Y                  || style="background:#00dd00" | Y                  || style="background:#00dd00" | Y                   
+
| [[#Built with Format Security|Built with Format Security]]    || style="background:#ffff00" | --                  || style="background:#ffff00" | --                  || style="background:#ffff00" | --                  || style="background:#ffff00" | --                  || style="background:#ffff00" | --                  || style="background:#00dd00" | Y                  || style="background:#00dd00" | Y                  || style="background:#00dd00" | Y                   
 
|-
 
|-
| [[#/dev/mem protection| /dev/mem protection]]    || style="background:#ffff00" | N                  || style="background:#00dd00" | Y                  || style="background:#00dd00" | Y                  || style="background:#00dd00" | Y                  || style="background:#00dd00" | Y                  || style="background:#00dd00" | Y                  || style="background:#00dd00" | Y                   
+
| [[#Crypto Policy|       Crypto Policy]]    || style="background:#ffff00" | --                  || style="background:#ffff00" | --                  || style="background:#ffff00" | --                  || style="background:#ffff00" | --                  || style="background:#ffff00" | --                  || style="background:#00dd00" | Y                  || style="background:#00dd00" | Y                  || style="background:#00dd00" | Y                   
 
|-
 
|-
| [[#/dev/kmem disabled| /dev/kmem disabled]]    || style="background:#ffff00" | N                  || style="background:#00dd00" | Y                  || style="background:#00dd00" | Y                  || style="background:#00dd00" | Y                  || style="background:#00dd00" | Y                  || style="background:#00dd00" | Y                  || style="background:#00dd00" | Y                   
+
| [[#Built with Stack Protector Strong|Built with Stack Protector Strong]]    || style="background:#ffff00" | --                  || style="background:#ffff00" | --                  || style="background:#ffff00" | --                  || style="background:#ffff00" | --                  || style="background:#ffff00" | --                  || style="background:#00dd00" | Y                  || style="background:#00dd00" | Y                  || style="background:#00dd00" | Y                   
 
|-
 
|-
| [[#Module RO/NX|       Module RO/NX]]    || style="background:#ffff00" | --                  || style="background:#ffff00" | --                  || style="background:#ffff00" | --                  || style="background:#ffff00" | --                  || style="background:#00dd00" | kernel              || style="background:#00dd00" | kernel              || style="background:#00dd00" | kernel             
+
| [[#Tamper Resistant Logs|Tamper Resistant Logs]]    || style="background:#ffff00" | N                  || style="background:#ffff00" | N                  || style="background:#ffff00" | N                  || style="background:#ffff00" | N                  || style="background:#98fd98" | Y                  || style="background:#98fd98" | Y                  || style="background:#98fd98" | Y                  || style="background:#98fd98" | Y                 
 
|-
 
|-
| [[#Kernel Address Display Restriction|Kernel Address Display Restriction]]    || style="background:#ffff00" | --                  || style="background:#ffff00" | --                  || style="background:#ffff00" | --                  || style="background:#ffff00" | --                  || style="background:#00dd00" | kernel              || style="background:#00dd00" | kernel              || style="background:#00dd00" | kernel             
+
| [[#0-address protection|0-address protection]]    || style="background:#00dd00" | Y (since 11/2009)  || style="background:#00dd00" | Y (since 9/2009)    || style="background:#00dd00" | Y (since 5/2008)    || style="background:#00dd00" | Y                  || style="background:#00dd00" | Y                  || style="background:#00dd00" | Y                  || style="background:#00dd00" | Y                  || style="background:#00dd00" | Y                 
 
|-
 
|-
| [[#Blacklist Rare Protocols|Blacklist Rare Protocols]]    || style="background:#98fd98" | Y                  || style="background:#98fd98" | Y                  || style="background:#98fd98" | Y                  || style="background:#98fd98" | Y                  || style="background:#98fd98" | Y                  || style="background:#98fd98" | Y                  || style="background:#98fd98" | Y                   
+
| [[#Block module loading|Block module loading]]    || style="background:#00dd00" | Y                  || style="background:#00dd00" | Y                  || style="background:#00dd00" | Y                  || style="background:#00dd00" | Y                  || style="background:#00dd00" | Y                  || style="background:#00dd00" | Y                  || style="background:#00dd00" | Y                  || style="background:#00dd00" | Y                   
 
|-
 
|-
| [[#Write-protect kernel .rodata sections|Write-protect kernel .rodata sections]]    || style="background:#ffff00" | N                  || style="background:#ffff00" | N                   || style="background:#ffff00" | N                   || style="background:#00dd00" | Y                  || style="background:#00dd00" | Y                  || style="background:#00dd00" | Y                  || style="background:#00dd00" | Y                   
+
| [[#/dev/mem protection| /dev/mem protection]]    || style="background:#ffff00" | N                  || style="background:#00dd00" | Y                   || style="background:#00dd00" | Y                  || style="background:#00dd00" | Y                   || style="background:#00dd00" | Y                  || style="background:#00dd00" | Y                  || style="background:#00dd00" | Y                  || style="background:#00dd00" | Y                   
 
|-
 
|-
| [[#Kernel Stack Protector|Kernel Stack Protector]]    || style="background:#ffff00" | N                  || style="background:#ffff00" | N                   || style="background:#ffff00" | N                   || style="background:#00dd00" | Y                  || style="background:#00dd00" | Y                  || style="background:#00dd00" | Y                  || style="background:#00dd00" | Y                   
+
| [[#/dev/kmem disabled| /dev/kmem disabled]]    || style="background:#ffff00" | N                  || style="background:#00dd00" | Y                   || style="background:#00dd00" | Y                  || style="background:#00dd00" | Y                   || style="background:#00dd00" | Y                  || style="background:#00dd00" | Y                  || style="background:#00dd00" | Y                  || style="background:#00dd00" | Y                   
 
|-
 
|-
| [[#sVirt labelling|     sVirt labelling]]    || style="background:#ffff00" | N                  || style="background:#ffff00" | N                  || style="background:#ffff00" | N                  || style="background:#00dd00" | Y                  || style="background:#00dd00" | Y                  || style="background:#00dd00" | Y                  || style="background:#00dd00" | Y                 
+
| [[#Module RO/NX|       Module RO/NX]]    || style="background:#ffff00" | --                  || style="background:#ffff00" | --                  || style="background:#ffff00" | --                  || style="background:#ffff00" | --                  || style="background:#00dd00" | kernel              || style="background:#00dd00" | kernel              || style="background:#00dd00" | kernel              || style="background:#00dd00" | kernel             
 
|-
 
|-
| [[#SYN cookies|         SYN cookies]]    || style="background:#98fd98" | ?                  || style="background:#98fd98" | kernel              || style="background:#00dd00" | kernel              || style="background:#00dd00" | kernel              || style="background:#00dd00" | kernel              || style="background:#00dd00" | kernel              || style="background:#00dd00" | kernel               
+
| [[#Kernel Address Display Restriction|Kernel Address Display Restriction]]    || style="background:#ffff00" | --                  || style="background:#ffff00" | --                  || style="background:#ffff00" | --                  || style="background:#ffff00" | --                  || style="background:#00dd00" | kernel              || style="background:#00dd00" | kernel              || style="background:#00dd00" | kernel              || style="background:#00dd00" | kernel               
 
|-
 
|-
| [[#Syscall Filtering|   Syscall Filtering]]    || style="background:#ffff00" | N                   || style="background:#ffff00" | N                   || style="background:#ffff00" | N                   || style="background:#ffff00" | ?                   || style="background:#98fd98" | Y                  || style="background:#98fd98" | Y                  || style="background:#98fd98" | Y                   
+
| [[#Blacklist Rare Protocols|Blacklist Rare Protocols]]    || style="background:#98fd98" | Y                   || style="background:#98fd98" | Y                   || style="background:#98fd98" | Y                   || style="background:#98fd98" | Y                  || style="background:#98fd98" | Y                   || style="background:#98fd98" | Y                  || style="background:#98fd98" | Y                  || style="background:#98fd98" | Y                   
 
|-
 
|-
| [[#Secure Boot Support| Secure Boot Support]]    || style="background:#ffff00" | N                  || style="background:#ffff00" | N                  || style="background:#ffff00" | N                  || style="background:#ffff00" | N                   || style="background:#98fd98" | Y                  || style="background:#98fd98" | Y                  || style="background:#98fd98" | Y                   
+
| [[#Write-protect kernel .rodata sections|Write-protect kernel .rodata sections]]    || style="background:#ffff00" | N                  || style="background:#ffff00" | N                  || style="background:#ffff00" | N                  || style="background:#00dd00" | Y                  || style="background:#00dd00" | Y                   || style="background:#00dd00" | Y                  || style="background:#00dd00" | Y                  || style="background:#00dd00" | Y                   
 
|-
 
|-
| [[#Tamper Resistant Logs|Tamper Resistant Logs]]    || style="background:#ffff00" | N                  || style="background:#ffff00" | N                  || style="background:#ffff00" | N                  || style="background:#ffff00" | N                   || style="background:#98fd98" | Y                  || style="background:#98fd98" | Y                  || style="background:#98fd98" | Y                   
+
| [[#Kernel Stack Protector|Kernel Stack Protector]]    || style="background:#ffff00" | N                  || style="background:#ffff00" | N                  || style="background:#ffff00" | N                  || style="background:#00dd00" | Y                  || style="background:#00dd00" | Y                   || style="background:#00dd00" | Y                  || style="background:#00dd00" | Y                  || style="background:#00dd00" | Y                   
 
