User: Password:
|
|
Subscribe / Log in / New account

How The Linux Foundation and Fedora are Addressing Workstation Security (Linux.com)

How The Linux Foundation and Fedora are Addressing Workstation Security (Linux.com)

Posted Feb 15, 2013 19:37 UTC (Fri) by spender (subscriber, #23067)
In reply to: How The Linux Foundation and Fedora are Addressing Workstation Security (Linux.com) by nix
Parent article: How The Linux Foundation and Fedora are Addressing Workstation Security (Linux.com)

Hi Nix!

This is the great thing about open source software -- if you don't like me, you're free to do my work yourself or get the same work from someone else.

Except for that little minor detail that the former will never happen and the latter doesn't exist. Like it or not, we're the only ones that care enough to have spent over a decade on the large security problems, despite the generally unappreciative Linux userbase.

We will continue to do worthwhile work while criticizing from the outside; I'm sure you'll likewise continue to complain about the way in which free code is given to you without accomplishing anything constructive in the process.

My responsibility is only to my own users. If you feel so strongly about this issue, why don't you spend all your free time like I do to do something about it other than complain?

Thanks,
-Brad


(Log in to post comments)

How The Linux Foundation and Fedora are Addressing Workstation Security (Linux.com)

Posted Feb 15, 2013 19:57 UTC (Fri) by patrick_g (subscriber, #44470) [Link]

> We will continue to do worthwhile work

It could be much more useful if you try to integrate mainline. At the moment very few people are using Grsecurity kernels. If you accept some compromises and try to work with other kernel hackers, your valuable work will be used by millions and millions of people.

How The Linux Foundation and Fedora are Addressing Workstation Security (Linux.com)

Posted Feb 16, 2013 1:37 UTC (Sat) by bojan (subscriber, #14302) [Link]

+1

Brad,

Trading insults on LWN may be fun, but given than you seem to care about security, open source, Linux kernel and users, doing the above would be a lot more useful. I would surely appreciate knowing that my latest stock kernel of my fav distros is as good as it can possibly be security wise.

Unfortunately, you should not expect that everyone's a genius when it comes to security. Most people are average or thereabouts, yours truly included. If I was able to get my shitty contribution into kernel proper, I am sure it should be possible for you as well. Patience, will to compromise and listening to points of view of others will be required, however.

How The Linux Foundation and Fedora are Addressing Workstation Security (Linux.com)

Posted Feb 16, 2013 23:08 UTC (Sat) by spender (subscriber, #23067) [Link]

We've addressed this several times in different places, including:
https://lwn.net/Articles/315164/
http://unix.stackexchange.com/questions/59020/why-are-the...

Read those first. This is the post I'll link to for similar questions in the future.

People who suggest what patrick_g have suggested are generally ignorant of our history and what we've done, and honestly I find the constant suggestions (even if good-intentioned) from people who don't contribute to furthering security or to our project in any way pretty tiresome and rude.

Both the PaX Team and myself do this work in our own free time. It already uses up more of my time than I'm comfortable with. Where do you propose this additional time come from to do the things you suggest? Take note that that additional time isn't a one-time cost, it would be a cost any time we want to push any additions or changes. It would still be a cost to us every time the kernel is updated. If you think otherwise, ask who is currently ensuring that kptr_restrict in the upstream kernel does what it claims?

The only work that interests me is dealing with the unsolved, difficult security problems. I don't want to spend my time playing politics. I paid out of my own pocket in 2010 to attend the Linux Security Summit and present on what the current state of security was in grsecurity and suggesting ways Linux could harden the kernel in the next decade (judging by how long it takes to rip off our features). Do you know how many major kernel developers attended the summit? None! They were all busy in their own non-security subgroups. It was overall an SELinux circlejerk and a waste of time (other than convincing Kees Cook apparently).

What has been suggested was already attempted by Vasiliy Kulikov during the 2011 GSOC. Here were the results:
http://openwall.info/wiki/Owl/kernel-hardening
What got merged upstream as a result of this?
A variant of /proc restrictions from Openwall and grsec (but without my additional changes).
Openwall's HARDEN_SHM as an optional sysctl.

Dan Rosenberg got Openwall's dmesg restriction merged upstream and attempted to get grsecurity's HIDESYM feature merged upstream. While the dmesg feature is complete (not difficult as it's only a single line of code basically) the HIDESYM feature is woefully incomplete and thus quite useless. None of the kernel developers nor Dan himself care to update it so that it does what it claims.

Seriously, this is all! How much time was wasted on all this? Over 600 emails were ultimately sent on the kernel-hardening list alone for this:
http://www.openwall.com/lists/kernel-hardening/

What have other people done in this area? Ubuntu's kernel hardening roadmap is nearly completely Openwall/grsecurity ripoffs:
https://wiki.ubuntu.com/SecurityTeam/Roadmap/KernelHardening
It hasn't been updated in nearly a year, unsurprisingly not long after Kees Cook left Canonical for Google.

In September, 2012 a "Linux security workgroup" was formed:
http://www.openwall.com/lists/kernel-hardening/2012/09/24/1
They have yet to accomplish anything AFAIK.

I don't believe in wasting time on these top-down exercises, where we build some organization or framework with the expectation that the actual useful people or code will just fall into place. It's almost always a failure. Instead I've put my focus on actually creating things. During the same timeframe as above (2011 to now), what have I alone accomplished?

See http://grsecurity.net/the_case_for_grsecurity.pdf slide 15 onward

Bruteforce deterrence for suid/sgid binaries
Preventing module auto-loading by unprivileged users
Enforcing that only filesystem modules can be loaded via mount
Banning an unprivileged user until reboot if he/she causes a detected kernel corruption
Whitelisting specific slab caches when doing copies between userland and the kernel. A copy_from_user could not be abused, for instance, to perform a copy directly into a task struct now.
Disallowed ptracing unreadable binaries
A multithreaded app's change from uid 0 to non-0 will be shared among all threads. Glibc already does this in userland, but other libcs/languages do not.
Race-free implementation of Apache's SymlinksIfOwnerMatch
Prevented suid apps from being able to have alternate memory layouts
Reduced ability to lessen stack entropy for suid apps
Implemented a special ID to protect various /proc entries against future /proc/pid/mem-style vulnerabilities
Automatically protected /proc entries and other seq_file users against kernel address leakage.
Prevented infoleaking of write timings against block/character devices
Killed reliable technique of overwriting another thread's userland stack due to distros not enabling -fstack-check on network services
Protected the BPF JIT against use for in-kernel arbitrary code execution
Implemented PXN support on ARM with VMSAv7, LPAE on or off
Implemented PAX_KERNEXEC on ARM LPAE
Implemented PAX_KERNEXEC/PAX_UDEREF on ARMv6+

We'd need a couple more pages to list what the PaX Team has accomplished in the same time-frame. The "toolchain support" section of http://pax.grsecurity.net/docs/PaXTeam-LATINOWARE12-PaX-l...
lists just some of these.

Now that the general ignorance has been laid bare, do you really want to demand that I waste the time I currently spend creating the above and put it toward fighting with Linus and others to get a measly percentage of these previous improvements merged upstream? It's telling really that on this site, people want to complain to or insult the messenger instead of asking questions and learning something about how security can be improved.

In 2008, we made the case (and proved really, it's not up for debate at this point) that the upstream developers were intentionally covering up security vulnerabilities and that this was harmful for Linux as a whole. The overwhelming response to Linus covering up security vulnerabilities was: "Yes, and?".

In recent news, this has screwed over Linux users yet again with the publication of CVE-2013-0871: http://seclists.org/oss-sec/2013/q1/326. The vulnerability was reported to security@ last month and yet across the board there is not a single vendor report or fix. This despite a Red Hat employee committing the fix. I however spotted the fix last month and backported it, as it matched the model I joked about in my H2HC presentation as a way to find silent upstream vuln fixes. Solar Designer's comments in the reply raise some serious questions that people should be asking. If history is any judge, though, they won't, and the status-quo will continue.

The majority of Linux users apparently are happy with the constant cycle of updates, bugfixing as the way to security, the "a bug is a bug" mantra, the appeal-to-authority SELinux, and other associated snake-oil and bad security advice. I'm no longer interested in helping these people; I believe in a security meritocracy. I'm not going to change the minds of users in general who aren't receptive to new ideas. For them, there's an entire parasitic security industry of AV/IDS/IPS/"Cloud" vendors who would be happy to take their money and make them feel good about it.

As I said before, this problem is not about us: it's about you and the rest of the Linux community. What are you doing to push for change from the status-quo? What are you doing to improve security and how it's handled? What are you doing to extend our work? What are you doing to support our work and make our efforts easier?

