slides/slides04.tex
changeset 405 6a54ee8b74c3
parent 404 4e3bc09748f7
child 406 0516bffd3f5f
equal deleted inserted replaced
404:4e3bc09748f7 405:6a54ee8b74c3
   109 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   
   109 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   
   110 
   110 
   111 
   111 
   112 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
   112 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
   113 \begin{frame}[c]
   113 \begin{frame}[c]
   114 \frametitle{\begin{tabular}{c}Network Applications:\\[-1mm] Privilege Separation\end{tabular}}
   114 \frametitle{\begin{tabular}{c}Network Applications:\\[-1mm] 
       
   115             Privilege Separation\end{tabular}}
   115 
   116 
   116 
   117 
   117 \begin{center}
   118 \begin{center}
   118   \begin{tikzpicture}[scale=1]
   119   \begin{tikzpicture}[scale=1]
   119   
   120   
   139   consequences of an attack
   140   consequences of an attack
   140 \end{itemize}
   141 \end{itemize}
   141 \end{frame}
   142 \end{frame}
   142 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%     
   143 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%     
   143 
   144 
   144 
   145 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
   145 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
   146 \begin{frame}[c]
   146 \mode<presentation>{
   147 \frametitle{Access Control in Unix}
   147 \begin{frame}[c]
   148 
   148 \frametitle{\begin{tabular}{@ {}c@ {}}Infamous Security Flaws\\[-1mm] in Unix\end{tabular}}
   149 \begin{itemize}
   149 
   150 \item access control provided by the OS
   150 
   151 \item authenticate principals
   151 \begin{itemize}
   152 \item mediate access to files, ports, processes etc according to
   152 \item \texttt{lpr} unfortunately runs with root privileges; you had the option to delete files after printing \ldots\pause\pause
   153   \alert{roles} (user ids)\\
       
   154 \item roles get attached with privileges (some special roles: root)\bigskip\\
       
   155 
       
   156 \hspace{8mm}
       
   157 \begin{bubble}[8cm]
       
   158 \alert{principle of least privilege:}\\
       
   159 users and programs should only have as much privilege as they need to
       
   160 accomplish a task
       
   161 \end{bubble}
       
   162 \end{itemize}
       
   163 
       
   164 \end{frame}
       
   165 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%     
       
   166 
       
   167 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%     
       
   168 \begin{frame}[c]
       
   169 \frametitle{Access Control in Unix (2)}
       
   170 
       
   171 
       
   172 \begin{itemize}
       
   173 \item privileges are specified by file access permissions (``everything is a file'')\medskip 
       
   174 \item there are 9 (plus 2) bits that specify the permissions of a file
       
   175 \end{itemize}
       
   176 
       
   177 \begin{center}
       
   178 ${\underbrace{\LARGE\texttt{-}}_{\text{\makebox[0mm]{directory}}}}
       
   179  \;{\underbrace{\LARGE\texttt{r{}-{}-}}_{\text{user}}}\,
       
   180  {\underbrace{\LARGE\texttt{r{}w{}-}}_{\text{group}}}\,
       
   181  {\underbrace{\LARGE\texttt{r{}w{}x}}_{\text{other}}}\;\;\;
       
   182  \LARGE\texttt{bob}\;\;\texttt{staff}\;\;\texttt{file}$
       
   183 \end{center}  
       
   184   
       
   185 \end{frame}
       
   186 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%     
       
   187    
       
   188 
       
   189 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
       
   190 \begin{frame}[c]
       
   191 \frametitle{Unix-Style Access Control}
       
   192 \small
       
   193 
       
   194 \begin{itemize}
       
   195 \item 
       
   196 Q: ``I am using Windows. Why should I care?'' \\ 
       
   197 A: In Windows you have similar AC:
       
   198 
       
   199 \begin{center}
       
   200 \begin{tabular}{l}
       
   201 administrators group\\ 
       
   202 \hspace{5mm}(has complete control over the machine)\\
       
   203 authenticated users\\
       
   204 server operators\\
       
   205 power users\\
       
   206 network configuration operators
       
   207 \end{tabular}
       
   208 \end{center}\medskip
       
   209 
       
   210 \item Modern versions of Windows have more fine-grained AC than Unix;
       
   211   they do not have a setuid bit, but have \texttt{runas} (asks for a
       
   212   password).\pause
       
   213 
       
   214 \item OS-provided access control can \alert{\bf add} to your security.
       
