Is RBAC unbreakable ?

[evilangel]

Hey all,

With such a provocative title, my question is totally candid.
According to all documents I read, MAC/RBAC seems to be a powerfull protection, preventing a lot of compromission.

Naturally, I am wondering "how much" it is safe.

As with the root identity, is a privilege escalation to the admin of the RBAC system possible ?

Is there some case where a MAC system has been defeated ?
In which condition a MAC system stops being efficient ?

Thanks for any informatio

[cormander]

Bottom line; if it can be made by man, it can be unmade by man.

The RBAC system is very powerful, but can fail under one of the following conditions:

1) a hacker is able to write/modify the data structure of the running kernel. This is possible if a hacker gains root privileges and certain grsecurity protections aren't enable (such as disabling module inserts at runtime)
2) there is an exploit in the kernel which allows anyone to arbitrarily write to kernel memory (vmsplice was the most recent one that I know of)
3) a hacker has console access to your hardware and reboots under a different kernel or boots with single user mode (or init=/bin/bash) under which RBAC probably won't have a chance to get re-enabled.

As far as the writes to kernel memory, they basically can guess where the symbols for grsec are and replace them with their own code, effectivly disabling the RBAC protections. This is quite difficult to do, especially if you have the option enabled to hide all exported symbols (it really becomes a guessing game at that point). The risk they take on writes to kernel memory is getting past PAX (which will, depending on your PAX configuration, stop these attempts) and writting to kernel memory at runtime can make the kernel unstable and crash the system, so you have a DOSS'd system rather then a full compromised system.

[evilangel]

Thanks for these info.

1) a hacker is able to write/modify the data structure of the running kernel. This is possible if a hacker gains root privileges and certain grsecurity protections aren't enable (such as disabling module inserts at runtime)

A kernel that do not support Linux Kernel Modules is protected, no ?

[cormander]

Yes, but grsecurity has the facility to turn on the disabling of modules at runtime (which cannot be undone without a reboot).

[evilangel]

OK
Thanks