diff options
Diffstat (limited to 'static/netbsd/man9/secmodel_securelevel.9')
| -rw-r--r-- | static/netbsd/man9/secmodel_securelevel.9 | 287 |
1 files changed, 287 insertions, 0 deletions
diff --git a/static/netbsd/man9/secmodel_securelevel.9 b/static/netbsd/man9/secmodel_securelevel.9 new file mode 100644 index 00000000..7dc580b4 --- /dev/null +++ b/static/netbsd/man9/secmodel_securelevel.9 @@ -0,0 +1,287 @@ +.\" $NetBSD: secmodel_securelevel.9,v 1.19 2019/05/18 10:21:03 alnsn Exp $ +.\" +.\" Copyright (c) 2006 Elad Efrat <elad@NetBSD.org> +.\" Copyright (c) 2000 Hugh Graham +.\" All rights reserved. +.\" +.\" Redistribution and use in source and binary forms, with or without +.\" modification, are permitted provided that the following conditions +.\" are met: +.\" 1. Redistributions of source code must retain the above copyright +.\" notice, this list of conditions and the following disclaimer. +.\" 2. Redistributions in binary form must reproduce the above copyright +.\" notice, this list of conditions and the following disclaimer in the +.\" documentation and/or other materials provided with the distribution. +.\" 3. The name of the author may not be used to endorse or promote products +.\" derived from this software without specific prior written permission. +.\" +.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR +.\" IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES +.\" OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. +.\" IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, +.\" INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT +.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, +.\" DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY +.\" THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT +.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF +.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. +.\" +.Dd May 18, 2019 +.Dt SECMODEL_SECURELEVEL 9 +.Os +.Sh NAME +.Nm secmodel_securelevel +.Nd securelevel security model +.Sh DESCRIPTION +The securelevel mechanism is intended to allow protecting the persistence +of code and data on the system, or a subset thereof, from modification, even +by the +.Em super-user , +by providing convenient means of +.Dq locking down +a system to a degree suited to its environment. +.Pp +The +.Em super-user +can raise the +.Em securelevel +using +.Xr sysctl 8 , +but only +.Xr init 8 +can lower it. +.Pp +Four security levels are provided: +.Bl -tag -width flag +.It \&-1 Em Permanently insecure mode +.Bl -bullet +.It +Do not raise the +.Em securelevel +on boot. +.El +.It \ 0 Em Insecure mode +.Bl -bullet +.It +The init process (PID 1) may not be traced or accessed by +.Xr ptrace 2 +or procfs. +.It +Immutable and append-only file flags may be changed by +.Xr chflags 1 +or by other means. +.It +All devices may be read or written subject to their permissions. +.It +All +.Xr gpio 4 +pins can be set and device drivers can be attached to them. +.It +On architectures that support +.Xr module 7 , +kernel modules can be loaded and unloaded. +.El +.It \ 1 Em Secure mode +.Bl -bullet +.It +All effects of +.Em securelevel +0. +.It +The +.Xr x86/kmem 4 +memory files +.Pa /dev/mem +and +.Pa /dev/kmem +may not be written to. +.It +Raw disk devices of mounted file systems are read-only. +.It +Immutable and append-only file flags may not be removed. +.It +Kernel modules may not be loaded or unloaded. +.It +Neither the +.Va net.inet.ip.sourceroute +nor the +.Va vm.user_va0_disable +.Xr sysctl 8 +variables may be changed. +.It +Adding or removing +.Xr sysctl 9 +nodes is denied. +.It +The RTC offset may not be changed. +.It +Set-id coredump settings may not be altered. +.It +Device +.Dq pass-thru +requests that may be used to perform raw disk and/or memory access are denied. +.It +The +.Em iopl +and +.Em ioperm +calls are denied. +.It +Access to unmanaged memory is denied. +.It +Only GPIO pins that have been set at +.Em securelevel +0 can be accessed. +.El +.It \ 2 Em Highly secure mode +.Bl -bullet +.It +All effects of +.Em securelevel +1. +.It +Raw disk devices are always read-only whether mounted or not. +.It +New disks may not be mounted, and existing mounts may only be downgraded +from read-write to read-only. +.It +The system clock may not be set backwards or close to overflow. +.It +Per-process coredump name may not be changed. +.It +Packet filtering and NAT rules may not be altered. +.It +CPU ucode loading is denied on platforms that support it. +.El +.El +.Pp +Highly secure mode may seem Draconian, but is intended as a last line of +defence should the +.Em super-user +account be compromised. +Its effects preclude +circumvention of file flags by direct modification of a raw disk device, +or erasure of a file system by means of +.Xr newfs 8 . +Further, it can limit the potential damage of a compromised +.Dq firewall +by prohibiting the modification of packet filter rules. +Preventing +the system clock from being set backwards aids in post-mortem analysis +and helps ensure the integrity of logs. +Precision timekeeping is not +affected because the clock may still be slowed. +.Pp +Normally, the system runs in +.Em securelevel +0 while single-user and in +.Em securelevel +1 while multi-user. +If a higher +.Em securelevel +is desired while running multi-user, +it can be set using the +.Sy securelevel +keyword in the startup script +.Pa /etc/rc.conf , +see +.Xr rc.conf 5 +for details. +Lower securelevels require the kernel to be compiled with +.Sy options INSECURE , +causing it to always default to +.Em securelevel +\-1. +.Pp +In order for this protection to be effective, the administrator +must ensure that no program that is run while the security level +is 0 or lower, nor any data or configuration file used by any such +program, can be modified while the security level is greater than +0. +This may be achieved through the careful use of the +.Dq immutable +file flag to define and protect a Trusted Computing Base (TCB) +consisting of all such programs and data, or by ensuring that all +such programs and data are on filesystems that are mounted read-only +and running at security level 2 or higher. +.Em Particular care must be taken to ensure, if relying upon +.Em security level 1 and the use of file flags, that the integrity of the +.Em TCB cannot be compromised through the use of modifications to the +.Em disklabel or access to overlapping disk partitions, including the +.Em raw partition . +.Pp +Do not overlook the fact that shell scripts (or anything else fed to an +interpreter, through any mechanism) and the kernel itself are "programs +that run while the security level is 0" and must be considered part of +the TCB. +.Pp +The following +.Xr sysctl 3 +variables are exported: +.Bl -tag -width compact +.It security.models.securelevel.securelevel +The system security level. +This level may be raised by processes with appropriate privilege. +It may only be lowered by process 1 (init). +.El +.Sh FUNCTIONS +.Nm +exposes a +.Xr secmodel_eval 9 +evaluation routine +to test whether the current +.Em securelevel +is above a certain threshold level or not. +.Pp +The parameters to +.Xr secmodel_eval 9 +are: +.Bl -tag -compact -width xxxxx +.It id +the unique identifier of +.Nm : +.Qo Dv org.netbsd.secmodel.securelevel Qc . +.It what +a string, +.Qo Dv is-securelevel-above Qc . +.It arg +a reference to an +.Dv int +representing the threshold level. +.It ret +a boolean, set by +.Nm +to +.Dv true +when the +.Em securelevel +is strictly above +the threshold level, +.Dv false +otherwise. +.El +.Sh RETURN TYPES +If successful, the evaluation returns 0 with the +.Fa ret +argument being either +.Dv true +or +.Dv false . +.Sh SEE ALSO +.Xr kauth 9 , +.Xr secmodel 9 , +.Xr secmodel_bsd44 9 , +.Xr secmodel_eval 9 +.Sh AUTHORS +.An Elad Efrat Aq Mt elad@NetBSD.org +.Sh BUGS +Systems without +.Xr sysctl 8 +behave as though they have security level \-1. +.Pp +The security level 2 restrictions relating to TCB integrity protection +should be enforced at security level 1. +Restrictions dependent upon security level but not relating to TCB +integrity protection should be selected by +.Xr sysctl 8 +settings available only at security level 0 or lower. |