Mandatory access control

In computer security, mandatory access control (MAC) refers to a type of access control by which the operating system constrains the ability of a subject or initiator to access or generally perform some sort of operation on an object or target. In practice, a subject is usually a process or thread; objects are constructs such as files, directories, TCP/UDP ports, shared memory segments, IO devices, etc. Subjects and objects each have a set of security attributes. Whenever a subject attempts to access an object, an authorization rule enforced by the operating system kernel examines these security attributes and decides whether the access can take place. Any operation by any subject on any object is tested against the set of authorization rules (aka policy) to determine if the operation is allowed. A database management system, in its access control mechanism, can also apply mandatory access control; in this case, the objects are tables, views, procedures, etc.

Implications of the term mandatory

In the context of Multilevel security (MLS), the term mandatory used with access controls has historically implied a very high degree of robustness that assures that the control mechanisms resist subversion, thereby enabling them to enforce an access control policy that is mandated by some regulation that must be absolutely enforced, such as the Executive Order 12958 for US classified information.

For MAC, the access control decision is contingent on verifying the compatibility of the security properties of the data and the clearance properties of the individual (or the process proxying for the individual). The decision depends on the integrity of the metadata (e.g. label) that defines the security properties of the data, as well as the security clearance of the individual or process requesting access. For example, if a security label can be changed by a user, a surprisingly common vulnerability in some self-proclaimed 'MAC capable' systems, then that user can corrupt the access controls. Security mechanisms that protect such metadata and the access control decision logic from corruption are MAC-critical objects and require appropriate robustness.

The term mandatory in MAC has acquired a special meaning derived from its use with military systems. MAC means access controls that are mandated by order of a government and so enforcement is supposed to be more imperative than for commercial applications. This precludes enforcement by best-effort mechanisms, only mechanisms that can provide absolute, or near-absolute enforcement of the mandate are acceptable for MAC. This is a tall order and sometimes assumed unrealistic by those unfamiliar with high assurance strategies, and very difficult for those who are.

Vendors claiming to enforce MAC are sometimes making claims beyond their capability, and sometimes making claims beyond their understanding. The claim that MAC is enforced implies a claim of very high robustness. Vendors claiming MAC capability do usually have functions that enable defining of MAC privileges and rules but their implementations can be woefully unable to enforce them under even the mildest of attacks. Ordinary 'best practices' do not produce software that has this kind of assurance level; in fact, no successful software-only approach has ever been documented. The only approach that has succeeded at protecting MAC controls from subversion has been to design the kernel to maintain a domain for its own execution using highly specialized hardware designed into the microprocessor architecture. Besides its cost, this is often unpopular because it affects portability of the operating system.

Degrees of MAC system strength

In some systems, users have the authority to decide whether to grant access to any other user. To allow that, all users have clearances for all data. This is not necessarily true of a MAC system. If individuals or processes exist that may be denied access to any of the data in the system environment, then the system must be trusted to enforce MAC. Since there can be various levels of data classification and user clearances, this implies a quantified scale for robustness. For example, more robustness is indicated for system environments containing classified Top Secret information and uncleared users than for one with Secret information and users cleared to at least Confidential. To promote consistency and eliminate subjectivity in degrees of robustness, an extensive scientific analysis and risk assessment of the topic produced a landmark benchmark standardization quantifying security robustness capabilities of systems and mapping them to the degrees of trust warranted for various security environments. The result was documented in CSC-STD-004-85.[1] Two relatively independent components of robustness were defined: Assurance Level and Functionality. Both were specified with a degree of precision that warranted significant confidence in certifications based on these criteria.

Evaluation of MAC system strength

The Common Criteria[2] is based on this science and it intended to preserve the Assurance Level as EAL levels and the functionality specifications as Protection Profiles. Of these two essential components of objective robustness benchmarks, only EAL levels were faithfully preserved. In one case, TCSEC level C2[3] (not a MAC capable category) was fairly faithfully preserved in the Common Criteria, as the Controlled Access Protection Profile (CAPP).[4] Multilevel security (MLS) Protection Profiles (such as MLSOSPP similar to B2)[5] is more general than B2. They are pursuant to MLS, but lack the detailed implementation requirements of their Orange Book predecessors, focusing more on objectives. This gives certifiers more subjective flexibility in deciding whether the evaluated product’s technical features adequately achieve the objective, potentially eroding consistency of evaluated products and making it easier to attain certification for less trustworthy products. For these reasons, the importance of the technical details of the Protection Profile is critical to determining the suitability of a product.

Such an architecture prevents an authenticated user or process at a specific classification or trust-level from accessing information, processes, or devices in a different level. This provides a containment mechanism of users and processes, both known and unknown (an unknown program (for example) might comprise an untrusted application where the system should monitor and/or control accesses to devices and files).

vs Discretionary Access Control

With mandatory access control, this security policy is centrally controlled by a security policy administrator; users do not have the ability to override the policy and, for example, grant access to files that would otherwise be restricted. By contrast, discretionary access control (DAC), which also governs the ability of subjects to access objects, allows users the ability to make policy decisions and/or assign security attributes. (The traditional Unix system of users, groups, and read-write-execute permissions is an example of DAC.) MAC-enabled systems allow policy administrators to implement organization-wide security policies. Unlike with DAC, users cannot override or modify this policy, either accidentally or intentionally. This allows security administrators to define a central policy that is guaranteed (in principle) to be enforced for all users.

Implementations

A few MAC implementations, such as Unisys' Blacker project, were certified robust enough to separate Top Secret from Unclassified late in the last millennium. Their underlying technology became obsolete and they were not refreshed. Today there are no current implementations certified by TCSEC to that level of robust implementation. However, some less robust products exist.

See also

Footnotes

  1. ↑ "Technical Rational Behind CSC-STD-003-85: Computer Security Requirements". 1985-06-25. Archived from the original on July 15, 2007. Retrieved 2008-03-15.
  2. ↑ "The Common Criteria Portal". Retrieved 2008-03-15.
  3. ↑ US Department of Defense (December 1985). "DoD 5200.28-STD: Trusted Computer System Evaluation Criteria". Retrieved 2008-03-15.
  4. ↑ "Controlled Access Protection Profile, Version 1.d". National Security Agency. 1999-10-08. Retrieved 2008-03-15.
  5. ↑ "Protection Profile for Multi-Level Operating Systems in Environments Requiring Medium Robustness, Version 1.22". National Security Agency. 2001-05-23. Retrieved 2008-03-15.
  6. ↑ National Information Assurance Partnership. "The Common Criteria Evaluation and Validation Scheme Validated Products List". Archived from the original on 2008-03-14. Retrieved 2008-03-15.
  7. ↑ "TOMOYO Linux, an alternative Mandatory Access Control". Linux 2 6 30. Linux Kernel Newbies.
  8. ↑ "Linux 2.6.36 released 20 October 2010". Linux 2.6.36. Linux Kernel Newbies.
  9. ↑ "Tor-ramdisk Technical Considerations". Retrieved 2011-04-15.
  10. ↑ "Why doesn't grsecurity use LSM?".
  11. ↑ Matthew Conover. "Analysis of the Windows Vista Security Model". Symantec Corporation. Retrieved 2007-10-08.
  12. ↑ Steve Riley. "Mandatory Integrity Control in Windows Vista". Retrieved 2007-10-08.
  13. ↑ Mark Russinovich. "PsExec, User Account Control and Security Boundaries". Retrieved 2007-10-08.
  14. ↑ TrustedBSD Project. "TrustedBSD Mandatory Access Control (MAC) Framework". Retrieved 2008-03-15.
  15. ↑ "sandbox_init(3) man page". 2007-07-07. Retrieved 2008-03-15.
  16. ↑ "SEPostgreSQL-patch".
  17. ↑ "Security Enhanced PostgreSQL".
  18. ↑ "Trusted RUBIX".
  19. ↑ (Russian) Ключевые особенности Astra Linux Special Edition по реализации требований безопасности информации
  20. ↑ "Official SMACK documentation from the Linux source tree". Archived from the original on 2012-09-13.
  21. ↑ Jonathan Corbet. "More stuff for 2.6.25". Archived from the original on 2012-09-12.

References

External links

This article is issued from Wikipedia - version of the Tuesday, April 05, 2016. The text is available under the Creative Commons Attribution/Share Alike but additional terms may apply for the media files.