   215   (defence in depth)
       
   216 \end{itemize}
       
   217   
       
   218 \end{frame}
       
   219 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   
       
   220 
       
   221 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
       
   222 \begin{frame}[c]
       
   223 \frametitle{Weaknesses of Unix AC}
       
   224 
       
   225 Not just restricted to Unix:
       
   226 
       
   227 \begin{itemize}
       
   228 \item if you have too many roles (i.e.~too finegrained AC), then
       
   229   hierarchy is too complex\\ \textcolor{gray}{you invite situations
       
   230     like\ldots let's be root}\bigskip
       
   231 
       
   232 \item you can still abuse the system\ldots
       
   233 \end{itemize}
       
   234 
       
   235 \end{frame}
       
   236 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   
       
   237 
       
   238 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
       
   239 \begin{frame}[c]
       
   240 \frametitle{A ``Cron''-Attack}
       
   241 
       
   242 The idea is to trick a privileged person to do something on your
       
   243 behalf:
       
   244 
       
   245 \begin{itemize}
       
   246 \item root:\\\texttt{rm /tmp/*/*}\bigskip\bigskip\pause
       
   247 
       
   248 \footnotesize
       
   249 \begin{minipage}{1.1\textwidth}
       
   250 \textcolor{gray}{the shell behind the scenes:}\\
       
   251 \textcolor{gray}{\texttt{rm /tmp/dir$_1$/file$_1$ /tmp/dir$_1$/file$_2$ /tmp/dir$_2$/file$_1$ \ldots}}\bigskip\\
       
   252 
       
   253 \textcolor{gray}{this takes time}
       
   254 \end{minipage}
       
   255 \end{itemize}
       
   256 
       
   257 \end{frame}
       
   258 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   
       
   259 
       
   260 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
       
   261 \begin{frame}[c]
       
   262 \frametitle{A ``Cron''-Attack}
       
   263 
       
   264 \begin{enumerate}
       
   265 \item attacker \textcolor{gray}{(creates a fake passwd file)}\\ 
       
   266 \texttt{mkdir /tmp/a; cat > /tmp/a/passwd}\medskip
       
   267 \item root \textcolor{gray}{(does the daily cleaning)}\\
       
   268 \texttt{rm /tmp/*/*}\medskip\\
       
   269 \hspace{2cm}\textcolor{gray}{\small records that \texttt{/tmp/a/passwd}}\\ 
       
   270 \hspace{2cm}\textcolor{gray}{\small should be deleted, but does not do it yet}\medskip\\
       
   271 
       
   272 \item attacker \textcolor{gray}{(meanwhile deletes the fake passwd file, and establishes a link to 
       
   273 the real passwd file)}\\
       
   274 \texttt{rm /tmp/a/passwd; rmdir /tmp/a;}\\\texttt{ln -s /etc /tmp/a}\\
       
   275 \item root now deletes  the real passwd file
       
   276 \end{enumerate}
       
   277 
       
   278 \only<2>{
       
   279 \begin{textblock}{11}(2,5)
       
   280 \begin{bubble}[8cm]
       
   281 \normalsize To prevent this kind of attack, you need additional
       
   282 policies (don't do such operations as root).
       
   283 \end{bubble}
       
   284 \end{textblock}}
       
   285 
       
   286 \end{frame}
       
   287 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   
       
   288 
       
   289 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
       
   290 \begin{frame}[c]
       
   291 \frametitle{\begin{tabular}{c}Infamous Security Flaws\\[-1mm] 
       
