3

Getting it out of the way: Not iptables!

What I'd like to do is block network access to certain IPs, subnets, and/or hostnames at the Linux kernel level, such that no user, including root, could bypass them once the system is running.

I actually do have a specific need for this, but I won't get into the details since it doesn't change the question.

Additional restrictions:

  • Is running unvirtualized on bare-hardware.
  • No access to upstream networking devices.
  • Not running SELinux (but feel free to give responses that use SELinux for the benefit of others).

Ideally root would be unable to remove the access restrictions in any way, but if root were still able to remove them in extreme ways such as directly overwriting in-memory structures, that would still be ok.

2
  • 1
    Preventing root from doing something? Thats unpossilbe!
    – rook
    May 3, 2013 at 4:57
  • I like that word, "unpossilbe" :)
    – Tek Tengu
    May 3, 2013 at 9:46

5 Answers 5

3

"Root is God". Well, there are gods... and then, there are elder gods.

The root user can do a lot of things on a machine. In particular, he can replace the files which are used to boot the machine; thus, he can potentially replace your kernel with another of his own, which would let him pass. SELinux can be used as a way to make a declawed, neutered root who will be limited in some ways, so no longer the real root user; in particular, forcing any escape to go through a reboot of the machine. However, it is hard to block all paths and, arguably, the Linux kernel and SELinux are way too complex to be bug-free -- therefore, there MUST exist local exploits allowing at least root to go in full-physical mode.

Also, there are devious ways to escape network filters. For instance, root could access the network interface at the ethernet level and emit and receive ethernet frames by himself, completely bypassing the TCP/IP stack of the kernel, thus unaffected by any blocking filter you would have inserted at that level (and, for that matter, it would bypass iptables as well).


To really contain root, overawe him with heavy artillery. I mean a Virtual Machine. Make the Linux system run in a VM; all external network traffic to and from the VM will go through the VM manager system, which can then block and allow in any way as you see fit, completely outside of reach of the evil root, regardless of what he does. This would even work if the evil root replaced the whole system with NetBSD or Windows or anything else.

The VM arrangement requires that the VM is effective at containing the guest and preventing it from tapping into the host. This requires a bit of faith, but much less than believing that something as complex as SELinux or the Unix permission system could accomplish the same level of isolation reliability.

3

Filtering arbitrary connections could be done with a kernel module by hooking netfilter. And anything done in kernel land with a kernel module, can be undone with a kernel module. Also, nothing is keeping root form just installing their own kernel...

root is GOD, never forget that.

2
  • This is interesting, but it's too easy to just remove the module using rmmod. Building the netfilter hooks into a recompiled kernel might be possible, although none of the examples that I found online show that method.
    – Animism
    May 13, 2013 at 16:43
  • @Animism any module can be built into a compiled kernel, and root can change or modify what kernel they are using and reboot. root is god.
    – rook
    May 13, 2013 at 17:17
1

So Rook's answer to you is yes/no. Basically without downloading the linux kernel source and rewriting some of it yourself, what he proposes is your answer. You could do most of what you want, but you could not achieve preventing root from being able to bypass changing it.

You could make it so that you have root account that never sees the light of day, and a secondary (through sudo like capabilities) root like account that does have the restriction and is prevented from changing it.

Or you could have your machine so that you have every login chroot jailed into a subordinate environment that could never see your outer scope that had the module changes.

So you can get some of the way there, but without hardware implementation, or some rewriting of the OS, not all of the way.

1

Rook is correct, of course. Given that you would be setting this up as root, someone could just as easily take it apart as root. However, you could make that time consuming.

The most direct approach would be to edit sys_socket.c, or perhaps just socket.c (the usermode-wrapper) to include a IP filter.

If you edit sys_socket.c you would have to recompile the kernel, but someone would have to boot a different kernel to undo your work, whereas recompiling socket.c should be a little easier to both implement and undo.

However the best approach would be to go buy a little basic IP firewall, and block the hosts on that.

0

Root is not god if you have SELinux enabled. That is the only way I can see to accomplish what you want. Block it with iptables and run SELinux in strict mode.

You might have uid 0 but you won't have the capabilities(7).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .