| blob | 623c059abf8b25154f8df760ef3d27bbedf62db1 |
1 .\" $NetBSD: security.8,v 1.18 2009/01/26 13:23:20 elad Exp $
2 .\"
3 .\" Copyright (c) 2006 Elad Efrat <elad@NetBSD.org>
4 .\" All rights reserved.
5 .\"
6 .\" Redistribution and use in source and binary forms, with or without
7 .\" modification, are permitted provided that the following conditions
8 .\" are met:
9 .\" 1. Redistributions of source code must retain the above copyright
10 .\" notice, this list of conditions and the following disclaimer.
11 .\" 2. Redistributions in binary form must reproduce the above copyright
12 .\" notice, this list of conditions and the following disclaimer in the
13 .\" documentation and/or other materials provided with the distribution.
14 .\" 3. The name of the author may not be used to endorse or promote products
15 .\" derived from this software without specific prior written permission.
16 .\"
17 .\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
18 .\" IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
19 .\" OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
20 .\" IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
21 .\" INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
22 .\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
23 .\" DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
24 .\" THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
25 .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
26 .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
27 .\"
28 .Dd January 26, 2009
29 .Dt SECURITY 8
30 .Os
31 .Sh NAME
32 .Nm security
33 .Nd
34 .Nx
35 security features
36 .Sh DESCRIPTION
37 .Nx
38 supports a variety of security features.
39 Below is a brief description of them with some quick usage examples
40 that will help you get started.
41 .Pp
42 Contents:
43 .Bl -hyphen -compact
44 .It
45 Veriexec (file integrity)
46 .It
47 Exploit mitigation
48 .It
49 Per-user
50 .Pa /tmp
51 directory
52 .It
53 Information filtering
54 .El
55 .Sh VERIEXEC
56 .Em Veriexec
57 is a file integrity subsystem.
58 .Pp
59 For more information about it, and a quick guide on how to use it, please see
60 .Xr veriexec 8 .
61 .Pp
62 In a nutshell, once enabled,
63 .Em Veriexec
64 can be started as follows:
65 .Bd -literal -offset indent
66 # veriexecgen \*[Am]\*[Am] veriexecctl load
67 .Ed
68 .Sh EXPLOIT MITIGATION
69 .Nx
70 incorporates some exploit mitigation features.
71 The purpose of exploit mitigation features is to interfere with the way exploits
72 work, in order to prevent them from succeeding.
73 Due to that, some features may have other impact on the system, so be sure to
74 fully understand the implications of each feature.
75 .Pp
76 .Nx
77 provides the following exploit mitigation features:
78 .Bl -hyphen -compact
79 .It
80 PaX ASLR (Address Space Layout Randomization)
81 .It
82 PaX MPROTECT
83 .Xr ( mprotect 2
84 restrictions)
85 .It
86 PaX SegvGuard
87 .It
88 .Xr gcc 1
89 stack-smashing protection (SSP)
90 .El
91 .Ss PaX ASLR
92 .Em PaX ASLR
93 implements Address Space Layout Randomization, meant to complement
94 non-executable mappings.
95 Its purpose is to harden prediction of the address space layout, namely
96 location of library and application functions that can be used by an attacker
97 to circumvent non-executable mappings by using a technique called
98 .Dq return to library
99 to bypass the need to write new code to (potentially executable) regions of
100 memory.
101 .Pp
102 When
103 .Em PaX ASLR
104 is used, it is more likely the attacker will fail to predict the addresses of
105 such functions, causing the application to segfault.
106 To detect cases where an attacker might try and brute-force the return address
107 of respawning services,
108 .Em PaX Segvguard
109 can be used (see below).
110 .Pp
111 For non-PIE (Position Independent Executable) executables,
112 the
113 .Nx
114 .Em PaX ASLR
115 implementation introduces randomization to the following memory regions:
116 .Bl -enum -compact
117 .It
118 The data segment
119 .It
120 The stack
121 .El
122 .Pp
123 For PIE executables:
124 .Bl -enum -compact
125 .It
126 The program itself (exec base)
127 .It
128 All shared libraries
129 .It
130 The data segment
131 .It
132 The stack
133 .El
134 .Pp
135 While it can be enabled globally,
136 .Nx
137 provides a tool,
138 .Xr paxctl 8 ,
139 to enable
140 .Em PaX ASLR
141 on a per-program basis.
142 .Pp
143 Example usage:
144 .Bd -literal -offset indent
145 # paxctl +A /usr/sbin/sshd
146 .Ed
147 .Pp
148 Enabling
149 .Em PaX ASLR
150 globally:
151 .Bd -literal -offset indent
152 # sysctl -w security.pax.aslr.global=1
153 .Ed
154 .Ss PaX MPROTECT
155 .Em PaX MPROTECT
156 implements memory protection restrictions, meant to complement non-executable
157 mappings.
158 Their purpose is to prevent situations where malicious code attempts to mark
159 writable memory regions as executable, often by trashing arguments to an
160 .Xr mprotect 2
161 call.
162 .Pp
163 While it can be enabled globally,
164 .Nx
165 provides a tool,
166 .Xr paxctl 8 ,
167 to enable
168 .Em PaX MPROTECT
169 on a per-program basis.
170 .Pp
171 Example usage:
172 .Bd -literal -offset indent
173 # paxctl +M /usr/sbin/sshd
174 .Ed
175 .Pp
176 Enabling
177 .Em PaX MPROTECT
178 globally:
179 .Bd -literal -offset indent
180 # sysctl -w security.pax.mprotect.global=1
181 .Ed
182 .Ss PaX Segvguard
183 .Em PaX Segvguard
184 monitors the number of segmentation faults in a program on a per-user basis,
185 in an attempt to detect on-going exploitation attempts and possibly prevent
186 them.
187 For instance,
188 .Em PaX Segvguard
189 can help detect when an attacker tries to brute-force a function
190 return address, when attempting to perform a return-to-lib attack.
191 .Pp
192 .Em PaX Segvguard
193 consumes kernel memory, so use it wisely.
194 While it provides rate-limiting protections, records are tracked for all
195 users on a per-program basis, meaning that irresponsible use may result in
196 tracking all segmentation faults in the system, possibly consuming all kernel
197 memory.
198 .Pp
199 For this reason, it is highly recommended to have
200 .Em PaX Segvguard
201 enabled explicitly only for network services, etc.
202 Enabling
203 .Em PaX Segvguard
204 explicitly works like this:
205 .Bd -literal -offset indent
206 # paxctl +G /usr/sbin/sshd
207 .Ed
208 .Pp
209 However, a global knob is still provided, for use in strict environments
210 with no local users (some network appliances, embedded devices, firewalls,
211 etc.):
212 .Bd -literal -offset indent
213 # sysctl -w security.pax.segvguard.global=1
214 .Ed
215 .Pp
216 Explicitly disabling
217 .Em PaX Segvguard
218 is also possible:
219 .Bd -literal -offset indent
220 # paxctl +g /bin/ls
221 .Ed
222 .Pp
223 In addition,
224 .Em PaX Segvguard
225 provides several tunable options.
226 For example, to limit a program to 5 segmentation faults from the same user in
227 a 60 second timeframe:
228 .Bd -literal -offset indent
229 # sysctl -w security.pax.segvguard.max_crashes=5
230 # sysctl -w security.pax.segvguard.expiry_timeout=60
231 .Ed
232 .Pp
233 The number of seconds a user will be suspended from running the culprit
234 program is also configurable.
235 For example, 10 minutes seem like a sane setting:
236 .Bd -literal -offset indent
237 # sysctl -w security.pax.segvguard.suspend_timeout=600
238 .Ed
239 .Ss GCC Stack Smashing Protection ( SSP )
240 As of
241 .Nx 4.0 ,
242 .Xr gcc 1
243 includes
244 .Em SSP ,
245 a set of compiler extensions to raise the bar on exploitation attempts by
246 detecting corruption of variables and buffer overruns, which may be used to
247 affect program control flow.
248 .Pp
249 Upon detection of a buffer overrun,
250 .Em SSP
251 will immediately abort execution of the program and send a log message
252 to
253 .Xr syslog 3 .
254 .Pp
255 The system (userland and kernel) can be built with
256 .Em SSP
257 by using the
258 .Dq USE_SSP
259 flag in
260 .Pa /etc/mk.conf :
261 .Bd -literal -offset indent
262 USE_SSP=yes
263 .Ed
264 .Pp
265 You are encouraged to use
266 .Em SSP
267 for software you build, by providing one of the
268 .Fl fstack-protector
269 or
270 .Fl fstack-protector-all
271 flags to
272 .Xr gcc 1 .
273 Keep in mind, however, that
274 .Em SSP
275 will not work for functions that make use of
276 .Xr alloca 3 ,
277 as the latter modifies the stack size during run-time, while
278 .Em SSP
279 relies on it being a compile-time static.
280 .Pp
281 Use of
282 .Em SSP
283 is especially encouraged on platforms without per-page execute bit granularity
284 such as
285 .Em i386 .
286 .Sh PER-USER TEMPORARY STORAGE
287 It is possible to configure per-user temporary storage to avoid potential
288 security issues (race conditions, etc.) in programs that do not make secure
289 usage of
290 .Pa /tmp .
291 .Pp
292 To enable per-user temporary storage, add the following line to
293 .Xr rc.conf 5 :
294 .Bd -literal -offset indent
295 per_user_tmp=YES
296 .Ed
297 .Pp
298 If
299 .Pa /tmp
300 is a mount point, you will also need to update its
301 .Xr fstab 5
302 entry to use
303 .Dq /private/tmp
304 (or whatever directory you want, if you override the default using the
305 .Dq per_user_tmp_dir
306 .Xr rc.conf 5
307 keyword) instead of
308 .Dq /tmp .
309 .Pp
310 Following that, run:
311 .Bd -literal -offset indent
312 # /etc/rc.d/perusertmp start
313 .Ed
314 .Sh INFORMATION FILTERING
315 .Nx
316 provides administrators the ability to restrict information passed from
317 the kernel to userland so that users can only view information they
318 .Dq own .
319 .Pp
320 The hooks that manage this restriction are located in various parts of the
321 system and affect programs such as
322 .Xr ps 1 ,
323 .Xr fstat 1 ,
324 and
325 .Xr netstat 1 .
326 Information filtering is enabled as follows:
327 .Bd -literal -offset indent
328 # sysctl -w security.curtain=1
329 .Ed
330 .Sh SEE ALSO
331 .Xr sysctl 3 ,
332 .Xr options 4 ,
333 .Xr paxctl 8 ,
334 .Xr sysctl 8 ,
335 .Xr veriexec 8 ,
336 .Xr veriexecctl 8 ,
337 .Xr veriexecgen 8
338 .Sh AUTHORS
339 .An Elad Efrat Aq elad@NetBSD.org