Practical techniques to obviate setuid-to-root binaries

Abstract

Trusted, setuid-to-root binaries have been a substantial, long-lived source of privilege escalation vulnerabilities on Unix systems. Prior work on limiting privilege escalation has only considered privilege from the perspective of the administrator, neglecting the perspective of regular users-the primary reason for having setuid-to-root binaries.The paper presents a study of the current state of setuidto-root binaries on Linux, focusing on the 28 most commonly deployed setuid binaries in the Debian and Ubuntu distributions. This study reveals several points where Linux kernel policies and abstractions are a poor fit for the policies desired by the administrator, and root privilege is used to create point solutions. The majority of these point solutions address 8 system calls that require administrator privilege, but also export functionality required by unprivileged users. This paper demonstrates how least privilege can be achieved on modern systems for non-administrator users. We identify the policies currently encoded in setuid-to-root binaries, and present a framework for expressing and enforcing these policy categories in the kernel. Our prototype, called Protego, deprivileges over 10,000 lines of code by changing only 715 lines of Linux kernel code. Protego also adds additional utilities to keep the kernel policy synchronized with legacy, policy-relevant configuration files, such as /etc/sudoers. Although some previously-privileged binaries may require changes, Protego provides users with the same functionality as Linux and introduces acceptable performance overheads. For instance, a Linux kernel compile incurs less than 2% overhead on Protego.

PoLPer

“…Several approaches [11,17,28] have investigated the status of setuid system calls and identified their semantic inconsistency. This problem occurred with human errors because they were insufficiently documented and poorly designed.…”

Thin Hypervisor-Based User Authentication Mechanism for Linux Security Modules

“…In other words, the same vulnerability described earlier exists for all applications involved with authentication such as login and su. By the way, the same problem exists in project Protego [7], which spares no effort to deprivilege privileged codes.…”

A study of modern Linux API usage and compatibility

“…Debian packages have been analyzed to study the evolution of the software itself [29,37,45], to measure the popularity of application programming languages [10], to analyze dependencies between the packages [23], to identify trends in package sizes [12], the number of developers involved in developing and maintaining a package [44], and estimating the cost of development [11]. Jain et al used popularity contest survey data to prioritize the implementation effort for new system security policies [33]. This study is unique in using this information to infer the relative importance of of system APIs to end users, based on frequency of application installation.…”