|-
 
|-
| [[#Overflow checking in new operator|Overflow checking in new operator]]    || style="background:#ffff00" | N                  || style="background:#ffff00" | N                  || style="background:#ffff00" | N                  || style="background:#ffff00" | N                  || style="background:#98fd98" | Y                  || style="background:#98fd98" | Y                  || style="background:#98fd98" | Y                   
+
| [[#sVirt labelling|     sVirt labelling]]    || style="background:#ffff00" | N                  || style="background:#ffff00" | N                  || style="background:#ffff00" | N                  || style="background:#00dd00" | Y                  || style="background:#00dd00" | Y                  || style="background:#00dd00" | Y                  || style="background:#00dd00" | Y                  || style="background:#00dd00" | Y                 
 +
|-
 +
| [[#SYN cookies|        SYN cookies]]    || style="background:#98fd98" | ?                  || style="background:#98fd98" | kernel              || style="background:#00dd00" | kernel              || style="background:#00dd00" | kernel              || style="background:#00dd00" | kernel              || style="background:#00dd00" | kernel              || style="background:#00dd00" | kernel              || style="background:#00dd00" | kernel             
 +
|-
 +
| [[#Syscall Filtering|  Syscall Filtering]]    || style="background:#ffff00" | N                   || style="background:#ffff00" | N                  || style="background:#ffff00" | N                  || style="background:#ffff00" | ?                  || style="background:#98fd98" | Y                  || style="background:#98fd98" | Y                  || style="background:#98fd98" | Y                  || style="background:#98fd98" | Y                 
 +
|-
 +
| [[#Secure Boot Support| Secure Boot Support]]    || style="background:#ffff00" | N                  || style="background:#ffff00" | N                  || style="background:#ffff00" | N                  || style="background:#ffff00" | N                  || style="background:#98fd98" | Y                   || style="background:#98fd98" | Y                  || style="background:#98fd98" | Y                  || style="background:#98fd98" | Y                   
 
|-
 
|-
 
|}
 
|}
== Features ==
 
 
 
 
<div style="float:right;">__TOC__</div>
 
<div style="float:right;">__TOC__</div>
 
== Configuration ==
 
== Configuration ==
Line 130: Line 133:
 
change required a complete firewall restart. The firewall daemon on the other
 
change required a complete firewall restart. The firewall daemon on the other
 
hand manages the firewall dynamically and applies changes without
 
hand manages the firewall dynamically and applies changes without
restarting the whole firewall. See [https://fedoraproject.org/wiki/FirewallD FirewallD]
+
restarting the whole firewall. See [[FirewallD|FirewallD]]
and [https://fedoraproject.org/wiki/SystemConfig/firewall system-config-firewall]
+
and [[SystemConfig/firewall|system-config-firewall]]
 
for more information.
 
for more information.
  
Line 137: Line 140:
 
=== Signed updates ===
 
=== Signed updates ===
 
Each stable RPM package that is published by Fedora Project is
 
Each stable RPM package that is published by Fedora Project is
signed with a GPG signature. By default, yum and the graphical update
+
signed with a GPG signature. By default, [[dnf|DNF]], [[yum|YUM]] and the graphical update
 
tools will verify these signatures and refuse to install any packages that
 
tools will verify these signatures and refuse to install any packages that
 
are not signed or have bad signatures. You should always verify the
 
are not signed or have bad signatures. You should always verify the
Line 152: Line 155:
  
 
=== SELinux ===
 
=== SELinux ===
[[SELinux]] is an inode-based MAC. See [https://fedoraproject.org/wiki/SELinux this page]
+
[[SELinux]] is an inode-based MAC. See [[SELinux|this page]]
 
and [http://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/6/html/Security-Enhanced_Linux/index.html this page]
 
and [http://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/6/html/Security-Enhanced_Linux/index.html this page]
 
for more information.
 
for more information.
Line 159: Line 162:
 
=== SELinux targeted policy ===
 
=== SELinux targeted policy ===
 
SELinux enabled with targeted policy by default.
 
SELinux enabled with targeted policy by default.
See [http://fedoraproject.org/wiki/SELinux/Policies discussion of policies page]
+
See [[SELinux/Policies|discussion of policies page]]
 
and [http://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/6/html/Security-Enhanced_Linux/index.html this page]
 
and [http://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/6/html/Security-Enhanced_Linux/index.html this page]
 
for more information.
 
for more information.
Line 187: Line 190:
 
The need for setuid applications can be reduced via the
 
The need for setuid applications can be reduced via the
 
application of [http://www.olafdietsche.de/linux/capability/ filesystem capabilities]
 
application of [http://www.olafdietsche.de/linux/capability/ filesystem capabilities]
using the xattrs available to most modern filesystems. This
+
using the xattrs available to most modern filesystems. This reduces the
reduces the possible misuse of vulnerable setuid applications. The kernel
+
possible misuse of vulnerable setuid applications. The kernel provides the
provides the support and the user-space tools are available in the
+
support and the user-space tools are available in the libcap package.
standard repositories.
+
  
Capabilities are defined in /usr/include/linux/capability.h
 
  
Linux Capability Version 1
+
=== PR_SET_SECCOMP ===
"_LINUX_CAPABILITY_U32S_1" defined as 1 indicates kernel has 32 or less capabilities
+
Setting SECCOMP(SECure COMPuting) for a process is meant to confine it to a small subsystem of system calls, used for specialized processing-only programs.
 +
See [http://lwn.net/Articles/507067/ this article] and [http://lwn.net/Articles/332974/ SECCOMP article]
 +
for more information.
  
Linux Capability Version 2
 
constant "_LINUX_CAPABILITY_U32S_2" defined as 2 indicated kernel has more than 32 capabilities,
 
  
Linux Capability Version 3
+
== Mandatory Access Control (MAC) ==
 +
Mandatory Access Controls specifies which subject can access specific data.
 +
Mandatory Access Controls are handled via the kernel LSM(Linux Security Modules) hooks. MAC is based on the
 +
security labels. Data on the system has clearance and classification data stored with security labels, which
 +
can be accessed by specific subjects or objects.When some subject tries to access the data on the system then
 +
the rules defined by the policy are checked to take access control decision.Security Levels are classified like
 +
Unclassified -> Confidential -> Secret -> Top Secret.If user has clearance to access the requested object
 +
then user will be allowed otherwise user will be denied access. It is a system wide policy which states that
 +
who is allowed to access, an individual user cannot alter the access. MAC model is mostly used in environment
 +
where confidentiality is important like in Government organizations like military, an example of widely used
 +
of MAC is SELinux.Security-Enhanced Linux (SELinux) employs MAC rules to facilitate fine-grained security.
  
"_LINUX_CAPABILITY_U32S_2" is deprecated by "_LINUX_CAPABILITY_U32S_3"
+
see [http://docs.fedoraproject.org/en-US/Fedora/13/html/SELinux_FAQ/index.html#id4228000 MAC]
  
32 bit integer is in /proc/sys/kernel/cap_last_cap which defines the current capability sets
 
Every linux process has sets of bitmaps
 
  
<code>
+
=== SELinux user confinement ===
  typedef struct __user_cap_data_struct {
+
        __u32 effective;
+
        __u32 permitted;
+
        __u32 inheritable;
+
  } *cap_user_data_t;
+
</code>
+
  
each capability is implemented as a bit in each of these bitmaps which is either set or unset.
+
Support for SELinux to confine users access on a system. Each Linux user is mapped to an SELinux user via SELinux
 +
policy, allowing Linux users to inherit the restrictions placed on SELinux users, for example (depending on the user),
 +
not being able to: run the X Window System; use networking; run setuid applications (unless SELinux policy permits it);
 +
or run the su and sudo commands
  
1. effective (E)
+
<pre>
Effective capability set indicates which capabilities are effective. When some privileged operation
+
# semanage login -l
is done, operating system checks for the bit in effective set of the processes rather than effective uid.
+
  
2. permitted (P)
+
Login Name          SELinux User        MLS/MCS Range        Service
Indicates which capabilities process can use. Process might have capabilities set in permitted set
+
but not in the effective set, that would mean that particular capability is disabled for the process
+
Process can set capability in effective set only if it is available in permitted set.
+
  
This combinations of effective and permitted bits allow to enable , disable and drop privileges
+
__default__          unconfined_u        s0-s0:c0.c1023      *
 +
root                unconfined_u        s0-s0:c0.c1023      *
 +
system_u            system_u            s0-s0:c0.c1023      *
 +
</pre>
 +
All the linux users are mapped to __default__ which maps to unconfined_u user. SELinux users that are available are
 +
guest_u, xguest_u, user_u, staff_u.
  