   292 in Unix\end{tabular}}
       
   293 
       
   294 
       
   295 \begin{itemize}
       
   296 \item \texttt{lpr} unfortunately runs with root privileges; you had the option to delete files after printing \ldots\pause
   153 \item for debugging purposes (FreeBSD) Unix provides a ``core dump'', but allowed to follow links \ldots\pause
   297 \item for debugging purposes (FreeBSD) Unix provides a ``core dump'', but allowed to follow links \ldots\pause
   154 \item \texttt{mkdir foo} is owned by root\medskip
   298 \item \texttt{mkdir foo} is owned by root\medskip
   155 \begin{center}
   299 \begin{center}
   156 \texttt{-rwxr-xr-x  1 root  wheel /bin/mkdir}
   300 \texttt{-rwxr-xr-x  1 root  wheel /bin/mkdir}
   157 \end{center}\medskip
   301 \end{center}\medskip
   158 it first creates an i-node as root and then changes to ownership to the user's id\\ \textcolor{gray}{\small (race condition -- can be automated with a shell script)}
   302 it first creates an i-node as root and then changes to ownership to the user's id\\ \textcolor{gray}{\small (race condition -- can be automated with a shell script)}
   159 \end{itemize}
   303 \end{itemize}
   160 
   304 
   161 \only<5->{
   305 \only<4->{
   162 \begin{textblock}{1}(3,7)
   306 \begin{textblock}{1}(3,7)
   163 \begin{tikzpicture}
   307 \begin{tikzpicture}
   164 \draw (0,0) node[inner sep=2mm,fill=cream, ultra thick, draw=red, rounded corners=2mm] 
   308 \draw (0,0) node[inner sep=2mm,fill=cream, ultra thick, draw=red, rounded corners=2mm] 
   165 {\begin{minipage}{8cm}
   309 {\begin{minipage}{8cm}
   166 Only failure makes us experts.
   310 Only failure makes us experts.
   167 	-- Theo de Raadt (OpenBSD, OpenSSH)
   311 	-- Theo de Raadt (OpenBSD, OpenSSH)
   168 \end{minipage}};
   312 \end{minipage}};
   169 \end{tikzpicture}
   313 \end{tikzpicture}
   170 \end{textblock}}
   314 \end{textblock}}
   171 
   315 
   172 \end{frame}}
   316 \end{frame}
   173 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   
   317 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   
   174 
   318 
   175 
       
   176 
       
   177 
       
   178 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
       
   179 \begin{frame}[c]
       
   180 \frametitle{Unix-Style Access Control}
       
   181 
       
   182 How to do control access? In Unix you have
       
   183 
       
   184 \begin{itemize}
       
   185 \item users and you have groups/roles:
       
   186 \item some special roles: root
       
   187 \end{itemize}
       
   188   
       
   189 \end{frame}
       
   190 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   
       
   191 
       
   192 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
       
   193 \begin{frame}[c]
       
   194 \frametitle{Unix-Style Access Control}
       
   195 \small
       
   196 
       
   197 \begin{itemize}
       
   198 \item 
       
   199 Q: ``I am using Windows. Why should I care?'' \\ 
       
   200 A: In Windows you have similar AC:
       
   201 
       
   202 \begin{center}
       
   203 \begin{tabular}{l}
       
   204 administrators group\\ 
       
   205 \hspace{5mm}(has complete control over the machine)\\
       
   206 authenticated users\\
       
   207 server operators\\
       
   208 power users\\
       
   209 network configuration operators
       
   210 \end{tabular}
       
   211 \end{center}\medskip
       
   212 
       
   213 \item Modern versions of Windows have more fine-grained AC than Unix;
       
   214   they do not have a setuid bit, but have \texttt{runas} (asks for a
       
   215   password).\pause
       
   216 
       
   217 \item OS-provided access control can \alert{\bf add} to your security.
       
   218   (defence in depth)
       
   219 \end{itemize}
       
   220   
       
   221 \end{frame}
       
   222 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   
       
   223 
       
   224 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
       
   225 \begin{frame}[c]
       
   226 \frametitle{\begin{tabular}{c}Network Applications:\\[-1mm] Privilege Separation\end{tabular}}
       
   227 
       
   228 
       
   229 \begin{center}
       
   230   \begin{tikzpicture}[scale=1]
       
   231   
       
   232   \draw[line width=1mm] (-.3, 0) rectangle (1.5,2);
       
   233   \draw (4.7,1) node {Internet};
       
   234   \draw (-2.7,1.7) node {\footnotesize Application};
       
   235   \draw (0.6,1.7) node {\footnotesize Interface};
       
   236   \draw (0.6,-0.4) node {\footnotesize \begin{tabular}{c}unprivileged\\[-1mm] process\end{tabular}};
       
   237   \draw (-2.7,-0.4) node {\footnotesize \begin{tabular}{c}privileged\\[-1mm] process\end{tabular}};
       
   238   
       
   239   \draw[line width=1mm] (-1.8, 0) rectangle (-3.6,2);
       
   240 
       
   241   \draw[white] (1.7,1) node (X) {};
       
   242   \draw[white] (3.7,1) node (Y) {};
       
   243   \draw[red, <->, line width = 2mm] (X) -- (Y);
       
   244  
       
   245   \draw[red, <->, line width = 1mm] (-0.6,1) -- (-1.6,1);
       
