Episode #125 of the Stack Overflow podcast is here. We talk Tilde Club and mechanical keyboards. Listen now
9

There are a couple of places that you can see Mandatory Access Control (MAC) systems in operation in consumer OSs, that spring to mind. SELinux is installed on a number of linux distributions and can be set in enforcing mode which would show an example. Also windows Mandatory Integrity Levels are another example. Seeing an example of this could be done by ...


8

I suspect you are slightly confused about how Bell-Lapadula works, and in particular, how categories work in Bell-Lapadula. Classifications are necessarily ordered. In your example, we have Restricted < Confidential < Secret < Top Secret. So far, so good. Categories are, in general, not ordered. Often, they are a set, with no ordering amongst ...


7

The short answer: They are two entirely different kinds of systems. They're just different. Comparing them is a bit like comparing apples and oranges. They are so fundamentally different -- different in so many ways -- that no one-sentence comparison will really do them justice. Oh, that's not good enough for you? OK, then, here's the long answer. ...


7

Capabilities are considered more powerful. They prevent confused deputy attacks, where applications act of behalf of others, and provide a clear paradigm for reducing and delegating permissions. This is important in systems where applications communicate a lot with each other, like Android or microkernel systems. In fact, NICTA advertises that as a result of ...


7

Grsecurity is not a pure pathname-based MAC system like TOMOYO or AppArmor. Policy is described using pathnames (same as every other system, including SELinux), but these are converted to inode/dev pairs at enable time and used thereafter. Pathnames are only used when matching regular expressions from policy or to provide "policy-recreation" -- given the ...


6

As with any security related matter it boils down to risk and cost of mitigation. Below are some additional measures you can take, but some will be quite an investment. This is actually a common problem. Some things you might do to reduce the risk is implementing sessions recorders like Centrify which also limit an administrators access and can re-play ...


6

[Restricted, Confidential, Secret, Top Secret] => [0, 1, 2, 3] //constants [Lieutenant, Colonel, Captain, Lieutenant General, General] => [0, 1, 2, 3, 4] //constants Set this up in a static class similar to how Math.MAX_INT and others work ... Classification.RESTRICTED will return 0. That makes it easy to read from a programmer's standpoint. How your ...


6

I don't think the granularity of permissions that can be achieved is relevant here. It doesn't matter if permission can be assigned to specific users, it matters which users can change permissions. Perhaps the DAC article is more clear about this: In computer security, discretionary access control (DAC) is a type of access control defined by the Trusted ...


5

MAC, in its academic form, is not about access control but about information flow. This is a fundamentally different approach than capabilities. MAC aims to prevents information flow from high to low levels or from low to high, depending on if you're worried about integrity or confidentiality. It's hierarchical that way. Capabilities are not as far as I ...


5

In a discretionary access control system the owner of the source decides who can access data. In a mandatory access control system an admin decides who can access data, which is then typically determined by policy. For example, all files in the ABC directory can only be read by XYZ users. In a MAC system no non-XYZ users could read the file. In a DAC ...


4

The simple way to remember the Bell-LaPadula model is: No read up, no write down. A classification is the label and controls whether the subject (person) can read the object (document, file, etc). For this example I will ignore compartments. Lets create four people Alice, Bob, Charlie, Diana, and Eve. Now lets give each one a laebl: Alice is Confidential, ...


4

I did. You need a plan, and you need to master the tools. You need to be able to compromise where you can and where you have to compromise. You need to work to make it reality. Access control is part of the bigger picture. There is trust involved inevitably. Knowledge about your environment and threats. Trade-offs. Common sense, a healthy dose of paranoia. ...


4

You are asking, whether maliciously or very badly written AppArmor profile can reduce security. Considering this question already states, that you can indeed reduce security using restrictive MAC, using restrictive AppArmor can obviously also decrease security in all the same ways, possible in some additional new ways as well. So YES, it indeed can decrease ...


3

Transmute feature in Smack solves a problem of two applications running with different Smack rules sharing data in a single directory. First of all, both applications need write ('w') and execute ('x') access to label of the directory in order to be able to write into it. But the files that would be created will have Smack label of the process that created ...


3

On a practical level MAC (as implemented in SELinux) requires all objects (files, directories, processes, and users) in the system to be labeled. A default label is given to objects not otherwise specified. It also requires a policy describing what types of access labeled objects are allowed. A monitor watches access requests and compares labels to the ...


2

No, HIPS is fundamentally different than MAC. Mandatory access control (MAC) systems try to provide a robust foundation for security on your machine. MAC systems are generally intended to provide a high level of assurance: they are based upon a rigorous mathematical theory, they try to provide strong guarantees, and they are intended to be secure even if ...


2

By default AppArmor whitelists all applications/programs. To setup apparmor so all applications/programs by default are blacklisted then you need to setup AppArmor Full System Policy. This is not a simple task but can definitely be done. Refer to the link for the details: https://gitlab.com/apparmor/apparmor/wikis/FullSystemPolicy


2

would defense-in-depth still be achieved even though all three security controls have at least one common attack surface? No, you can see it very well with anti-virus software for instance: they look like defense in depth as they put protection systems at several layers (network firewall, browser plugin, process monitoring, file analyzing, etc.), however an ...


2

Generally capabilities are a good way of implementing a Mandatory Access Control system (see Eros OS, for example). The Linux system capabilities affect objects which can be under both DAC and MAC. They also don't seem to break the possibility to do MAC since you can limit altering capabilities using the bounding set. Once you remove the ability to ...


2

I think, pathname based access control in general is not flawed conceptually at all, it may even have advantages, but current implementations are not convenient. Advantage is that you can have cleaner and more understandable policy specified in the single place, and you don't have complications of xattrs spreading over whole filesystem. Thinkability, I say, ...


2

https://thumbs.gfycat.com/AcrobaticLegitimateAnura-mobile.mp4 As the name suggests, these are models, and not implementations. Bell-LaPadula provided a framework that guided how to think about confidentiality (and that significantly impacted the military clearance system) but it is not actively the source of any modern systems security. from: ...


1

I cant give a scenario but I can tell you the difference in location. Physical Location in your terms refer to where your access the site from, as in a physical address. The logical address is what device you are using. Because Full blown computers are now the size of cell phones, the definitions have to change to better suit the understanding. Also you ...


1

Controls of any type are implementation mechanisms; the Parkerian Hexad are goals or assets. You would implement access controls to ensure that the set of potential actions affecting these goals are limited to only the set of actions that are explicitly permitted. Access controls are an answer to the question: What have you done to ensure that the system ...


1

Looking back at the wikipedia page you linked to, I can see access control falling into the first bullet, confidentiality. Quoting Wikipedia Confidentiality refers to limits on who can get what kind of information. For example, executives concerned about protecting their enterprise’s strategic plans from competitors; individuals are concerned about ...


1

No, the intended difference is that MAC says the security officer has given me access to, for example, the SDE compartment. Within it, there are files I can set (DAC) acls on, but no matter what access I assign you, the MAC will stop you from reading those files unless you also have been cleared for access to SDE. Discretionary access is under my control ...


1

You're hitting upon one of the dirty secrets of infosec: MAC and DAC are fundamentally the same thing. They both provide access control, they just have different concepts what a "user", an "administrator", and a "resource" are. There's a reason that MAC didn't become popular until the age of computers administered by people who don't actually use them ...


1

A Linux system contains a lot of "applications" -- do a ls /usr/bin to see it. Many of these must be launched regularly for proper system operation, not only at boot but also afterwards. Also, a lot of applications rely on the ability to launch these other applications, without necessarily making it apparent to the human user. Anything which looks like a ...


Only top voted, non community-wiki answers of a minimum length are eligible