SELinux ist eine Erweiterung für das Betriebssystem Linux, deren Einsatz eine Erhöhung der Systemsicherheit verspricht. Dieses Tutorial stellt einige der Grundlagen und Mechanismen von SELinux vor. Es gibt einen Einblick in Nutzung und Konfiguration. / SELinux is an extension to the Linux operating system. It promises an increase in system security. This tutorial introduces some of the principles and mechanisms of SELinux. It provides insight into its usage and configuration.

Tato práce se zabývá analýzou politik pro bezpečnostní moduly založené na mandatorním řízení přístupu (MAC), se zaměřením na SELinux. Vzhledem k omezeným schopnostem dostupných nástrojů byl navržen a implementován nový nástroj. Jeho hlavní cíle jsou usnadnění vývoje bezpečnostních politik a pomoc při odhadu role SELinuxu v zabezpečení systému. V případě úspěšného nasazení bude nový nástroj začleněn do balíčku nástrojů SETools 4.

SELinux ist eine Erweiterung für das Betriebssystem Linux, deren Einsatz eine Erhöhung der Systemsicherheit verspricht. Dieses Tutorial stellt einige der Grundlagen und Mechanismen von SELinux vor. Es gibt einen Einblick in Nutzung und Konfiguration. / SELinux is an extension to the Linux operating system. It promises an increase in system security. This tutorial introduces some of the principles and mechanisms of SELinux. It provides insight into its usage and configuration.

This thesis deals with technologies of SELinux security policy writing. Furthermore the thesis analyzes userspace of GNU/Linux operating system with special focus on KDE desktop environment. On the basis of this analysis a bottom-up methodics to create a security policy is devised. Acquired knowledge is then used in practice when realizing the main goal of the thesis, which is to create example security policies for chosen KDE applications. When describing technologies of security policy writing the thesis draws information from available sources of information. Input for userspace analysis are available electronic sources of information and author's own experience with analyzed applications. This is used with common philosophic principles to devise bottom-up methodics of policy writting. Following act of policy building draws from defined security goals, acquired knowledge, created methodics and defined usecases. Theoretical contribution of the thesis is devised methodics of userspace policy building. Main practical contribution are then created example SELinux policies for chosen KDE applications. The structure of the thesis follows its goals. For them three parts are created: background research of available resources, author's own theoretical contemplations and practical output of the thesis. Those parts are then devided into sections according to needs of each topic.

The self-defending object (SDO) concept is an extension to the object-oriented programming paradigm, whereby those objects that encapsulate the protected resources of a security aware application (SAA), are made aware of, and responsible for, the defence of those resources. That defence takes two forms, the enforcement of mandatory access control on protected resources and the generation of the corresponding portion of the SAA's audit trail. The SDO concept acts as the philosophy that guides the application level mandatory access control within SAAs which ensures that the provided access control is both complete and non bypassable. Although SDOs accept responsibility for controlling access to the protected data and functionality that they encapsulate, an SDO delegates the responsibility for making authorisation decisions to an associated authorisation object. Thus, SDOs fulfill their access control obligations by initiating the authorisation check and then enforcing the decision made on their behalf. A simple, yet effective mechanism for enforcing that access control at the object level involves controlling the ability to invoke those SDO methods that access protected resources. In the absence of previous research on this approach to the enforcement of application level access control, the primary aim of this research was to demonstrate that the SDO concept is a viable paradigm for developing SAAs. That aim was achieved in two stages. The first stage targeted the provision of a 'proof of concept', that demonstrated that the SDO concept could be applied to the development of non-distributed SAAs. The second stage demonstrated its applicability to the development of distributed SAAs. In the second stage, two versions of a distributed prototype were developed, one based on a traditional (proprietary) distributed computing model, (Java RMI), and the second using the currently popular Web services model, to demonstrate the general applicability of the SDO concept. Having already demonstrated that the SDO concept could be applied to SAAs executing on a single machine, the major focus of that research was to devise a mechanism by which SDOs could be transferred between machines. The research then concentrated on determining what impacts the adoption of the SDO concept would have on SAA development. Experimentation carried out using the distributed prototypes demonstrated that (1) the adoption of the SDO does not restrict the use of inheritance hierarchies that include SDOs, (2) the restriction of the lifetime of SDOs can be supported, (3) usage rights enforcement can be employed, and (4) the use of cryptographic techniques to provide additional security guarantees is not affected. A key feature of the SDO concept, is that no major changes need to be made to current development tools or　methodologies, so its adoption is not hampered by significant financial or training impediments. This research demonstrated that the SDO concept is practical and constitutes a valuable extension to the object oriented paradigm that will help address the current lack of security in information systems. The SDO approach warrants additional research and adoption.

Les systèmes à objets sont présents partout dans notre quotidien. Ainsi, une vulnérabilité dans ces systèmes compromet amplement la confidentialité ou l'intégrité. Par exemple, Java est un système à objets basé sur les classes qui a été la cible de nombreuses cyber-attaques entre 2012 et 2013 au point que le département de la sécurité intérieure des Etats-Unis recommande son abandon. Dans cette thèse nous proposons de limiter les relations entre objets au moyen d’un contrôle d’accès obligatoire. Pour cela nous définissons un modèle général de système à objets supportant notamment les langages objets et à prototypes. Puis nous formalisons les relations élémentaires que nous pouvons observer et donc contrôler. Celles-ci sont la référence, l’interaction et trois types de flux (d’activité, d’information, de données). Nous proposons également une logique basée sur des automates qui permet de calculer les privilèges de chaque objet. Ainsi, nous calculons dynamiquement la politique obligatoire nécessaire pour satisfaire les objectifs de sécurité exigés. Par là même, nous résolvons d’un seul coup le calcul des politiques obligatoires et le problème d’efficacité puisque la politique obligatoire se trouve réduite. L’expérimentation propose une application aux objectifs de sécurité JAAS existants dans Java. De fait, nous avons été capables d’empêcher les malwares Java correspondant à une année de vulnérabilités au moyen de l’outil d’exploitation Metasploit. / Objects based systems are presents everywhere in our life. When such a system presents vulnerabilities, confidentiality and integrity are thus widely compromised. For example, Java is an object language authorizing many cyber-attacks between 2012 and 2013 leading the US department of homeland security to recommend its abandon. This thesis proposes to limit the relations between the objects thanks to a mandatory access control. First, a general model of objects supporting objects and prototypes languages is defined. Second, the elementary relations are formalized in order to control them. Those relations include the reference, interaction and three types of flow (activity, information and data). Automata authorize a logic that enables to compute the required mandatory policy. At the same time, the computation of the MAC policy and the efficiency are solved since the policy is reduced. Experimentations use the JAAS security objectives existing in the Java language. Thus, one year of Java vulnerabilities is prevented thanks to the Metasploit framework.

Benutzerbestimmte Zugriffskontrolle ist an vielen Stellen schwer zu beschränken und zu administrieren. Der Ansatz der systembestimmten Zugriffskontrolle - Mandatory Access Control - gibt die Verantwortung an das System ab und gibt Benutzern deutlich weniger Rechte. Diese Arbeit vergleicht zwei Vertreter, welche Mandatory Access Control umsetzen, einerseits das Linux Security Module Framework und andererseits das FreeBSD MAC Framework, zudem werden die wichtigsten Policy Vertreter angegeben. Auf beiden Seiten finden sich ähnliche Ansätze wie die Umsetzung als Kernelmodul und vor allem generische Fähigkeiten, allerdings sind die implementierten Funktionalitäten unter FreeBSD im Detail oft besser durchdacht oder auch ausgereifter.

Health Information Systems (HIS) make extensive use of Information and Communication Technologies (ICT). The use of ICT aids in improving the quality and efficiency of healthcare services by making healthcare information available at the point of care (Goldstein, Groen, Ponkshe, and Wine, 2007). The increasing availability of healthcare data presents security and privacy issues which have not yet been fully addressed (Liu, Caelli, May, and Croll, 2008a). Healthcare organisations have to comply with the security and privacy requirements stated in laws, regulations and ethical standards, while managing healthcare information. Protecting the security and privacy of healthcare information is a very complex task (Liu, May, Caelli and Croll, 2008b). In order to simplify the complexity of providing security and privacy in HIS, appropriate information security services and mechanisms have to be implemented. Solutions at the application layer have already been implemented in HIS such as those existing in healthcare web services (Weaver et al., 2003). In addition, Discretionary Access Control (DAC) is the most commonly implemented access control model to restrict access to resources at the OS layer (Liu, Caelli, May, Croll and Henricksen, 2007a). Nevertheless, the combination of application security mechanisms and DAC at the OS layer has been stated to be insufficient in satisfying security requirements in computer systems (Loscocco et al., 1998). This thesis investigates the feasibility of implementing Security Enhanced Linux (SELinux) to enforce a Role-Based Access Control (RBAC) policy to help protect resources at the Operating System (OS) layer. SELinux provides Mandatory Access Control (MAC) mechanisms at the OS layer. These mechanisms can contain the damage from compromised applications and restrict access to resources according to the security policy implemented. The main contribution of this research is to provide a modern framework to implement and manage SELinux in HIS. The proposed framework introduces SELinux Profiles to restrict access permissions over the system resources to authorised users. The feasibility of using SELinux profiles in HIS was demonstrated through the creation of a prototype, which was submitted to various attack scenarios. The prototype was also subjected to testing during emergency scenarios, where changes to the security policies had to be made on the spot. Attack scenarios were based on vulnerabilities common at the application layer. SELinux demonstrated that it could effectively contain attacks at the application layer and provide adequate flexibility during emergency situations. However, even with the use of current tools, the development of SELinux policies can be very complex. Further research has to be made in order to simplify the management of SELinux policies and access permissions. In addition, SELinux related technologies, such as the Policy Management Server by Tresys Technologies, need to be researched in order to provide solutions at different layers of protection.