   246   \end{tikzpicture}
       
   247 \end{center}
       
   248 
       
   249 \begin{itemize}
       
   250 \item the idea is make the attack surface smaller and mitigate the
       
   251   consequences of an attack
       
   252 \end{itemize}
       
   253 
       
   254 \end{frame}
       
   255 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%     
       
   256 
       
   257 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
       
   258 \begin{frame}[c]
       
   259 \frametitle{Weaknesses of Unix AC}
       
   260 
       
   261 Not just restricted to Unix:
       
   262 
       
   263 \begin{itemize}
       
   264 \item if you have too many roles (i.e.~too finegrained AC), then
       
   265   hierarchy is too complex\\ \textcolor{gray}{you invite situations
       
   266     like\ldots let's be root}\bigskip
       
   267 
       
   268 \item you can still abuse the system\ldots
       
   269 \end{itemize}
       
   270 
       
   271 \end{frame}
       
   272 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   
       
   273 
       
   274 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
       
   275 \begin{frame}[c]
       
   276 \frametitle{A ``Cron''-Attack}
       
   277 
       
   278 The idea is to trick a privileged person to do something on your
       
   279 behalf:
       
   280 
       
   281 \begin{itemize}
       
   282 \item root:\\\texttt{rm /tmp/*/*}\bigskip\bigskip\pause
       
   283 
       
   284 \footnotesize
       
   285 \begin{minipage}{1.1\textwidth}
       
   286 \textcolor{gray}{the shell behind the scenes:}\\
       
   287 \textcolor{gray}{\texttt{rm /tmp/dir$_1$/file$_1$ /tmp/dir$_1$/file$_2$ /tmp/dir$_2$/file$_1$ \ldots}}\bigskip\\
       
   288 
       
   289 \textcolor{gray}{this takes time}
       
   290 \end{minipage}
       
   291 \end{itemize}
       
   292 
       
   293 \end{frame}
       
   294 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   
       
   295 
       
   296 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
       
   297 \begin{frame}[c]
       
   298 \frametitle{A ``Cron''-Attack}
       
   299 
       
   300 \begin{enumerate}
       
   301 \item attacker \textcolor{gray}{(creates a fake passwd file)}\\ 
       
   302 \texttt{mkdir /tmp/a; cat > /tmp/a/passwd}\medskip
       
   303 \item root \textcolor{gray}{(does the daily cleaning)}\\
       
   304 \texttt{rm /tmp/*/*}\medskip\\
       
   305 \hspace{2cm}\textcolor{gray}{\small records that \texttt{/tmp/a/passwd}}\\ 
       
   306 \hspace{2cm}\textcolor{gray}{\small should be deleted, but does not do it yet}\medskip\\
       
   307 
       
   308 \item attacker \textcolor{gray}{(meanwhile deletes the fake passwd file, and establishes a link to 
       
   309 the real passwd file)}\\
       
   310 \texttt{rm /tmp/a/passwd; rmdir /tmp/a;}\\\texttt{ln -s /etc /tmp/a}\\
       
   311 \item root now deletes  the real passwd file
       
   312 \end{enumerate}
       
   313 
       
   314 \only<2>{
       
   315 \begin{textblock}{11}(2,5)
       
   316 \begin{bubble}[8cm]
       
   317 \normalsize To prevent this kind of attack, you need additional
       
   318 policies (don't do such operations as root).
       
   319 \end{bubble}
       
   320 \end{textblock}}
       
   321 
       
   322 \end{frame}
       
   323 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   
       
   324 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
       
   325 \begin{frame}[fragile]
       
   326 \frametitle{D-Link Backdoors}
       
   327 
       
   328 D-Link router flaw lets anyone login through "Joel's Backdoor":\medskip
       
   329 
       
   330 \begin{quote}\rm\small
       
   331 If you tell your browser to identify itself as Joel's backdoor, instead of (say) 
       
   332 as Mozilla/5.0 AppleWebKit/536.30.1 Version/6.0.5, you're in without authentication.\medskip
       
   333   
       
   334 "What is this string," I hear you ask?
       