-Brad

How The Linux Foundation and Fedora are Addressing Workstation Security (Linux.com)

Posted Feb 17, 2013 20:45 UTC (Sun) by bojan (subscriber, #14302) [Link]

Let me start by something that I find mostly irrelevant, which is about what I can do. Well, the only thing I can do, I'm pretty much doing here. Essentially, there are people that keep coming up with ways to subvert the kernel, who at the same time claim to have a systematic way of preventing that, while keeping the kernel just as usable (this is how I understand what you claim to have). I would like to have this in my stock kernel.

You keep repeating the history. The only thing this will tell you is what not to do. It is otherwise mostly irrelevant. Also, as a side note, pointing fingers and blaming people (especially saying that everything is 100% someone else's fault in an argument) is simply counter productive.

Now to the real issue. You ask:

> Both the PaX Team and myself do this work in our own free time. It already uses up more of my time than I'm comfortable with. Where do you propose this additional time come from to do the things you suggest?

I propose you spend none of your free time on this. Zero. I propose you get paid to do this. And well.

Linux is a multi billion dollar business. If you can show to any of the companies that are involved (Google, Red Hat, Oracle, Samsung, etc.) that they can sell what you have, they will buy it.

So, in a nutshell: you need to sell it.

Doing things the old "I'm a volunteer who pays my own way to a conference" way isn't going to do it. You should stop fighting "them" and become one of "them" - and get paid for it.

So, when you rock up at a conference (at company expense) and present your work (which has been shipping in a supported product people paid money for), others may listen more closely.

At least there is no downside for you - you would get paid doing what you obviously love doing anyway. And you would have a greater number of users who appreciate your work.

How The Linux Foundation and Fedora are Addressing Workstation Security (Linux.com)

Posted Feb 18, 2013 3:48 UTC (Mon) by clopez (subscriber, #66009) [Link]

I only can agree with you.

What strikes me is why Spender was unable yet to get a well-paid full-time job for hacking on grsecurity.

Isn't any of the big Linux distributions focused on the server market (RedHat/SUSE/Oracle/Ubuntu..) interested in shipping hardened kernels? Aren't their customers demanding this? Why?

Is just because they think that with the linux LSMs (SELinux/Apparmor/etc..) is enough?

How The Linux Foundation and Fedora are Addressing Workstation Security (Linux.com)

Posted Feb 18, 2013 6:10 UTC (Mon) by px43 (guest, #89407) [Link]

I'm pretty sure spender doesn't work on grsec professionally for the same reason that Linus doesn't work on Linux professionally. If he had to declare loyalty to one company, it would create a conflict of interest. I'm sure any of those places would hire him in a heartbeat if he actually showed any interest. We really do need people like him though, not worrying about politics and doing the shit that needs to be done. Others like bliss and kees can do the rest and work on getting things upstreamed :-)

How The Linux Foundation and Fedora are Addressing Workstation Security (Linux.com)

Posted Feb 18, 2013 6:26 UTC (Mon) by dlang (subscriber, #313) [Link]

> ..for the same reason that Linus doesn't work on Linux professionally.

Umm, Linus does work on Linux as his full-time paid job, he has for quite a few years.

He avoided working at any distro, but he is one of several people who are paid by the Linux Foundation to work on Linux full-time.

creating fixes that almost nobody runs isn't a very effective thing to be doing. if they produced 1/10 as many fixes, but those fixes got into the upstream kernel their effect on the world would be much larger.

The problem is that they want to just say "security says we need to do this" and have whatever they have provided accepted.

the kernel people want to understand what the problem is, look at the impact of doing things, and try to find a solution that both solves the problem and doesn't hurt performance. That's not what Spender and Paxteam want, they seem to want people to accept and run whatever they provide.

There are other developers who work this way, and a few of them do have an impact (Theo, djb, and Jörg Schilling are three examples), but they end up fading from relevance over time as other people who work better with others are more effective.

How The Linux Foundation and Fedora are Addressing Workstation Security (Linux.com)

Posted Feb 18, 2013 7:32 UTC (Mon) by imitev (guest, #60045) [Link]

> the kernel people want to understand what the problem is, look at the impact of doing things, and try to find a solution that both solves the problem and doesn't hurt performance.

