www.Lucq.org

Adding POSIX/1.e extensions to OpenBSD

Introduction and disclaimer

Even though OpenBSD has a good track record in the area of security (especially through the code auditing process), it lacks several operating system features for increased security. The (now defunct) draft POSIX/1.e extensions are an example of this; they include features such as fine-grained filesystem access control lists (ACLs), mandatory access control (MAC), capabilities, and fine-grained system auditing. On this page I provide some patches that attempt to integrate some of these features into OpenBSD. They include ports of other people's code, as well as some code of my own. If you have remarks or questions, feel free to drop me a note (but note that I this code is not a priority for me, I work on it when I have time and when I am in the mood). In general, you should use OpenBSD-current to test these patches, and you should use the most recent version of the patch.

I cannot be held responsible for direct or indirect damage, or any other consequence, of using, not using, or using incorrectly the information contained on this page, or linked to from this page.

Reference information

• The TrustedBSD project (http://www.trustedbsd.org/), which aims to integrate advanced security features into FreeBSD.
• The (defunct) POSIX/1.e draft standard, Posix_1003.1e-990310.pdf.
• The (defunct) POSIX/2.c draft standard, Posix_1003.2c-990310.pdf.
• Summary about POSIX/1.e (http://wt.xpilot.org/publications/posix.1e/).

Filesystem ACLs

Currently OpenBSD uses the traditional UNIX user/group/world filesystem access rights. This patch, which is an OpenBSD port of the ACL code from FreeBSD 5.0 (the original ACL code was written by people from the TrustedBSD project), attempts to introduce more fine-grained filesystem ACLs into OpenBSD. These extend the existing mechanism by allowing permissions to be granted on a discretionary basis to more than one user and/or group. These filesystem ACLs currently rely on the presence of the extended attribute code.

Trusted auditing

At the moment, OpenBSD lacks an industry-grade auditing subsystem. Such a subsystem would allow an administrator to collect detailed information about the actions taken by users of a system, and by daemons, with sufficient information about each action (e.g. time stamp, user and process information, status of the action, etc.). The audit component of the POSIX/1.e draft standard provides a reasonable starting point for such an audit framework. The code provided here is a port of the initial TrustedBSD audit effort, which attempted to implement such an audit subsystem.

Note that development has halted for now on this component, since its structure needs to be rethought, in order to minimize the performance hit this subsystem implies, and in order to properly integrate it with other components.

NETWORK_PORT_ACL

In a traditional BSD-ish UNIX a process needs to be UID 0 in order to be able to bind to one of the so-called privileged network (TCP/UDP) ports (these are the TCP/UDP ports in the range 1 through 1023). In my opinion this requirement is hideous; it is one of the reasons that processes like named and httpd need to start out as root. This patch tries to address this, by providing a simplistic ACL model for privileged port binding. For example, you can now allow UID 67 (user “www”) to bind to port 80 (and only to this port).

To install, first apply the patch to your kernel sources. Then, make sure option NETWORK_PORT_ACL is enabled, and recompile the kernel and userland, and reboot with the new kernel. Then, check the EXAMPLES section in sysctl(8) for information on how to set things up.

Also note that this is strictly speaking not a POSIX/1.e extension; it's something of my own imagination instead.