   335 
       
   336 You will laugh: it is\pause 
       
   337 
       
   338 \begin{center}\large
       
   339 \pcode{xmlset_roodkcableoj28840ybtide}
       
   340 \end{center}
       
   341 \end{quote}\bigskip\bigskip
       
   342 
       
   343 \hfill\footnotesize October 15, 2013\\
       
   344 \hfill\footnotesize\url{http://www.devttys0.com/2013/10/reverse-engineering-a-d-link-backdoor/}
       
   345 
       
   346 \end{frame}
       
   347 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   
       
   348 
       
   349 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
       
   350 \begin{frame}[fragile]
       
   351 
       
   352 CVE-2014-0476 \pcode{chkrootkit} vulnerability 4 Jun'14\medskip
       
   353 
       
   354 \begin{quote}\rm\small
       
   355 Hi,
       
   356 
       
   357 we just found a serious vulnerability in the chkrootkit package, which
       
   358 may allow local attackers to gain root access to a box in certain
       
   359 configurations (\pcode{/tmp} not mounted noexec). Steps to reproduce:
       
   360 
       
   361 \begin{itemize}
       
   362 \item Put an executable file named \pcode{update} with non-root owner in 
       
   363 \pcode{/tmp} (not mounted noexec, obviously)
       
   364 \item Run chkrootkit (as uid \pcode{0})
       
   365 \end{itemize}
       
   366 
       
   367 Result: The file \pcode{/tmp/update} will be executed as root, thus effectively
       
   368 rooting your box, if malicious content is placed inside the file.
       
   369 
       
   370 If an attacker knows you are periodically running chkrootkit (like in
       
   371 \pcode{cron.daily}) and has write access to \pcode{/tmp} (not mounted noexec), he may
       
   372 easily take advantage of this.
       
   373 \end{quote}
       
   374 \mbox{}\\[-10mm]
       
   375 
       
   376 \hfill\footnotesize\url{http://seclists.org/oss-sec/2014/q2/430}
       
   377 
       
   378 \end{frame}
       
   379 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   
       
   380 
       
   381 
       
   382 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
       
   383 \begin{frame}[c]
       
   384 \frametitle{Access Control in Unix}
       
   385 
       
   386 \begin{itemize}
       
   387 \item access control provided by the OS
       
   388 \item authenticate principals
       
   389 \item mediate access to files, ports, processes etc according to
       
   390   \alert{roles} (user ids)\\
       
   391 \item roles get attached with privileges\bigskip\\
       
   392 
       
   393 \hspace{8mm}
       
   394 \begin{bubble}[8cm]
       
   395 \alert{principle of least privilege:}\\
       
   396 users and programs should only have as much privilege as they need to
       
   397 accomplish a task
       
   398 \end{bubble}
       
   399 \end{itemize}
       
   400 
       
   401 \end{frame}
       
   402 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%     
       
   403 
       
   404 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
       
   405 \mode<presentation>{
       
   406 \begin{frame}[c]
       
   407 \frametitle{Access Control in Unix (2)}
       
   408 
       
   409 
       
   410 \begin{itemize}
       
   411 \item privileges are specified by file access permissions (``everything is a file'')\medskip 
       
   412 \item there are 9 (plus 2) bits that specify the permissions of a file
       
   413 
       
   414 \begin{center}
       
   415 \begin{tabular}{l}
       
   416 \texttt{\$ ls -la}\\
       
   417 \texttt{-rwxrw-r-{}- \hspace{3mm} foo\_file.txt}
       
   418 \end{tabular}
       
   419 \end{center}
       
   420 \end{itemize}
       
   421 
       
   422 \end{frame}}
       
   423 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   
       
   424 
   319 
   425 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
   320 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
   426 \begin{frame}[c]
   321 \begin{frame}[c]
   427 \frametitle{Login Process}
   322 \frametitle{Login Process}
   428 
   323 
   449 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
   344 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
   450 \begin{frame}[c]
   345 \begin{frame}[c]
   451 \frametitle{Setuid and Setgid}
   346 \frametitle{Setuid and Setgid}
   452 
   347 
   453 The solution is that Unix file permissions are 9 + \underline{2 Bits}:
   348 The solution is that Unix file permissions are 9 + \underline{2 Bits}:
   454 \alert{Setuid} and \alert{Setgid} bits
   349 \alert{\bf Setuid} and \alert{\bf Setgid} bits
   455 
   350 
   456 \begin{itemize}
   351 \begin{itemize}
   457 \item When a file with setuid is executed, the resulting process will
   352 \item When a file with setuid is executed, the resulting process will
   458   assume the UID given to the \underline{owner} of the file.
   353   assume the UID given to the \underline{owner} of the file.
   459 \item This enables users to create processes as root (or another
   354 \item This enables users to create processes as root (or another