My feeling with kernel security is that performance and compatibility with broken stuff gets the priority over security. LWN's fine editors have been outlining the lack of focus on security - albeit with diplomacy and subtlety - for quite some time, so it's not just me.

grsecurity is GPL, so the personality of developers isn't relevant: whatever they think of Spender's behavior, any of the kernel people you mention could rip and push gresecurity solutions/concepts upstream. But this doesn't happen. So 1/ either kernel people who have enough "power" to push for such changes are not interested in security, or 2/ they won't look at spender's work just because they don't like him, or 3/ grsecurity features are useless. Kernel devs are not in kindergarten and if we assume that security-conscious companies who use grsecurity know what they are doing, that leaves us with 1/

How The Linux Foundation and Fedora are Addressing Workstation Security (Linux.com)

Posted Feb 18, 2013 7:56 UTC (Mon) by dlang (subscriber, #313) [Link]

Well, he would have to make a case that he needed to be paid by them.

And as part of the application, he would need to show that he can work with the community, which would be a fairly hard thing to do given his current attitude

How The Linux Foundation and Fedora are Addressing Workstation Security (Linux.com)

Posted Feb 18, 2013 8:06 UTC (Mon) by dlang (subscriber, #313) [Link]

or 4, they respond when someone points out a problem and work to close that problem, but are not willing to sacrifice performance based on theoretical problems that they see no possible way to exploit.

They are also far too busy reviewing and accepting code where the author wants it to be part of the kernel to go hunting around for code that may exist, may or may not have bugs, may or may not apply to the core kernel without problems, and may or may not even be legally released.

one of the side effects of the SCO fiasco is that they require that people attest that they have the right to contribute the code that they submit. Just saying 'someone slapped a GPL tag on it' isn't going to be good enough

The kernel developers have removed code that they had the legal right to include in the kernel because the author of the code wanted them to. They aren't about to go hunting for code who's author may oppose what they do with it.

How The Linux Foundation and Fedora are Addressing Workstation Security (Linux.com)

Posted Feb 18, 2013 10:20 UTC (Mon) by imitev (guest, #60045) [Link]

> or 4, they respond when someone points out a problem and work to close that problem, but are not willing to sacrifice performance based on theoretical problems that they see no possible way to exploit

Well the *class* of exploits that grsecurity prevents looks rather practical to me (and if it was only theoretical why would security companies even bother using it?), so we'll have to agree to disagree.

> The kernel developers have removed code that they had the legal right to include in the kernel because the author of the code wanted them to.

Code != concepts. So OK, the problem is then with patents.
Let's have a look at virtualization: one would think that it's a patent minefield compared to security, but we continue to enjoy a steady rate of improvements and new features in that area. Maybe it's just that it's more fun and interesting to develop than security. Or not: companies make money selling virtualization products, or save money buying them to optimize their computing resources. Meanwhile, security is not only costly, with no immediate benefits, but it also prevents your employees from getting the work done in a quick&dirty way, it makes users yell at sysadmins, and a few other dozen complaints. You just realize how nice it would have been when your systems are compromised. And on the other side, if you invested in it, you might not see any effect since you effectively decreased the chance somebody would manage to hack you. I'm wandering too far, but the point is that security is a difficult sell, I don't think it has anything to do with legal stuff. People are just not interested.

> Well, he would have to make a case that he needed to be paid by them

I don't understand how your comment relates to what I've written.
There seems to be an assumption that Spender needs money and should be paid to push features upstream; I hope for him he's already well paid between sponsoring, consulting, and (maybe) selling exploits. I anticipate you'll ask why he's then bothering trying to advertise his superior features, maybe he's just trying to prove a point and have some recognition for the work he's doing - very human, after all. Granted, with a complete lack of diplomacy.

How The Linux Foundation and Fedora are Addressing Workstation Security (Linux.com)

Posted Feb 18, 2013 7:15 UTC (Mon) by anselm (subscriber, #2796) [Link]

I'm pretty sure spender doesn't work on grsec professionally for the same reason that Linus doesn't work on Linux professionally. If he had to declare loyalty to one company, it would create a conflict of interest.

If that were the case, the obvious move would be for the Linux Foundation to pay him a stipend just like they're paying Linus.

How The Linux Foundation and Fedora are Addressing Workstation Security (Linux.com)

Posted Feb 18, 2013 6:18 UTC (Mon) by treed (guest, #11432) [Link]

Sounds like sour grapes to me. The grsecurity guys are pretty bummed that SELinux is getting all of the love.