La thèse porte sur deux enjeux importants de sécurité. Le premier concerne l’amélioration de la sécurité des systèmes Linux présents dans le calcul intensif et le second la protection des postes de travail Windows. Elle propose une méthode commune pour l’observation des appels système et la répartition d’observateurs afin de renforcer la sécurité et mesurer les performances obtenues. Elle vise des observateurs du type moniteur de référence afin de garantir de la confidentialité et de l’intégrité. Une solution utilisant une méthode de calcul intensif est mise en oeuvre pour réduire les surcoûts de communication entre les deux moniteurs de référence SELinux et PIGA. L’évaluation des performances montre les surcoûts engendrés par les moniteurs répartis et analyse la faisabilité pour les différents noeuds d’environnements de calcul intensif. Concernant la sécurité des postes de travail, un moniteur de référence est proposé pour Windows. Il repose sur les meilleures protections obligatoires issues des systèmes Linux et simplifie l’administration. Nous présentons une utilisation de ce nouveau moniteur pour analyser le fonctionnement de logiciels malveillants. L’analyse permet une protection avancée qui contrôle l’ensemble du scénario d’attaque de façon optimiste. Ainsi, la sécurité est renforcée sans nuire aux activités légitimes. / This thesis deals with two major issues in the computer security field. The first is enhancing the security of Linux systems for scientific computation, the second is the protection of Windows workstations. In order to strengthen the security and measure the performances, we offer a common method for the distributed observation of system calls. It relies on reference monitors to ensure confidentiality and integrity. Our solution uses specific high performance computing technologies to lower the communication latencies between the SELinux and PIGA monitors. Benchmarks study the integration of these distributed monitors in the scientific computation. Regarding workstation security, we propose a new reference monitor implementing state of the art protection models from Linux and simplifying administration. We present how to use our monitor to analyze the behavior of malware. This analysis enables an advanced protection to prevent attack scenarii in an optimistic manner. Thus, security is enforced while allowing legitimate activities.

Táto diplomová práca sa zameriava zvyšovanie bezpečnosti v operačných systémoch založených na Red Hat Enterprise Linux, na základe analyzovaných zraniteľnosti za posledných 5 rokov. V teoretickej časti sú popísané slabiny a zraniteľnosti, základné bezpečnostné mechanizmy v Linuxe, so zameraním na technológiu SELinux. Technológia SELinux je súčasťou operačných systémov Red Hat Enterprise Linux, Fedora a CentOS. Na základe analyzovaných zraniteľností bola v praktickej časti navrhnutá konfigurácia technológie SELinux. V návrhu sú popísané prvky, ktoré sa budú konfigurovať a tými sú SELinuxové booleany, SELinuxové moduly a SELinuxoví užívatelia, so zameraním na ochranu pamäte, eskalovanie privilégií, spúšťaniu kódu, úniku dat a obmedzenie procesov a užívateľov. Na základe návrhov bola vytvorená konfigurácia v konfiguračnom nástroji Ansible, ktorej cieľom je umožniť užívateľovi jednoducho a rýchlo nakonfigurovať hosťa. Okrem nej boli vytvorene ďalšie dve konfigurácie, ktoré umožnia vrátiť systém do predchádzajúceho stavu alebo uzamknúť SELinuxovú konfiguráciu. Následne sa overoval dopad konfigurácií na použiteľnosť systému a nájdené chyby boli opravené alebo nahlásené. Posledná časť overuje funkčnosť konfigurácie pred zneužitím zraniteľností.