3. inheritable (I)
+
<pre>
Inheritable capability set indicates which capabilities are inheritable by the process which is going
+
# ls /etc/selinux/targeted/contexts/users
to be executed by the current process.
+
guest_u  root  staff_u  sysadm_u  unconfined_u  user_u  xguest_u
  
If P1 has X capabilities , then the process P1' which is ran or forked by P1 for example using exec(),
+
# ls /etc/selinux/mls/contexts/users
how many capabilities out of X can be inherited by P1' is decided by inheritable capabilities set.
+
guest_u  root  staff_u  unconfined_u  user_u  xguest_u
  
The need for setuid applications can be reduced via the
+
* sysadm_u is not present in MLS Policy
application of [http://www.olafdietsche.de/linux/capability/ filesystem capabilities]
+
using the xattrs available to most modern filesystems. This
+
reduces the possible misuse of vulnerable setuid applications. The kernel
+
provides the support and the user-space tools are available in the
+
standard repositories.
+
  
Programmes have been vulnerable to set-UID, there is no need for having root
+
</pre>
privileges every time for a process to run, it is logical to provide to minimum
+
set of privileges to programme that can enable the programme to run
+
effectively. With the normal set-UID approach programmes would run more than
+
the privileges required, increasing the risk of Privilege Escalation. Enabling
+
Capabilities to programme has been started since kernel 2.6.24 known as file
+
capability implemented in fs/exec.c in Kernel itself.
+
  
Common capabilities are implemented in security/commoncap.c
+
As listed http://docs.fedoraproject.org/en-US/Fedora/13/html/Security-Enhanced_Linux/sect-Security-Enhanced_Linux-Targeted_Policy-Confined_and_Unconfined_Users.html
 
+
Implementation in Red Hat Enterprise Linux
+
  
 
{| class="wikitable"
 
{| class="wikitable"
RELEASE  ||  KERNEL    || CAPABILITY
+
|User    ||  Domain    |X Window System  || su and sudo  || Execute in home directory and /tmp/   || Networking
 
|-
 
|-
| [[RHEL 2]] || 2.4.9-e.X   ||     N
+
|guest_u || guest_t no ||  no              ||   no        || optional                              ||  no
 
|-
 
|-
| [[RHEL 3]] || 2.4.21-X    ||     N
+
|xguest_u || xguest_t  ||   yes              ||   no        || optional                              ||  only Firefox
 
|-
 
|-
| [[RHEL 4]] || 2.6.9-X      ||     Y
+
|user_u  || user_t    ||   yes              ||   no        || optional                              ||  yes
 
|-
 
|-
| [[RHEL 5]] || 2.6.18-X    ||     Y
+
|staff_u || staff_t    ||   yes              ||  only sudo    || optional                              || yes
|-
+
| [[RHEL 6]] || 2.6.32-X    ||     Y
+
 
|}
 
|}
  
==== Modifying Filesystem Capabilities ====
+
Users are defined in /etc/selinux/<target or mls>/contexts/users.
  
There is no specific system call provided by the linux to modify filesystem capabilities.
+
See [http://docs.fedoraproject.org/en-US/Fedora/13/html/Security-Enhanced_Linux/sect-Security-Enhanced_Linux-Targeted_Policy-Confined_and_Unconfined_Users.html Confined and Unconfined Users article]
But as its implemented as inode getxattr() , fsetxattr system calls can be used.
+
 
+
Here "$" means normal user and "#" means root user. Let's take 'ping' as working example
+
to show how capabilities work.
+
 
+
  $ mkdir CapabilityTest
+
  $ cd CapabilityTest
+
  $ cp `which ping` .
+
 
+
  $ ./ping -q -c 1 127.0.0.1
+
  ping: icmp open socket: Operation not permitted
+
 
+
  # ./ping -q -c 1 127.0.0.1
+
  PING 127.0.0.1 (127.0.0.1) 56(84) bytes of data.
+
  --- 127.0.0.1 ping statistics ---
+
  1 packets transmitted, 1 received, 0% packet loss, time 0ms
+
  rtt min/avg/max/mdev = 0.213/0.213/0.213/0.000 ms
+
 
+
  # setcap cap_net_raw=ep ./ping
+
  # getcap ./ping
+
  ./ping = cap_net_raw+ep
+
  $ ./ping -q -c 1 127.0.0.1
+
  PING 127.0.0.1 (127.0.0.1) 56(84) bytes of data.
+
  --- 127.0.0.1 ping statistics ---
+
  1 packets transmitted, 1 received, 0% packet loss, time 0ms
+
  rtt min/avg/max/mdev = 0.170/0.170/0.170/0.000 ms
+
 
+
from administrators perspective effective bit has to be disabled , so logical way of doing this will  be
+
 
+
  # setcap cap_net_raw=p ./ping
+
  # getcap ./ping
+
  ./ping = cap_net_raw+p
+
 
+
  $ ./ping -q -c 1 127.0.0.1
+
  PING 127.0.0.1 (127.0.0.1) 56(84) bytes of data.
+
  --- 127.0.0.1 ping statistics ---
+
  1 packets transmitted, 1 received, 0% packet loss, time 0ms
+
  rtt min/avg/max/mdev = 0.170/0.170/0.170/0.000 ms
+
 
+
from that it can be concluded that, ping requires more privileges then a normal user for specially
+
crafted network packets, so while running with 'root' user it works as 'root' has all effective
+
capabilities. In the Linux Kernel there is a check which sees if application is capable, which means
+
to run it should have effective capability for CAP_NET_RAW.
+
 
+
Using set-UID root makes 'ping' over privileged, if buffer overflow is detected
+
then attacker could do local privilege escalation giving back shell.
+
 
+
 
+
== Mandatory Access Control (MAC) ==
+
Mandatory Access Controls are handled via the
+
kernel LSM hooks.
+
 
+
 
+
=== SELinux user confinement ===
+
 
+
Support for SELinux to confine users access on a system.
+
See [https://access.redhat.com/site/documentation/en-US/Red_Hat_Enterprise_Linux/6/html-single/6.0_Release_Notes/index.html#id3184917 this page]
+
 
for more information.
 
for more information.
  
Line 333: Line 268:
 
=== SELinux XACE ===
 
=== SELinux XACE ===
  
Support for SELinux X Access Control Extension (XACE).
+
SELinux X Access Control Extension (XACE) aims at extending SELinux to X.org system, to provide flexible fine-grained MAC to the desktop.
XACE (X Access Control Extension) provides a wrapper to do security checks at
+
places where untrusted clients should be restricted. XACE provides control over
+
X server objects including colormaps, windows, pixmaps, cursors, fonts which are
+
assigned unique ID numbers stored. ID numbers can store client ID numbers so
+
that resources can be allocated to the clients. clients access resources by the
+
their ID numbers when making protocol requests. Developer can place XACE hooks
+
in the code at the places where clients should be restricted. XACE hooks when
+
present in the code triggers different types of hooks, for e.g while
+
authenticating XACE_AUTH_AVAIL hook can be placed there, if code present in the
+
application tries to access any device like system bell, cdrom etc.
+
XACE_DEVICE_ACCESS hook can be used similarly there are more hooks present in
+
XACE, to use #include<Xext/xace.h> is the header to be included which includes
+
everything with constants and function declarations, if only structure
+
definitions are needed use #include<Xext/xacestr.h>
+
 
+
List of Hook Identifiers:
+
 
+
XACE_CORE_DISPATCH
+
XACE_EXT_DISPATCH
+
XACE_RESOURCE_ACCESS
+
XACE_DEVICE_ACCESS
+
XACE_PROPERTY_ACCESS
+
XACE_SEND_ACCESS
+
XACE_RECEIVE_ACCESS
+
XACE_CLIENT_ACCESS
+
XACE_EXT_ACCESS
+
XACE_SERVER_ACCESS
+
XACE_SELECTION_ACCESS
+
XACE_SCREEN_ACCESS
+
XACE_SCREENSAVER_ACCESS
+
XACE_AUTH_AVAIL
+
XACE_KEY_AVAIL
+
XACE_AUDIT_BEGIN
+
XACE_AUDIT_END
+
 
+
with each identifier there is a callback function attached
+
 
+
For complete information about XACE and security hooks provided by it : http://www.x.org/releases/X11R7.5/doc/security/XACE-Spec.html
+
 
+
XACE security hooks can be used like for e.g in case of DEVICE ACCESS:
+
 
+
<code>
+
<pre>
+
#include<Xext/xace.h>
+
#include<dix-config.h>
+
static int check_something(DeviceIntPtr dev, ClientPtr client, ....<some_other_args>) {
+
 
+
int res;
+
 
+
/* DixManageAccess : Global device configuration is being performed.
+
        * on ChangeKeyboardMapping, XiChangeDeviceControl, XkbSetControls
+
* http://www.x.org/releases/X11R7.5/doc/security/XACE-Spec.html#device_access_hook
+
*/
+
 
+
        res = XaceHook(XACE_DEVICE_ACCESS, client, dev, DixManageAccess);
+
if (res != Success) {
+
client->errorValue = dev->id;
+
return res;
+
}
+
}
+
</pre>
+
</code>
+
 
+
  
  
Line 404: Line 276:
 
See [https://access.redhat.com/site/documentation/en-US/Red_Hat_Enterprise_Linux/6/html-single/6.0_Release_Notes/index.html#id3184917 this page]
 
See [https://access.redhat.com/site/documentation/en-US/Red_Hat_Enterprise_Linux/6/html-single/6.0_Release_Notes/index.html#id3184917 this page]
 
and [http://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/6/html-single/6.0_Release_Notes/index.html#id3184917 this page]
 
and [http://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/6/html-single/6.0_Release_Notes/index.html#id3184917 this page]
for more information.
 
 
 
=== PR_SET_SECCOMP ===
 
SECCOMP(SECure COMPuting) which is meant to condine it to small subsystem of system
 
calls, is available since Linux 2.6.23. PR_SET_SECCOMP set the secure computing
 
mode for the the calling thread this limits the system calls for using this in
 
code #include<linux/seccomp.h> and #include<sys/prctl.h>. The  systemd init daemon
 
supports the seccomp filter mecahnism in 3.5 kernel. The result is that process can
 
be easily configured to be run in a sandboxed environment.
 
 
<code>
 
<pre>
 
#include<sys/prctl.h>
 
#include<linux/seccomp.h>
 
int main() {
 
 
  /* int prctl(int option, unsigned long arg2, unsigned long arg3,
 
  * unsigned long arg4, unsigned long arg5);
 
  * option is PR_SET_SECCOMP, rest args are set according to option passed into
 
  * prctl function.
 
