70004: Added SELinux notes

Author: OliverKillane

70004 - Advanced Computer Security/Bell-LaPadula Model.md

@@ -0,0 +1,12 @@
+## Definition
+A state machine model for access control focusing on [[Confidentiality]].
+- **no read up, no write down**
+
+| Policy              | Description                                                              |
+| ------------------- | ------------------------------------------------------------------------ |
+| Simple Security     | A subject at a given level may not read an object at a higher level.     |
+| Star (`*`) Security | A subject at a given level may not write to any object at a lower level. |
+| Discretionary       | Use an access matrix to specify the discretionary access control.        |
+*[Bell–LaPadula model - Wikipedia](https://en.wikipedia.org/wiki/Bell%E2%80%93LaPadula_model)*
+## Attributes
+- Focuses on [[Confidentiality]], rather than [[Integrity]] as with the [[Biba Model]]

70004 - Advanced Computer Security/Biba Model.md

@@ -0,0 +1,9 @@
+## Definition
+A state machine for access control focusing on [[Integrity]].
+- **no write up, no read down**
+
+| Property             | Description                                                                         |
+| -------------------- | ----------------------------------------------------------------------------------- |
+| Simple Integrity     | Subject at a given integrity level must not read data at a lower level.             |
+| Star (`*`) Integrity | Subject at a given level on integrity must not write to data at a higher level.     |
+| Invocation Property  | A process cannot request higher access, only with subjects at equal or lower level. |

70004 - Advanced Computer Security/Discretionary Access Control.md

@@ -0,0 +1,3 @@
+## Definition
+- Users can change access controls for resources (e.g. files) they have ownership of / permissions to modify permissions of
+- Implemented in standard Operating Systems (Linux, Windows, BSD, MacOS)

70004 - Advanced Computer Security/Mandatory Access Control.md

@@ -0,0 +1,5 @@
+Access control decisions cannot be changed by normal users.
+- System wide set of enforced rukes
+- Normal (i.e. non root) users cannot change permissions ([[Control Schema]])
+Offers stronger guarantees than [[Discretionary Access Control]] (does not trust normal users).
+

70004 - Advanced Computer Security/Multi-Level Security.md

@@ -0,0 +1,22 @@
+## Definition
+Enforced orthogonally to [[Security Enhanced Linux#Type Enforcement]].
+```python
+f"{user}:{role}:{type}:{security_level}" with 
+security_level = f"{sensitivity}:{category labels}"
+
+# For example:
+"user_u:user_r:user_t:s0-s2:c1,c4.c8"
+```
+- Sensitivity labels can instantiate a [[Bell-LaPadula Model]] or [[Biba Model]].
+- Category labels are used for isolation (e.g. departments in a company-wide system, users on the system).
+## Android
+Encodes multiple users using category field:
+
+| User      | Description             |
+| --------- | ----------------------- |
+| Primary   | Always Running          |
+| Secondary | Background and Network  |
+| Guest     | Only one user at a time |
+Used for managed profiles:
+- parental controls (restricted profile)
+- company managed profiles (work accounts, samsung KNOX)

70004 - Advanced Computer Security/SELinux_flow.svg

@@ -0,0 +1,57 @@
+## Summary
+Introduced by the NSA for securing linux assets.
+- Enforces an admin-defined security policy ([[Mandatory Access Control]]) over all processes, objects and operations.
+- Can confine services and applications (even running as root) to mitigate the risks of flawed or malicious programs
+
+All subjects (processes) and objects (files, ports and other resources) are associated with labels used to describe authorisation.
+
+When an operation occurs (e.g. opening a file), the request is redirected to a *policy engine* which determines if the subject can perform the operation.
+- Deny all by default
+
+![[SELinux_flow.svg]]
+### Advantages
+- Can confine the operations of privileged system daemons (reduces the impact of a daemon being misused by a malicious process)
+- Centralized policy configuration is easier to manage and analyse than [[Discretionary Access Control]]'s scattered configuration.
+### Limitations
+- If the vulnerability used is in the kernel.
+- If a security policy is permissive ([[Security Enhanced Linux]] will merely enforce the policy it is given)
+## Type Enforcement
+```python
+# For each subject and object
+f"{user}:{role}:{type}:{security level}"
+
+# for example
+facebook      = f"u:r:facebook:s0:c0" # level: s0 is sensitivity, c0 is category
+sys_directory = f"u:r:sysfs:s0:c0" 
+
+```
+*Note: Android uses the type field to isolate processes, and level to isolate device users*
+- Process types are called *domains*
+- *Domains*/*types* are [[Security Equivalence Classes]]
+- Same *domain*/*type* means same access & the subject/object is identified using this.
+- The security level (sensitivity and zero of more categories) os determined by [[Multi-Level Security]]
+![[domains_and_types.svg]]
+### Rules
+```python
+f"allow {domain} {type}:{class} \{{permissions}\}"
+"allow D1 T2:file read_write_execute"
+
+f"neverallow {domain} {type}:{class} \{{permissions}\}"
+
+# Disallow any system service apart from the dumpstate, shell etc of the domain attribute from executing files
+"neverallow {domain -appdomain -dumpstate -shell -system_server -zygote} {file_type -system_file -exec_type}:file execute" 
+```
+*Note: [AVCRules - SELinux Wiki (selinuxproject.org)](https://selinuxproject.org/page/AVCRules)* 
+- `neverallow` is used to ensure no `allow` rules are added in future that accidentally conflict (the `checkpolicy` compiler issues a warning).
+- The last rule in a conflict is chosen
+## Configuration
+
+| Path                  | Description                                                                                                                        |
+| --------------------- | ---------------------------------------------------------------------------------------------------------------------------------- |
+| `*.te`                | Type Enforcement files (`D1.te`, `D2.te`, etc.) containing rules for a domain.                                                     |
+| `file_contexts`       | File security contexts (labels for `\sys` at build time, `\dev, \data` at runtime).                                                |
+| `mac_permissions.xml` | Assigns a seinfo tag to applications based on their signature (and optionally package name). Configuration is read during startup. |
+| `seapp_contexts`      | Maps app UID (and optionally seinfo) to domain.                                                                                    |
+## Android
+Ported to android in 2012, and adopted in *permissive mode* in `4.3`, *enforcing mode* in `4.4`.
+

70004 - Advanced Computer Security/Security Enhanced Linux.md

@@ -0,0 +1,2 @@
+## Definition
+A grouping of similar/equivalent elements.