Using the Kernel Security Module Interface
This example shows how powerful and simple the LSM interface can be. With one hook, any program with the root group ID is prevented from running unless a device is physically present in the system.
Using this code, if the device is not present, users are not allowed to log in to the console, as mingetty traditionally runs as root. But users can log in through SSH as normal users, as sshd already was running before the device was removed. Web pages also can be served, and other services that do not run as root (your mail server, database server, etc.) also will function properly. If one of these server programs were broken into, and they tried to spawn a root shell, that root shell would not be allowed to run.
This module does not prevent any program already running as root from cloning itself, or keep a program from trying to change the privileges that are currently assigned to it. To check for these things, the task_* functions in the security_operations structure should be used. The implementation of these functions will be much like the bprm_check_security function, but the parameters passed to the function will be different, so the egid will need to be determined differently.
There are probably other methods of taking an existing running program and spawning a root process that this module does not catch. Please do not use it in a production environment, but rather as a learning exercise for how to create other LSM example code.
I would like to thank Chris Wright, Stephen Smalley, James Morris and all of the other programmers who helped create the LSM interface and get it accepted into the main kernel tree. Due to their hard work, Linux now has a flexible security model that will give everyday users the ability to have access to different security models with little effort. I also would like to thank Alan Cox for the initial idea that spawned this example.
For more information about the LSM Project, the development mailing list, documentation and patches for different kernel versions, please see the web site at lsm.immunix.org.
- Readers' Choice Awards 2013
- Mars Needs Women
- IBM Will Minimize Impact of Future Disasters
- Sublime Text: One Editor to Rule Them All?
- December 2013 Issue of Linux Journal: Readers' Choice
- Raspberry Pi: the Perfect Home Server
- RSS Feeds
- Tech Tip: Really Simple HTTP Server with Python
- Linux Systems Administrator
- Web Administration Scripts
- Nothing is perfect
1 min 16 sec ago
- Mixtapes Community
5 hours 40 min ago
- KDE is one true DE
6 hours 14 min ago
- Command Line Shells (Bash, Zsh, etc.) are 2nd place
6 hours 43 min ago
8 hours 38 min ago
- yes it's Jupiter Broadcasting
9 hours 57 min ago
- nice to see PClinuxOS finally
12 hours 31 min ago
- Personally, I am no longer a
13 hours 27 min ago
- It's Jupiter
1 day 3 hours ago
- GIMP is certainly a graphic
1 day 4 hours ago