  */
 
 
  prctl(PR_SET_SECCOMP,SECCOMP_MODE_STRICT,0,0,0);
 
  _exit(0);
 
}
 
</pre>
 
</code>
 
See [http://lwn.net/Articles/507067/ this article] and [http://lwn.net/Articles/332974/ SECCOMP]
 
 
for more information.
 
for more information.
  
Line 439: Line 282:
  
 
A boolean variable to allow SELinux to turn off all processes ability to ptrace other process.
 
A boolean variable to allow SELinux to turn off all processes ability to ptrace other process.
See [https://fedoraproject.org/wiki/Features/SELinuxDenyPtrace this page]
+
See [[Features/SELinuxDenyPtrace|this page]]
 
and [http://lwn.net/Articles/491440/ this] for more information.
 
and [http://lwn.net/Articles/491440/ this] for more information.
  
Line 471: Line 314:
  
  
=== per-user temp folder ===
+
=== Polyinstantiate /tmp, /var/tmp and user home folders ===
Similar to the previous security feature,, per-user /tmp protect users and the system from mistakes in
+
To protect the world writable shared folders like /tmp and /var/tmp PAM (Pluggable Authentication Modules)
/tmp handling, by having a private /tmp for each users. This is transparent for them, and each directory is separated.
+
can help by creating namespace for users on the system. Security of a system works at different layers, Polyinstantiating these
This feature is implemented using ''pam_namespace.so''.
+
world writable folders add an extra layer to protect from further intrusion into the system. Polyinstanting means that a new
 +
instance of /tmp or /var/tmp directory is created for each user. This feature is implemented using ''pam_namespace.so''.
 +
To enable this feature :
 +
 
 +
uncomment the respective lines in /etc/security/namespace.conf
 +
<pre>#/tmp    /tmp-inst/            level      root,adm
 +
#/var/tmp /var/tmp/tmp-inst/    level      root,adm
 +
# Remove the line below if required to polyinstantiate HOME directory of the user
 +
#$HOME    $HOME/$USER.inst/    level</pre>
 +
 
 +
add
 +
<pre> session    required    pam_namespace.so </pre>
 +
to /etc/pam.d/login. File /etc/security/namespace.conf specifies which directories will be polyinstantiated. It also specifies
 +
how they will be polyinstantiated , what will the names of the directories which will be polyinstantiated and also for users where
 +
Polyinstantiation would not be performed.
 +
 
 +
create the directories and set selinux context and bool value to polyinstantiate
 +
<pre># mkdir /tmp-inst /var/tmp-inst
 +
# chmod 000 /tmp-inst
 +
# chmod 000 /var/tmp-inst
 +
# chcon -R -t tmp_t /tmp-inst
 +
# chcon -R -t tmp_t /var/tmp-inst
 +
# setsebool polyinstantiation_enabled 1</pre>
 +
 
 +
* $ man 8 pam_namespace
 +
* $ man 5 namespace.conf
 +
 
 +
As per reference https://www.ibm.com/developerworks/library/l-polyinstantiation/
 +
 
 +
Polyinstantiation of world-writeable directories prevents the following types of attacks:
 +
* Race-condition attacks with symbolic links
 +
* Exposing a file name considered secret information or useful to an attacker
 +
* Attacks by one user on another user
 +
* Attacks by a user on a daemon
 +
* Attacks by a non-root daemon on a user
 +
 
 +
However, polyinstantiation does NOT prevent these types of attacks:
 +
* Attacks by a root daemon on a user
 +
* Attacks by root (account or escalated privilege) on any user
 +
 
 +
see [http://www.coker.com.au/selinux/talks/sage-2006/PolyInstantiatedDirectories.html Polyinstantiation of directories in an SE Linux system]
 +
[https://www.ibm.com/developerworks/library/l-polyinstantiation/ Improve security with polyinstantiation]
  
  
Line 488: Line 372:
 
With the use of LVM Encryption user can just encrypt Physical Volume where other partitions
 
With the use of LVM Encryption user can just encrypt Physical Volume where other partitions
 
reside making encryption and decryption much faster. LVM is created under big encrypted
 
reside making encryption and decryption much faster. LVM is created under big encrypted
blockdevice which hides the LVM until blockdevice is unencrypted. Once the blockdevice is
+
blockdevice which hides the LVM until blockdevice is unecrypted. Once the blockdevice is
 
unencrypted it reads the volume structure and mounts all the detected partitions at boot
 
unencrypted it reads the volume structure and mounts all the detected partitions at boot
 
time.
 
time.
Line 501: Line 385:
 
specific folders/directories as needed after creation of Filesystem.
 
specific folders/directories as needed after creation of Filesystem.
  
See [http://ecryptfs.org/ eCryptfs homepage] and [http://www.linuxjournal.com/article/9400 / eCryptfs Article]
+
See [http://ecryptfs.org/ eCryptfs homepage] and [http://www.linuxjournal.com/article/9400 eCryptfs Article]
 
for more details.
 
for more details.
  
Line 530: Line 414:
 
**  [    0.000000] Using x86 segment limits to approximate NX protection
 
**  [    0.000000] Using x86 segment limits to approximate NX protection
  
For more information, see [https://fedoraproject.org/wiki/Security_Features?rd=Security/Features#Exec-Shield Security Features] page.
+
For more information, see [[Security_Features?rd=Security/Features#Exec-Shield|Security Features]] page.
  
  
Line 541: Line 425:
 
building the entire archive. PIE has a large (5-10%) performance penalty
 
building the entire archive. PIE has a large (5-10%) performance penalty
 
on architectures with small numbers of general registers (e.g. x86), so it
 
on architectures with small numbers of general registers (e.g. x86), so it
should only be used for a [https://fedoraproject.org/wiki/Hardened_Packages select number of security-critical packages].
+
should only be used for a [[Hardened_Packages|select number of security-critical packages]].
 
PIE on x86_64 does not have the same penalties, and will eventually be made the
 
PIE on x86_64 does not have the same penalties, and will eventually be made the
 
default, but more testing is required. See
 
default, but more testing is required. See
Line 547: Line 431:
 
[https://fedorahosted.org/fesco/ticket/1113 FESCo ticket] for more
 
[https://fedorahosted.org/fesco/ticket/1113 FESCo ticket] for more
 
information.
 
information.
 +
 +
In Fedora 23 and later, all packages are built with PIE and Full RELRO. See
 +
[[Changes/Harden_All_Packages|this page]] for details.
  
  
Line 563: Line 450:
 
the ability to perform arbitrary code execution via heap memory overflows
 
the ability to perform arbitrary code execution via heap memory overflows
 
that try to corrupt the control structures of the malloc heap memory
 
that try to corrupt the control structures of the malloc heap memory
areas.This protection has evolved over time, adding more and more protections as
+
areas. This protection has evolved over time, adding more and more protections as
 
additional [http://www.phrack.com/issues.html?issue=66&id=10#article corner-cases were researched].
 
additional [http://www.phrack.com/issues.html?issue=66&id=10#article corner-cases were researched].
 
As it currently stands, glibc 2.10 and later appears to successfully resist
 
As it currently stands, glibc 2.10 and later appears to successfully resist
Line 587: Line 474:
 
Enabled at compile-time. The routines used for stack checking are actually
 
Enabled at compile-time. The routines used for stack checking are actually
 
part of glibc, but gcc is patched to enable linking against those routines
 
part of glibc, but gcc is patched to enable linking against those routines
by default. See [https://fedoraproject.org/wiki/Security_Features?rd=Security/Features#Stack_Smash_Protection.2C_Buffer_Overflow_Detection.2C_and_Variable_Reordering this page]
+
by default. See [[Security_Features?rd=Security/Features#Stack_Smash_Protection.2C_Buffer_Overflow_Detection.2C_and_Variable_Reordering|this page]]
 
for more information.
 
for more information.
  
  
=== Address Space Layout Randomisation (ASLR) ===
+
=== Address Space Layout Randomization (ASLR) ===
 
ASLR is implemented by the kernel and the ELF
 
ASLR is implemented by the kernel and the ELF
loader by randomising the location of memory allocations (stack, heap,
+
loader by randomizing the location of memory allocations (stack, heap,
 
shared libraries, etc). This makes memory addresses harder to predict when
 
shared libraries, etc). This makes memory addresses harder to predict when
 
an attacker is attempting a memory-corruption exploit. ASLR is controlled
 
an attacker is attempting a memory-corruption exploit. ASLR is controlled
system-wide by the value of ''/proc/sys/kernel/randomize_va_space''. See
+
system-wide by the value of ''/proc/sys/kernel/randomize_va_space''.
[http://www.redhat.com/magazine/009jul05/features/execshield/#preventing-abuse this article] and
+
* 0 - Turn ASLR off.
[http://lwn.net/Articles/190139/ this article] for more information. ASLR is now enabled for all packages
+
* 1 - Make the addresses of mmap(2) allocations, the stack, loaded shared libraries and the VDSO page randomized.
by default in Rawhide.
+
* 2 - Also support heap randomization in additon.
 +
 
 +
Even when randomize_va_space is set to 2, the text segment of binaries is
 +
loaded at a static address. To make ASLR effective all segments must be
 +
randomized. Leaving the text segment loading address non-randomized reduces the
 +
protection provided by the ASLR since the attackers can use ret2text attacks.
 +
The loading address of the text segement in a binary can be randomized by
 +
building the binary as PIE (Position Independent Executable).
 +
 
 +
See [http://www.redhat.com/magazine/009jul05/features/execshield/#preventing-abuse this article] and
 +
[http://lwn.net/Articles/190139/ this article] for more information.
  
  
Line 617: Line 514:
  
  
=== Exec ASLR ===
+
==== Exec ASLR ====
 
Each execution of a program that has been built with "-fPIE
 
Each execution of a program that has been built with "-fPIE
 
-pie" will get loaded into a different memory location. This makes it
 
-pie" will get loaded into a different memory location. This makes it
Line 642: Line 539:
 
RELRO stands for RELocation Read-Only, it is a mitigation technique to harden
 
RELRO stands for RELocation Read-Only, it is a mitigation technique to harden
 
data sections of an ELF/process. It is used to move commonly exploited structures
 
data sections of an ELF/process. It is used to move commonly exploited structures
in ELF binary to a read-only location.It Hardens ELF programs against loader memory
+
in ELF binary to a read-only location. It Hardens ELF programs against loader memory
 
area overwrites by having the loader mark any areas of the relocation table as read-only
 
area overwrites by having the loader mark any areas of the relocation table as read-only
 
for any symbols resolved at load-time ("read-only relocations"). This reduces the area of
 
for any symbols resolved at load-time ("read-only relocations"). This reduces the area of
Line 652: Line 549:
 
Partial RELRO
 
Partial RELRO
  
- Compilation: gcc -Wl,-z,relro
+
* Compilation: gcc -Wl,-z,relro
 
+
* ELF sections are reordered, so that ELF internal data sections (.got, .dtors, etc) precede the program's data sections (.data and .bss)
- ELF sections are reordered, so that ELF internal data sections (.got, .dtors, etc)
+
* non-PLT GOT is read-only
precede the program's data sections (.data and .bss)
+
* GOT is writable
 
+
- non-PLT GOT is read-only
+
 
+
- GOT is writable
+
  
 
Full RELRO
 
Full RELRO
  
- compilation: gcc -Wl,-z,relro,-z,now
+
* compilation: gcc -Wl,-z,relro,-z,now
 +
* Supports all the features of partial RELRO
 +
* In addition , GOT is also remapped  as read-only
  
- Supports all the features of partial RELRO
+
In case of a bss or data overflow bug both partial and full RELRO can protect
 
+
the ELF internal data sections from being overwritten. With full RELRO a
- In addition , GOT is also remapped  as read-only
+
working mitigation technique to successfully prevent the modification of GOT
 
+
entries is available. Full RELRO has been enabled for all packages in Fedora 23
Only Full RELRO can protect from exploiting technique of overwriting GOT entry to get
+
and later.
control over program execution flow.
+
 
+
So the question is what are GOT and PLT?
+
 
+
GOT (Global Offset Table) redirects position independent address calculations to an absolute
+
location and is located in .got section of an ELF executable or shared object. It has the final
+
location of a function calls symbol, used with dynamically linked code. By default GOT is created
+
dynamically while program is running. The first time function is called GOT contains pointer back
+
to PLT (Procedure Linkage Table), where linker is called to find actual location of the function.
+
The location found is written to GOT, Second time whenever the function is called GOT already
+
knows location of the function known as lazy binding.
+
 
+
PLT (Procedure Linker Table) works with GOT to reference and relocate functions. PLT reference will
+
cause a jmp into the GOT and find the location of the called function. On the first call there wont
+
be no entry in GOT, so PLT will hand over the request to the rtld for resolving the function's
+
absolute location, after this GOT will be updated for future references.
+
 
+
Few Constraints about PLT and GOT
+
 
+
1. PLT will always contain code that is called by program directly,so it will be allocated at a
+
known offset from the .text segment.
+
 
+
2. GOT contains data used by different parts of the program directly,so it will be at a static
+
address in the memory.
+
 
+
3. As GOT is "lazy binded",so it needs to be writable
+
 
+
In case of a bss or data overflow bug both partial and full RELRO can protect the ELF internal data sections from being overwritten.
+
With full RELRO a working mitigation technique to successfully prevent the modification of GOT entries is available.Only one reason
+
why full RELRO is not widely used is that the startup of processes is slowed down as the linker has to perform all relocations at startup time.
+
  
 
In short, RELRO hardens ELF programs against loader memory area overwrites by
 
In short, RELRO hardens ELF programs against loader memory area overwrites by
Line 705: Line 570:
 
any symbols resolved at load-time ("read-only relocations"). This reduces
 
any symbols resolved at load-time ("read-only relocations"). This reduces
 
the area of possible GOT-overwrite-style memory corruption attacks.
 
the area of possible GOT-overwrite-style memory corruption attacks.
 +
 +
This information has been borrowed from [http://tk-blog.blogspot.in/2009/02/relro-not-so-well-known-memory.html this article].
 +
  
 
=== Built with BIND_NOW ===
 
=== Built with BIND_NOW ===
Line 760: Line 628:
 
etc) to extract additional credentials and continue to immediately expand the scope
 
etc) to extract additional credentials and continue to immediately expand the scope
 
of their attack without resorting to user-assisted phishing or trojans.
 
of their attack without resorting to user-assisted phishing or trojans.
 +
It is provided by YAMA , can be enabled by CONFIG_SECURITY_YAMA in the kernel.
 +
 +
Independent of this configuration, processes that know they store secrets in
 +
memory may already use <code>prctl(PR_SET_DUMPABLE,0);</code> to prevent ptrace ''and other''
 +
memory-snooping attacks.
 +
 +
 +
=== Overflow checking in new operator ===
 +
 +
GCC performs overflow checking in operator new[]. new operator is used to dynamically
 +
allocate memory.It throws bad_alloc exception, header to include for using it is <new>
 +
new() or new[]() without declaration of exception cannot signal memory exhaustion.If
 +
there is an option to choose between calloc/malloc/new for allocation of the memory,
 +
new should be used. If new[] is used to allocate memory then delete[] should be used to
 +
free the allocated memory. Using delete without [] will cause memory leak. Use try-catch
 +
block with new, as it throws exception and does not return value, though it can be forced
 +
to return a value by using nothrow.
 +
 +
<pre>
 +
using namespace std;
 +
/* this should return a value */
 +
alpha* pt = new (nothrow) alpha[200];
 +
 +
or it will throw bad_alloc exception which can be handled by the following code
 +
class bad_alloc : public exception {
 +
/* error to be thrown to be implemented here */
 +
};
 +
struct alpha_t{};
 +
 +
extern const alpha_t alpha;  // indicator for allocation to prevent exceptions
 +
 +
/* should throw exception */
 +
int* ptr = new int[100000];
 +
 +
/* to avoid exception correct usage would be */
 +
int* ptr = new(alpha) int[100000];
 +
</pre>
 +
 +
See [https://securityblog.redhat.com/2012/10/31/array-allocation-in-cxx/ Array allocation in C++ article] for
 +
more information.
 +
 +
 +
 +
=== Built with Format Security ===
 +
 +
Enable "-Werror=format-security" compilation flag for all packages in Fedora. Once this flag is enabled,
 +
GCC will refuse to compile code that could be vulnerable to a string format security flaw.
 +
see [[Changes/FormatSecurity|Format Security]] for more information
 +
 +
 +
=== Crypto Policy ===
 +
 +
Unify the crypto policies used by different applications and libraries. That is allow setting a consistent
 +
security level for crypto on all applications in a Fedora system. The implementation approach will be to
 +
initially modify SSL libraries to respect the policy and gradually adding more libraries and applications.
 +
See [[Changes/CryptoPolicy|Crypto Policy]] for more information.
 +
 +
 +
=== Built with Stack Protector Strong ===
 +
 +
See [http://lwn.net/Articles/584225/ "Strong" stack protection for GCC] article for more information.
 +
 +
 +
=== Tamper Resistant Logs ===
 +
 +
When a system is compromised, attackers might tamper the system logs. This can
 +
be prevented by using FSS (Forward Secure Sealing) which is implemented in
 +
the systemd journal. Binary logs maintained by systemd are sealed at certain time
 +
intervals. Sealing is an cryptographic operation on the logs so that any
 +
tempering on the logs can be detected, though an attacker can completely remove
 +
entire logs but this is likely to get noticed by the system administrator.
 +
 +
See [http://danwalsh.livejournal.com/58647.html Forward Secure Sealing (FSS) article] for
 +
more information.
  
  
Line 802: Line 744:
 
restrictions for loaded modules in the kernel. This can help resist future
 
restrictions for loaded modules in the kernel. This can help resist future
 
kernel exploits that depend on various memory regions in loaded modules.
 
kernel exploits that depend on various memory regions in loaded modules.
Enabled via the CONFIG_DEBUG_MODULE_RONX option.
+
Enabled via the CONFIG_DEBUG_SET_MODULE_RONX option.
  
  
Line 870: Line 812:
  
 
"Secure Boot" describes a UEFI feature by which malware is prevented from
 
"Secure Boot" describes a UEFI feature by which malware is prevented from
inserting itself into the boot process before the operating system loads. See [http://fedoraproject.org/wiki/Features/SecureBoot Fedora + UEFI Secure Boot]
+
inserting itself into the boot process before the operating system loads.
article for more details.
+
 
+
 
+
=== Tamper Resistant Logs ===
+
 
+
See [http://danwalsh.livejournal.com/58647.html Forward Secure Sealing (FSS) article] for
+
more information.
+
 
+
 
+
=== Overflow checking in new operator ===
+
 
+
GCC performs overflow checking in operator new[]. new operator is used to dynamically
+
allocate memory.It throws bad_alloc exception, header to include for using it is <new>
+
new() or new[]() without declaration of exception cannot signal memory exhaustion.If
+
there is an option to choose between calloc/malloc/new for allocation of the memory,
+
new should be used. If new[] is used to allocate memory then delete[] should be used to
+
free the allocated memory. Using delete without [] will cause memory leak. Use try-catch
+
block with new, as it throws exception and does not return value, though it can be forced
+
to return a value by using nothrow.
+
 
+
<code>
+
using namespace std;
+
/* this should return a value */
+
alpha* pt = new (nothrow) alpha[200];
+
 
+
or it will throw bad_alloc exception which can be handled by the following code
+
class bad_alloc : public exception {
+
/* error to be thrown to be implemented here */
+
};
+
struct alpha_t{};
+
 
+
extern const alpha_t alpha;  // indicator for allocation to prevent exceptions
+
 
+
/* should throw exception */
+
int* ptr = new int[100000];
+
 
+
/* to avoid exception correct usage would be */
+
int* ptr = new(alpha) int[100000];
+
</code>
+
 
+
See [https://securityblog.redhat.com/2012/10/31/array-allocation-in-cxx/ Array allocation in C++ article] for
+
more information.
+
  
 +
For more in-depth information about Secure Boot see [[Features/SecureBoot|SecureBoot]],
 +
[http://docs.fedoraproject.org/en-US/Fedora/18/html/UEFI_Secure_Boot_Guide/chap-UEFI_Secure_Boot_Guide-What_is_Secure_Boot.html this] and
 +
[http://www.uefi.org/sites/default/files/resources/UEFI_Secure_Boot_in_Modern_Computer_Security_Solutions_2013.pdf this]
 +
articles.
  
  

Latest revision as of 12:47, 16 May 2017



By Default
Available
Unimplemented
Security Features RHEL 3 RHEL 4 RHEL 5 RHEL 6 RHEL 7 Fedora 24 Fedora 25 Rawhide
Configurable Firewall iptables iptables iptables iptables iptables firewalld firewalld firewalld
Signed updates yum yum yum yum yum yum / dnf yum / dnf yum / dnf
SELinux N Y Y Y Y Y Y Y
SELinux targeted policy N Y Y Y Y Y Y Y
SELinux Executable Memory Protection N N Y Y Y Y Y Y
Password hashing md5crypt md5crypt md5crypt sha512crypt sha512crypt sha512crypt sha512crypt sha512crypt
Filesystem Capabilities -- kernel kernel kernel kernel kernel kernel kernel
PR_SET_SECCOMP -- -- -- -- kernel kernel kernel kernel
SELinux user confinement N N Y Y Y Y Y Y
SELinux XACE N N N Y Y Y Y Y
SELinux sandbox N N N Y Y Y Y Y
SELinux Deny Ptrace N N N N Y Y Y Y
SELinux restricted module loading N N  ?  ? Y Y Y Y
User namespaces N N N N N N N N
/tmp namespace for systemd N N N N Y Y Y Y
Polyinstantiate /tmp, /var/tmp and user home folders N N N Y Y Y Y Y
Encrypted LVM  ?  ? Y Standard Installer Standard Installer Standard Installer Standard Installer Standard Installer
eCryptfs N N Y Y Y Optional Package Optional Package Optional Package
Non-Executable Memory (NX) Y (since 9/2004) Y Y Y Y Y Y Y
Built as PIE package list (since 9/2004) package list package list package list package list Y Y Y
Pointer Obfuscation N N Y Y Y glibc glibc glibc
Heap Protector N glibc glibc glibc glibc glibc glibc glibc
Built with Fortify Source N Y Y Y Y Y Y Y
Stack Protector N N Y Y Y Y Y Y
Stack ASLR Y (since 9/2004) kernel kernel kernel kernel kernel kernel kernel
Libs/mmap ASLR kernel (since 9/2004) kernel kernel kernel kernel kernel kernel kernel
Exec ASLR (since 9/2004) Y y Y Y Y Y Y
brk ASLR N N  ? Y Y Y Y Y
VDSO ASLR no vDSO kernel kernel kernel kernel kernel kernel kernel
Built with RELRO -- -- -- -- gcc patch Y Y Y
Built with BIND_NOW N  ? package list package list package list Y Y Y
/proc/$pid/maps protection -- -- -- -- kernel & sysctl kernel & sysctl kernel & sysctl kernel & sysctl
Symlink restrictions N N N N Y kernel kernel kernel
Hardlink restrictions N N N N Y kernel kernel kernel
ptrace scope N N N N N N N N
Overflow checking in new operator N N N N Y Y Y Y
Built with Format Security -- -- -- -- -- Y Y Y
Crypto Policy -- -- -- -- -- Y Y Y
Built with Stack Protector Strong -- -- -- -- -- Y Y Y
Tamper Resistant Logs N N N N Y Y Y Y
0-address protection Y (since 11/2009) Y (since 9/2009) Y (since 5/2008) Y Y Y Y Y
Block module loading Y Y Y Y Y Y Y Y
/dev/mem protection N Y Y Y Y Y Y Y
/dev/kmem disabled N Y Y Y Y Y Y Y
Module RO/NX -- -- -- -- kernel kernel kernel kernel
Kernel Address Display Restriction -- -- -- -- kernel kernel kernel kernel
Blacklist Rare Protocols Y Y Y Y Y Y Y Y
Write-protect kernel .rodata sections N N N Y Y Y Y Y
Kernel Stack Protector N N N Y Y Y Y Y
sVirt labelling N N N Y Y Y Y Y
SYN cookies  ? kernel kernel kernel kernel kernel kernel kernel
Syscall Filtering N N N  ? Y Y Y Y
Secure Boot Support N N N N Y Y Y Y

Contents

Configuration

Configurable Firewall

firewalld provides a dynamically managed firewall with support for network/firewall zones to define the trust level of network. The former firewall model with system-config-firewall/lokkit was static and every change required a complete firewall restart. The firewall daemon on the other hand manages the firewall dynamically and applies changes without restarting the whole firewall. See FirewallD and system-config-firewall for more information.


Signed updates

Each stable RPM package that is published by Fedora Project is signed with a GPG signature. By default, DNF, YUM and the graphical update tools will verify these signatures and refuse to install any packages that are not signed or have bad signatures. You should always verify the signature of a package before you install it. These signatures ensure that the packages you install are what was produced by the Fedora Project and have not been altered (accidentally or maliciously) by any mirror or website that is providing the packages. See this page for more information. [MOVE] We use a number of GPG keys to sign our software packages. The necessary public keys are included in the relevant products and are used to automatically verify software updates. See this page for more information.


SELinux

SELinux is an inode-based MAC. See this page and this page for more information.


SELinux targeted policy

SELinux enabled with targeted policy by default. See discussion of policies page and this page for more information.


SELinux Executable Memory Protection

SELinux restricts certain memory protection operation if the appropriate boolean values enable these checks. See this page for more information.


Password hashing

The system password used for logging into Fedora is stored in /etc/shadow. Very old style password hashes were based on DES and visible in /etc/passwd. Modern Linux has long since moved to /etc/shadow, and for some time now has used salted MD5-based hashes for password verification (crypt id 1). Since MD5 is considered "broken" for some uses and as computational power available to perform brute-forcing of MD5 increases, modern Fedora versions have proactively moved to using salted SHA-512 based password hashes (crypt id 6), which are orders of magnitude more difficult to brute-force. See the crypt(3) manpage for additional details.


Subsystems

Filesystem Capabilities

The need for setuid applications can be reduced via the application of filesystem capabilities using the xattrs available to most modern filesystems. This reduces the possible misuse of vulnerable setuid applications. The kernel provides the support and the user-space tools are available in the libcap package.


PR_SET_SECCOMP

Setting SECCOMP(SECure COMPuting) for a process is meant to confine it to a small subsystem of system calls, used for specialized processing-only programs. See this article and SECCOMP article for more information.


Mandatory Access Control (MAC)

Mandatory Access Controls specifies which subject can access specific data. Mandatory Access Controls are handled via the kernel LSM(Linux Security Modules) hooks. MAC is based on the security labels. Data on the system has clearance and classification data stored with security labels, which can be accessed by specific subjects or objects.When some subject tries to access the data on the system then the rules defined by the policy are checked to take access control decision.Security Levels are classified like Unclassified -> Confidential -> Secret -> Top Secret.If user has clearance to access the requested object then user will be allowed otherwise user will be denied access. It is a system wide policy which states that who is allowed to access, an individual user cannot alter the access. MAC model is mostly used in environment where confidentiality is important like in Government organizations like military, an example of widely used of MAC is SELinux.Security-Enhanced Linux (SELinux) employs MAC rules to facilitate fine-grained security.

see MAC


SELinux user confinement

Support for SELinux to confine users access on a system. Each Linux user is mapped to an SELinux user via SELinux policy, allowing Linux users to inherit the restrictions placed on SELinux users, for example (depending on the user), not being able to: run the X Window System; use networking; run setuid applications (unless SELinux policy permits it); or run the su and sudo commands

# semanage login -l

Login Name           SELinux User         MLS/MCS Range        Service

__default__          unconfined_u         s0-s0:c0.c1023       *
root                 unconfined_u         s0-s0:c0.c1023       *
system_u             system_u             s0-s0:c0.c1023       *

All the linux users are mapped to __default__ which maps to unconfined_u user. SELinux users that are available are guest_u, xguest_u, user_u, staff_u.

# ls /etc/selinux/targeted/contexts/users
guest_u  root  staff_u  sysadm_u  unconfined_u  user_u  xguest_u

# ls /etc/selinux/mls/contexts/users
guest_u  root  staff_u  unconfined_u  user_u  xguest_u

* sysadm_u is not present in MLS Policy

As listed http://docs.fedoraproject.org/en-US/Fedora/13/html/Security-Enhanced_Linux/sect-Security-Enhanced_Linux-Targeted_Policy-Confined_and_Unconfined_Users.html

User Domain X Window System su and sudo Execute in home directory and /tmp/ Networking
guest_u guest_t no no no optional no
xguest_u xguest_t yes no optional only Firefox
user_u user_t yes no optional yes
staff_u staff_t yes only sudo optional yes

Users are defined in /etc/selinux/<target or mls>/contexts/users.

See Confined and Unconfined Users article for more information.


SELinux XACE

SELinux X Access Control Extension (XACE) aims at extending SELinux to X.org system, to provide flexible fine-grained MAC to the desktop.


SELinux sandbox

Support for SELinux to test untrusted content via a sandbox. See this page and this page for more information.


SELinux Deny Ptrace

A boolean variable to allow SELinux to turn off all processes ability to ptrace other process. See this page and this for more information.


SELinux restricted module loading

Support for SELinux to restrict the loading of kernel modules by unprivileged processes in confined domains was implemented in this commit.


User namespaces

User namespaces allow per-namespace mappings of user and group IDs. This means that a process' user and group IDs inside a user namespace can be different from its IDs outside of the namespace. Most notably, a process can have a nonzero user ID outside a namespace while at the same time having a user ID of zero inside the namespace; in other words, the process is unprivileged for operations outside the user namespace but has root privileges inside the namespace. See this page and this page for more information. See this bug to track this feature.


/tmp namespace for systemd

Run some services started by systemd with a private /tmp directory. This would mitigate the chance of a service making a mistake with how it handles its /tmp data allowing a user on the system to get a privilege escalation, since users would not have access to the services /tmp directory.

See this page for more information.


Polyinstantiate /tmp, /var/tmp and user home folders

To protect the world writable shared folders like /tmp and /var/tmp PAM (Pluggable Authentication Modules) can help by creating namespace for users on the system. Security of a system works at different layers, Polyinstantiating these world writable folders add an extra layer to protect from further intrusion into the system. Polyinstanting means that a new instance of /tmp or /var/tmp directory is created for each user. This feature is implemented using pam_namespace.so. To enable this feature :

uncomment the respective lines in /etc/security/namespace.conf

#/tmp     /tmp-inst/            level      root,adm
#/var/tmp /var/tmp/tmp-inst/    level      root,adm
# Remove the line below if required to polyinstantiate HOME directory of the user
#$HOME    $HOME/$USER.inst/     level

add

 session    required     pam_namespace.so 

to /etc/pam.d/login. File /etc/security/namespace.conf specifies which directories will be polyinstantiated. It also specifies how they will be polyinstantiated , what will the names of the directories which will be polyinstantiated and also for users where Polyinstantiation would not be performed.

create the directories and set selinux context and bool value to polyinstantiate

# mkdir /tmp-inst /var/tmp-inst
# chmod 000 /tmp-inst
# chmod 000 /var/tmp-inst
# chcon -R -t tmp_t /tmp-inst
# chcon -R -t tmp_t /var/tmp-inst
# setsebool polyinstantiation_enabled 1
  • $ man 8 pam_namespace
  • $ man 5 namespace.conf

As per reference https://www.ibm.com/developerworks/library/l-polyinstantiation/

Polyinstantiation of world-writeable directories prevents the following types of attacks:

  • Race-condition attacks with symbolic links
  • Exposing a file name considered secret information or useful to an attacker
  • Attacks by one user on another user
  • Attacks by a user on a daemon
  • Attacks by a non-root daemon on a user

However, polyinstantiation does NOT prevent these types of attacks:

  • Attacks by a root daemon on a user
  • Attacks by root (account or escalated privilege) on any user

see Polyinstantiation of directories in an SE Linux system Improve security with polyinstantiation


Filesystem encryption

Encrypted LVM

Modern Fedora versions include the ability to install Fedora onto an encrypted LVM, which allows all partitions in the logical volume, including swap, to be encrypted. LVM uses LUKS encryption (Linux Unified Key Setup). Except the boot partition All Other partitions can be encrypted. As the Linux Kernel modules reside on root partition so they are also protected if Encryption is applied. With the use of LVM Encryption user can just encrypt Physical Volume where other partitions reside making encryption and decryption much faster. LVM is created under big encrypted blockdevice which hides the LVM until blockdevice is unecrypted. Once the blockdevice is unencrypted it reads the volume structure and mounts all the detected partitions at boot time. https://code.google.com/p/cryptsetup/


eCryptfs

eCryptfs (Enterprise cryptographic Filesystem) is a cryptographic stacked Linux filesystem. eCryptfs stores cryptographic metadata in the header of each file written, so that encrypted files can be copied between hosts; the file will be decrypted with the proper key in the Linux kernel keyring. It has been there since Kernel 2.6.19. It works at filesystem-level, so this type of encryption can be applied to specific folders/directories as needed after creation of Filesystem.

See eCryptfs homepage and eCryptfs Article for more details.


Userspace Hardening

Many security features are available through the default compiler flags used to build packages and through the kernel in Fedora.


Non-Executable Memory (NX)

Modern processors support a feature called NX which allows a system to control the execution of various portions of memory. Data memory is flagged as non-executable and program memory is flagged as non-writeable. This helps prevent certain types of buffer overflow exploits from working as expected. Most modern CPUs protect against executing non-executable memory regions (heap, stack, etc). Since not all processors support the NX feature, attempts have been made to support this feature via segment limits. A segment limit will prevent certain portions of memory from being executed. This provides very similar functionality to NX technology. After booting, you can see what NX protection is in effect:

  • Hardware-based (via PAE mode):
    • [ 0.000000] NX (Execute Disable) protection: active
  • Partial Emulation (via segment limits):
    • [ 0.000000] Using x86 segment limits to approximate NX protection

For more information, see Security Features page.


Built as PIE

All programs built as Position Independent Executables (PIE) with "-fPIE -pie" can take advantage of the exec ASLR. This protects against "return-to-text" and generally frustrates memory corruption attacks. This requires centralized changes to the compiler options when building the entire archive. PIE has a large (5-10%) performance penalty on architectures with small numbers of general registers (e.g. x86), so it should only be used for a select number of security-critical packages. PIE on x86_64 does not have the same penalties, and will eventually be made the default, but more testing is required. See this paper and this FESCo ticket for more information.

In Fedora 23 and later, all packages are built with PIE and Full RELRO. See this page for details.


Pointer Obfuscation

Some pointers stored in glibc are obfuscated via PTR_MANGLE/PTR_UNMANGLE macros internally in glibc, preventing libc function pointers from being overwritten during runtime.


Heap Protector

The GNU C Library heap protector (both automatic via ptmalloc and manual) provides corrupted-list/unlink/double-free/overflow protections to the glibc heap memory manager (first introduced in glibc 2.3.4). This stops the ability to perform arbitrary code execution via heap memory overflows that try to corrupt the control structures of the malloc heap memory areas. This protection has evolved over time, adding more and more protections as additional corner-cases were researched. As it currently stands, glibc 2.10 and later appears to successfully resist even these hard-to-hit conditions. See this page for more details.


Built with Fortify Source

Programs built with "-D_FORTIFY_SOURCE=2" (and -O1 or higher), enable several compile-time and run-time protections in glibc:

  • expand unbounded calls to "sprintf", "strcpy" into their "n" length-limited cousins when the size of a destination buffer is known (protects against memory overflows).
  • stop format string "%n" attacks when the format string is in a writable memory segment.
  • require checking various important function return codes and arguments (e.g. system, write, open).
  • require explicit file mask when creating new files.

-D_FORTIFY_SOURCE=2 also protects C++ code. See this page for more information.


Stack Protector

gcc's -fstack-protector provides a randomized stack canary that protects against stack overflows, and reduces the chances of arbitrary code execution via controlling return address destinations. Enabled at compile-time. The routines used for stack checking are actually part of glibc, but gcc is patched to enable linking against those routines by default. See this page for more information.


Address Space Layout Randomization (ASLR)

ASLR is implemented by the kernel and the ELF loader by randomizing the location of memory allocations (stack, heap, shared libraries, etc). This makes memory addresses harder to predict when an attacker is attempting a memory-corruption exploit. ASLR is controlled system-wide by the value of /proc/sys/kernel/randomize_va_space.

  • 0 - Turn ASLR off.
  • 1 - Make the addresses of mmap(2) allocations, the stack, loaded shared libraries and the VDSO page randomized.
  • 2 - Also support heap randomization in additon.

Even when randomize_va_space is set to 2, the text segment of binaries is loaded at a static address. To make ASLR effective all segments must be randomized. Leaving the text segment loading address non-randomized reduces the protection provided by the ASLR since the attackers can use ret2text attacks. The loading address of the text segement in a binary can be randomized by building the binary as PIE (Position Independent Executable).

See this article and this article for more information.


Stack ASLR

Each execution of a program results in a different stack memory space layout. This makes it harder to locate in memory where to attack or deliver an executable attack payload. This feature has been available in the mainline kernel since 2.6.15.


Libs/mmap ASLR

Each execution of a program results in a different mmap memory space layout. This causes the dynamically loaded libraries to get loaded into different locations each time. This makes it harder to locate in memory where to jump to for "return to libc" to similar attacks. This was available in the mainline kernel since 2.6.15.


Exec ASLR

Each execution of a program that has been built with "-fPIE -pie" will get loaded into a different memory location. This makes it harder to locate in memory where to attack or jump to when performing memory-corruption-based attacks. This was available in the mainline kernel since 2.6.25.


brk ASLR

Similar to exec ASLR, brk ASLR adjusts the memory locations relative between the exec memory area and the brk memory area (for small mallocs). The randomization of brk offset from exec memory was added in 2.6.22.


VDSO ASLR

Each execution of a program results in a random vdso location. This has existed in the mainline kernel since 2.6.18 (x86, PPC) and 2.6.22 (x86_64). People needing ancient pre-libc6 static high vdso mappings can use "vdso=2" on the kernel boot command line to gain COMPAT_VDSO again. See this article for more information.


Built with RELRO

RELRO stands for RELocation Read-Only, it is a mitigation technique to harden data sections of an ELF/process. It is used to move commonly exploited structures in ELF binary to a read-only location. It Hardens ELF programs against loader memory area overwrites by having the loader mark any areas of the relocation table as read-only for any symbols resolved at load-time ("read-only relocations"). This reduces the area of possible GOT-overwrite-style memory corruption attacks, specially the GOT is made read-only after relocation by the dynamic linker.

RELRO can be classified into:

Partial RELRO

  • Compilation: gcc -Wl,-z,relro
  • ELF sections are reordered, so that ELF internal data sections (.got, .dtors, etc) precede the program's data sections (.data and .bss)
  • non-PLT GOT is read-only
  • GOT is writable

Full RELRO

  • compilation: gcc -Wl,-z,relro,-z,now
  • Supports all the features of partial RELRO
  • In addition , GOT is also remapped as read-only

In case of a bss or data overflow bug both partial and full RELRO can protect the ELF internal data sections from being overwritten. With full RELRO a working mitigation technique to successfully prevent the modification of GOT entries is available. Full RELRO has been enabled for all packages in Fedora 23 and later.

In short, RELRO hardens ELF programs against loader memory area overwrites by having the loader mark any areas of the relocation table as read-only for any symbols resolved at load-time ("read-only relocations"). This reduces the area of possible GOT-overwrite-style memory corruption attacks.

This information has been borrowed from this article.


Built with BIND_NOW

Marks ELF programs to resolve all dynamic symbols at start-up (instead of on-demand, also known as "immediate binding") so that the GOT can be made entirely read-only (when combined with RELRO above).


/proc/$pid/maps protection

With ASLR, a process's memory space layout suddenly becomes valuable to attackers. The "maps" file is made read-only except to the process itself or the owner of the process. Went into mainline kernel with sysctl toggle in 2.6.22. The toggle was made non-optional in 2.6.27, forcing the privacy to be enabled regardless of sysctl settings (this is a good thing).

Symlink restrictions

A long-standing class of security issues is the symlink-based ToCToU race, most commonly seen in world-writable directories like /tmp/. The common method of exploitation of this flaw is crossing privilege boundaries when following a given symlink (i.e. a root user follows a symlink belonging to another user).

In modern Fedora version, symlinks in world-writable sticky directories (e.g. /tmp) cannot be followed if the follower and directory owner do not match the symlink owner. The behavior is controllable through the /proc/sys/kernel/yama/protected_sticky_symlinks sysctl.


Hardlink restrictions

Hardlinks can be abused in a similar fashion to symlinks above, but they are not limited to world-writable directories. If /etc/ and /home/ are on the same partition, a regular user can create a hardlink to /etc/shadow in their home directory. While it retains the original owner and permissions, it is possible for privileged programs that are otherwise symlink-safe to mistakenly access the file through its hardlink. Additionally, a very minor untraceable quota-bypassing local denial of service is possible by an attacker exhausting disk space by filling a world-writable directory with hardlinks.

In modern Fedora versions, hardlinks cannot be created to files that the user would be unable to read and write originally, or are otherwise sensitive.


ptrace scope

A troubling weakness of the Linux process interfaces is that a single user is able to examine the memory and running state of any of their processes. For example, if one application was compromised, it would be possible for an attacker to attach to other running processes (e.g. SSH sessions, GPG agent, etc) to extract additional credentials and continue to immediately expand the scope of their attack without resorting to user-assisted phishing or trojans. It is provided by YAMA , can be enabled by CONFIG_SECURITY_YAMA in the kernel.

Independent of this configuration, processes that know they store secrets in memory may already use prctl(PR_SET_DUMPABLE,0); to prevent ptrace and other memory-snooping attacks.


Overflow checking in new operator

GCC performs overflow checking in operator new[]. new operator is used to dynamically allocate memory.It throws bad_alloc exception, header to include for using it is <new> new() or new[]() without declaration of exception cannot signal memory exhaustion.If there is an option to choose between calloc/malloc/new for allocation of the memory, new should be used. If new[] is used to allocate memory then delete[] should be used to free the allocated memory. Using delete without [] will cause memory leak. Use try-catch block with new, as it throws exception and does not return value, though it can be forced to return a value by using nothrow.

 using namespace std;
 /* this should return a value */
 alpha* pt = new (nothrow) alpha[200];

 or it will throw bad_alloc exception which can be handled by the following code
 class bad_alloc : public exception {
 /* error to be thrown to be implemented here */
 };
 struct alpha_t{};

 extern const alpha_t alpha;  // indicator for allocation to prevent exceptions

 /* should throw exception */
 int* ptr = new int[100000];

 /* to avoid exception correct usage would be */
 int* ptr = new(alpha) int[100000];

See Array allocation in C++ article for more information.


Built with Format Security

Enable "-Werror=format-security" compilation flag for all packages in Fedora. Once this flag is enabled, GCC will refuse to compile code that could be vulnerable to a string format security flaw. see Format Security for more information


Crypto Policy

Unify the crypto policies used by different applications and libraries. That is allow setting a consistent security level for crypto on all applications in a Fedora system. The implementation approach will be to initially modify SSL libraries to respect the policy and gradually adding more libraries and applications. See Crypto Policy for more information.


Built with Stack Protector Strong

See "Strong" stack protection for GCC article for more information.


Tamper Resistant Logs

When a system is compromised, attackers might tamper the system logs. This can be prevented by using FSS (Forward Secure Sealing) which is implemented in the systemd journal. Binary logs maintained by systemd are sealed at certain time intervals. Sealing is an cryptographic operation on the logs so that any tempering on the logs can be detected, though an attacker can completely remove entire logs but this is likely to get noticed by the system administrator.

See Forward Secure Sealing (FSS) article for more information.


Kernel Hardening

The kernel itself has protections enabled to make it more difficult to become compromised.

0-address protection

Since the kernel and userspace share virtual memory addresses, the "NULL" memory space needs to be protected so that userspace mmap'd memory cannot start at address 0, stopping "NULL dereference" kernel attacks. This is possible with 2.6.22 kernels, and was implemented with the "mmap_min_addr" sysctl setting. See this article for more information.


Block module loading

It is possible to remove CAP_SYS_MODULES from the system-wide capability bounding set , which would stop any new kernel modules from being loaded. This was another layer of protection to stop kernel rootkits from being installed. This feature to block module loading can be enabled setting 1 in /proc/sys/kernel/modules_disabled.


/dev/mem protection

Some applications (Xorg) need direct access to the physical memory from user-space. The special file /dev/mem exists to provide this access. In the past, it was possible to view and change kernel memory from this file if an attacker had root access. See this page and this page for details.


/dev/kmem disabled

There is no modern user of /dev/kmem any more beyond attackers using it to load kernel rootkits. CONFIG_DEVKMEM is set to n.


Module RO/NX

This feature extends CONFIG_DEBUG_RODATA to include similar restrictions for loaded modules in the kernel. This can help resist future kernel exploits that depend on various memory regions in loaded modules. Enabled via the CONFIG_DEBUG_SET_MODULE_RONX option.


Kernel Address Display Restriction

When attackers try to develop run anywhere exploits for kernel vulnerabilities, they frequently need to know the location of internal kernel structures. By treating kernel addresses as sensitive information, those locations are not visible to regular local users. /proc/sys/kernel/kptr_restrict is set to 1 to block the reporting of known kernel address leaks. Additionally, various files and directories were made readable only by the root user: /boot/vmlinuz, /boot/System.map, /sys/kernel/debug/, /proc/slabinfo.


Blacklist Rare Protocols

Normally the kernel allows all network protocols to be autoloaded on demand. Many of these protocols are old, rare, or generally of little use to the average Fedora user and may contain undiscovered exploitable vulnerabilities. These include: ax25, netrom, x25, rose, decnet, econet, rds, and af_802154. If any of the protocols are needed, they can speficially loaded via modprobe, or the /etc/modprobe.d/blacklist-rare-network.conf file can be updated to remove the blacklist entry. A FESCo proposal to do this for Fedora is in progress.


Write-protect kernel .rodata sections

Enabled write-protection for kernel read-only data structures by default. See this commit for details. This makes sure that certain kernel data sections are marked to block modification. This helps protect against some classes of kernel rootkits. Enabled via the CONFIG_DEBUG_RODATA option.


Kernel Stack Protector

Similar to the stack protector used for ELF programs in userspace, the kernel can protect its internal stacks as well. This feature is enabled via the CONFIG_CC_STACKPROTECTOR option.

See commits 1, 2 and 3 for more details.


sVirt labelling

Support for sVirt labelling to provide security over guest instances. See this page for more information.


SYN cookies

When a system is overwhelmed by new network connections, SYN cookie use is activated, which helps mitigate a SYN-flood attack. This feature can be controlled by /proc/sys/net/ipv4/tcp_syncookies file.


Syscall Filtering

Programs can filter out the availability of kernel syscalls by using the seccomp_filter interface. This is done in containers or sandboxes that want to further limit the exposure to kernel interfaces when potentially running untrusted software.


Secure Boot Support

"Secure Boot" describes a UEFI feature by which malware is prevented from inserting itself into the boot process before the operating system loads.

For more in-depth information about Secure Boot see SecureBoot, this and this articles.


Additional Documentation