How The Linux Foundation and Fedora are Addressing Workstation Security (Linux.com)

Posted Feb 18, 2013 13:41 UTC (Mon) by dpquigl (guest, #52852) [Link]

Spender repeatedly spouts the false dichotomy that its either GRSecurity or SELinux. Lets clear something up right now. SELinux is an access control model. GRSecurity is a set of security enhancements to a bunch of places in the kernel including kernel memory protections using PaX. GRSecurity also includes their own access control model in the form of RBAC (Rule Based Access Control) where they have their own learning mode. The parts that you should compare SELinux and GRSecurity to are SELinux and GRSecurity RBAC. We in the SELinux community do not claim to do any sort of kernel level exploit mitigation and we never have. The best we could ever do is make policies that restrict avenues of attack for kernel exploits but we do not do anything to mitigate damage at a kernel level. As spender has pointed out the default policies for Fedora are very permissive because they have traded off some usability for strict security. We have people who use much stricter policies which restrict far more but those are in applications where the need for security far exceeds the need for usability. Those deployments are where the machine in question is acting mostly as an appliance which will never be interacted with directly.

All that being said Spender and PaXTeam do tons of great work. I would love to see a lot of their code merged into mainline but the likelyhood of that happening isn't very good. If you use a Hardened Gentoo kernel you'll actually get a kernel with PaX protections with some GRSecurity features and SELinux enabled which I think is an awesome thing. As Spender showcased above he does not play politics or suffer fools. What he doesn't seem to care about is that most of the kernel inclusion process is politics. We've seen it before with competing implementations of features where the person in the "in crowd" got their implementation chosen over someone who had been working on the problem for a very long time with a large user base. That coupled with a hostile attitude from upstream about security (Linus has repeatedly called security people crazy, Spender and SELinux people included) makes it hard to dedicate time to working on getting things upstreamed.

How The Linux Foundation and Fedora are Addressing Workstation Security (Linux.com)

Posted Feb 18, 2013 13:57 UTC (Mon) by dpquigl (guest, #52852) [Link]

Correction its RSBAC not RBAC.

How The Linux Foundation and Fedora are Addressing Workstation Security (Linux.com)

Posted Feb 18, 2013 14:01 UTC (Mon) by spender (subscriber, #23067) [Link]

RSBAC is a completely separate project ;)

http://www.rsbac.org

-Brad

How The Linux Foundation and Fedora are Addressing Workstation Security (Linux.com)

Posted Feb 18, 2013 14:03 UTC (Mon) by dpquigl (guest, #52852) [Link]

I stand corrected. I thought it was part of your work with GRSecurity. Its good to see that its separated out so that if someone wanted to use it they could. However If I was going to roll my own kernel with RSBAC in it I'd just use the GRSecurity patches and get all the extra goodies that go along with it.

How The Linux Foundation and Fedora are Addressing Workstation Security (Linux.com)

Posted Feb 18, 2013 15:21 UTC (Mon) by spender (subscriber, #23067) [Link]

I think you may be confused still ;) Grsecurity has its own RBAC system (I haven't given it a fancy name) which is included in the grsecurity patch. RSBAC is a totally different project, different authors, etc. It's not related to grsecurity in any way.

-Brad

How The Linux Foundation and Fedora are Addressing Workstation Security (Linux.com)

Posted Feb 18, 2013 15:45 UTC (Mon) by dpquigl (guest, #52852) [Link]

You're right I was confused. I was looking through the PaX slides you referenced above and it had GRSecurity and RSBAC right next to each other so I associated them together. So yes the correct comparison would be SELinux against your RBAC mechanism.

How The Linux Foundation and Fedora are Addressing Workstation Security (Linux.com)

Posted Feb 18, 2013 13:50 UTC (Mon) by dpquigl (guest, #52852) [Link]

You may find some people that think LSMs are enough but everyone I've spoken to (LSM authors) realize that the LSMs are really only access control models and that other parts of the kernel need to be hardened as well. That being said as someone who worked on SELinux it wasn't my job to harden the kernel. My job was to do research and we used SELinux as a platform. If it got merged upstream all the better. If it was something that someone like Red Hat wanted then I had more help in getting stuff upstream. Spenders main issue is with a community that seems indifferent at best and openly hostile at worse to handling security related issues. Its also that some of his features would not be as palatable with the subsystem maintainers that they would interact with.


Copyright © 2017, Eklektix, Inc.
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds