Getting Memcached Secure      NEC OSS Promotion Center KaiGai Kohei <kaigai@ak.jp.nec.com>
Self Introduction▐ Name             KaiGai Kohei▐ Company          NEC, OSS Promotion Center▐ Works            7 years exp...
1. Memcached and security    Background    Centralized security and SELinux2. Getting Memcached secure    Adjustment of se...
Recent web-systems architecture     Fast, but poor      Fast, but poor      functionality       functionality             ...
What is Memcached▐ Memcached           general purpose, high-performance, distributed memory caches           Typically, u...
Memcached from security perspective (1/2)                    (3) Not run as root                     (3) Not run as root  ...
Memcached from security perspective (2/2)                    Any items                     Any items   Memcached        ac...
Why server software applies access controls▐ How reliable is the security feature?           Consistency and Comprehensive...
More centralized access control (1/2)           PostgreSQL                                                                ...
More centralized access control (2/2)                  a centralized                 security server                      ...
SELinux as a Security Server (1/3)▐ Interactions with object managers           Kernel subsystems do queries via LSM.     ...
SELinux as a Security Server (2/3)▐ Case of Linux Kernel           staff_u:staff_r:staff_t:s0                             ...
SELinux as a Security Server (3/3)▐ Case of Memcached           staff_u:staff_r:staff_t:s0                                ...
1. Memcached and security    Background    Centralized security and SELinux2. Getting Memcached secure    Adjustment of se...
Needed features to be enhanced▐ Memcached needs to get enhanced      1. Facility to retrieve security context of client pr...
Security context of the clients▐ getpeercon(int sockfd, security_context_t *con)           It allows to retrieve security ...
Security context of key/value item  hash_item structure                                      mchunk_t.item   uint32_t nbyt...
memcached - storage engine interface (1/2)▐ What is the storage engine interface?           An upcoming feature in memcach...
memcached - storage engine interface (2/2)   typedef struct engine_interface_v1 {           :   /**     * Retrieve an item...
Flow-chart in GET command                        Protocol                         Parser                     Storage Engin...
selinuxfs and libselinux (1/2) [kaigai@saba ~]$ ls /selinux access                context                                 ...
selinuxfs and libselinux (2/2)extern int security_compute_av(const security_context_t scon,                               ...
Flow-chart in ADD command                        Protocol                         Parser                               sel...
Memcached - selinux engine▐ To obtain the source code     git clone git://github.com/trondn/memcached.git -b engine     sv...
Userspace access vector cache (avc)▐ security_compute_xxx() always invokes a system-call           AVC enables to cache ac...
Benchmark                               default                                default                             selinux...
Summary▐ Why object managers apply access controls           Access control should be centralized            • Consistency...
Any Questions?
Thank you!
Upcoming SlideShare
Loading in...5
×

Getting Memcached Secure

1,553

Published on

slides on LinuxCon Japan 2010

Published in: Technology
0 Comments
0 Likes
Statistics
Notes
  • Be the first to comment

  • Be the first to like this

No Downloads
Views
Total Views
1,553
On Slideshare
0
From Embeds
0
Number of Embeds
0
Actions
Shares
0
Downloads
18
Comments
0
Likes
0
Embeds 0
No embeds

No notes for slide

Getting Memcached Secure

  1. 1. Getting Memcached Secure NEC OSS Promotion Center KaiGai Kohei <kaigai@ak.jp.nec.com>
  2. 2. Self Introduction▐ Name KaiGai Kohei▐ Company NEC, OSS Promotion Center▐ Works 7 years experiences of OSS development » SELinux » PostgreSQL » Memcached » Apache (mod_selinux)▐ Memcached - selinux engine A memcached plugin to apply mandatory access control according to the SELinux policy. Page 2 LinuxCon Japan/Tokyo 2010 - Memcached getting secure
  3. 3. 1. Memcached and security Background Centralized security and SELinux2. Getting Memcached secure Adjustment of security model Engine framework performing with libselinux The selinux_engine.so plugin
  4. 4. Recent web-systems architecture Fast, but poor Fast, but poor functionality functionality Web servers The Internet Key-Value Web application store Slow, but rich Slow, but rich functionality functionality RDBMS End Users Page 4 LinuxCon Japan/Tokyo 2010 - Memcached getting secure
  5. 5. What is Memcached▐ Memcached general purpose, high-performance, distributed memory caches Typically, used to backends of high-traffic web systems Much faster than RDBMS, but less functionalities PostgreSQL Memcached Client Interface SQL memcached protocol Script support OK OK Schemed Data good bad Data Integrity good bad Performance relatively worse good Scaling-out not easy much easier authentication & Security less features access controls Page 5 LinuxCon Japan/Tokyo 2010 - Memcached getting secure
  6. 6. Memcached from security perspective (1/2) (3) Not run as root (3) Not run as root Memcached (2) SASL auth, (2) SASL auth, (1) Firewalling, if needed Web Apps (1) Firewalling, if needed always always Web Server▐ We have few options to keep Memcached secure :-( Should never allow to connect from external network SASL authentication Should never run as root▐ Memcached Security; by Dustin Sallings http://dustin.github.com/2010/08/08/memcached-security.html Page 6 LinuxCon Japan/Tokyo 2010 - Memcached getting secure
  7. 7. Memcached from security perspective (2/2) Any items Any items Memcached accessible! accessible! Perhaps, Perhaps, Web Apps vulnerable? vulnerable? Web Server▐ Our concern No protection from internal threats Buggy application turns an external threats into an internal threat. It means all the application must be FREE from BUGS and VULNERABILITIES! Page 7 LinuxCon Japan/Tokyo 2010 - Memcached getting secure
  8. 8. Why server software applies access controls▐ How reliable is the security feature? Consistency and Comprehensiveness▐ Which is more preferable to apply access control? If each applications apply access control? Some of them may not be right Some of them may check nothing... Access control should be centralized. Access Control Authentication object object Applications Access Control Access object Control object Server Application Access (Object Manager) Control Page 8 LinuxCon Japan/Tokyo 2010 - Memcached getting secure
  9. 9. More centralized access control (1/2) PostgreSQL Memcached SE-PgSQL Table Item Schema Item Table Item Table Item selinux_engine Security Security Server Server SQL memcached protocol LSM File System Security call File File Policy Filesystem SELinux Linux kernel Page 9 LinuxCon Japan/Tokyo 2010 - Memcached getting secure
  10. 10. More centralized access control (2/2) a centralized security server ie; we dont allow classified process to write SELinux Security an object being readable Policy from unclassified process Filesystem Networks classified unclassified information information memcached RDBMS domain of inter process domain of classified processes communication channels unclassified processes Page 10 LinuxCon Japan/Tokyo 2010 - Memcached getting secure
  11. 11. SELinux as a Security Server (1/3)▐ Interactions with object managers Kernel subsystems do queries via LSM. Userspace applications do queries via libselinux. Both of them control users requests according to the decision.▐ Security context as a common identifier system_u:system_r:memcached_t:s0 system_u:object_r:var_log_t:s0 A short formatted text, independent from object classes.▐ Security policy A massive set of access control rules. A rule describes a set of actions to be allowed on a pair of a security context of the subject (process being accessing) and a security context of the object being accessed. Page 11 LinuxCon Japan/Tokyo 2010 - Memcached getting secure
  12. 12. SELinux as a Security Server (2/3)▐ Case of Linux Kernel staff_u:staff_r:staff_t:s0 user_u:user_r:user_t:s0 write(2) write(2) read(2) read(2) user process A Subject: user process B Subject: user_u:user_r:user_t:s0 user_u:user_r:user_t:s0 Applications Object: user_u:object_r:user_home_t:s0 Linux kernel Object: user_u:object_r:user_home_t:s0 Target class: file Target class: file VFS LSM Security Policy file:{getattr read write ...} file:{getattr read write ...} SELinux File X File Y system_u:object_r:etc_t:s0 user_u:object_r:user_home_t:s0 Page 12 LinuxCon Japan/Tokyo 2010 - Memcached getting secure
  13. 13. SELinux as a Security Server (3/3)▐ Case of Memcached staff_u:staff_r:staff_t:s0 user_u:user_r:user_t:s0 SET SET GET GET user process A Subject: user_u:user_r:user_t:s0 userSubject:user_u:user_r:user_t:s0 process B Applications Object: user_u:object_r:user_item_t:s0 Object: user_u:object_r:user_item_t:s0 Memcached Target class: kv_item Linux kernel Target class: kv_item libselinux Protocol Parser Security selinux_engine.so Policy kv_item:{read write ...} kv_item:{read write ...} SELinux Item X Item Y user_u:object_r:user_item_t:s0system_u:object_r:system_ro_item_t:s0 Page 13 LinuxCon Japan/Tokyo 2010 - Memcached getting secure
  14. 14. 1. Memcached and security Background Centralized security and SELinux2. Getting Memcached secure Adjustment of security model Engine framework performing with libselinux The selinux_engine.so plugin
  15. 15. Needed features to be enhanced▐ Memcached needs to get enhanced 1. Facility to retrieve security context of client process 2. Facility to assign security context on key-value item 3. Facility to ask SELinux its access control decision querysystem_u:system_r:user_webapp_t:s0 system_u:object_r:memcached_item_t:s0 system_u:object_r:memcached_item_t:s0 Item Protocol Parser Engine Module web application Item Security Policy Itemsystem_u:system_r:guest_webapp_t:s0 SELinux Page 15 LinuxCon Japan/Tokyo 2010 - Memcached getting secure
  16. 16. Security context of the clients▐ getpeercon(int sockfd, security_context_t *con) It allows to retrieve security context of the client process that connected to the server using sockfd. If UNIX domain socket, no configurations are necessary If TCP/IP socket, also need to set up labeled IPsec.▐ Labeled IPsec It uses an enhanced version of key-exchange daemon that transfers peer security context during IKE exchanges. getpeercon(3) enables to retrieve the delivered one. For more details: Introduction to Labeled Networking on Linux (Paul Moore, HP) http://www.linuxfoundation.jp/jp_uploads/seminar20080709/paul_moore-r1.pdf Page 16 LinuxCon Japan/Tokyo 2010 - Memcached getting secure
  17. 17. Security context of key/value item hash_item structure mchunk_t.item uint32_t nbytes uint16 flags uint16_t nkey uint16_t keylen uint16_t iflag uint32_t datalen mchunk_t.label uint32_t secid uint32_t secid uint32_t refcount Key of item Key of item security context in text form Value of item Value of item▐ SELinux needs key-value item to be labeled But original hash_item is not designed to store a security context.▐ Revised data format that allows to point a certain security context Large number of objects tend to share small number of security contexts Page 17 LinuxCon Japan/Tokyo 2010 - Memcached getting secure
  18. 18. memcached - storage engine interface (1/2)▐ What is the storage engine interface? An upcoming feature in memcached v1.6.x It allows a plugin to provide its mechanism to manage key/value pair. Well designed protocol between the core and engine plugin. • Some plugins may provide persistent storage support. • Some plugins may provide access control. : xxx storage engine memcached protocol plugin interface Protocol Parser selinux SELinux plugin memcached Page 18 LinuxCon Japan/Tokyo 2010 - Memcached getting secure
  19. 19. memcached - storage engine interface (2/2) typedef struct engine_interface_v1 { : /** * Retrieve an item. * * @param handle the engine handle * @param cookie The cookie provided by the frontend * @param item output variable that will receive the located item * @param key the key to look up * @param nkey the length of the key * @param vbucket the virtual bucket id * * @return ENGINE_SUCCESS if all goes well */ ENGINE_ERROR_CODE (*get)(ENGINE_HANDLE* handle, const void* cookie, item** item, const void* key, const int nkey, uint16_t vbucket); : } Page 19 LinuxCon Japan/Tokyo 2010 - Memcached getting secure
  20. 20. Flow-chart in GET command Protocol Parser Storage Engine selinux_get() Interface GET xxx ENGINE_KEY_ENOENT Item exists? No decision security_compute_av() ENGINE_EACCESS /selinux/access Allowed? No Security Return the item Policy Storage Engine Interface ENGINE_SUCCESS SELinux Client Application Memcached Kernel Page 20 LinuxCon Japan/Tokyo 2010 - Memcached getting secure
  21. 21. selinuxfs and libselinux (1/2) [kaigai@saba ~]$ ls /selinux access context load reject_unknown avc/ create member relabel booleans/ deny_unknown mls status checkreqprot disable null user class/ enforce policy_capabilities/ commit_pending_bools initial_contexts/ policyvers▐ selinuxfs A pseudo filesystem as an interface to applications Eg; write and read on /selinux/access it asks selinux its access control decision▐ libselinux A set of wrapper functions for selinuxfs and configuration files. Eg; security_getenforce() read /selinux/enforce Userspace access vector cache Page 21 LinuxCon Japan/Tokyo 2010 - Memcached getting secure
  22. 22. selinuxfs and libselinux (2/2)extern int security_compute_av(const security_context_t scon, const security_context_t tcon, security_class_t tclass, access_vector_t required, struct av_decision *avd); It contains bitmask of It contains bitmask of allowed permissions. allowed permissions.▐ security_compute_av scon ... security context of the user process tcon ... security context of the item to be referenced tclass ... code of object class required... an obsolete argument avd ... result shall be set in this structure It writes scon, tcon and tclass to /selinux/access, then SELinux returns allowed actions on a pair of them. Page 22 LinuxCon Japan/Tokyo 2010 - Memcached getting secure
  23. 23. Flow-chart in ADD command Protocol Parser selinux_allocate() default context Storage Engine security_compute_create() Interface ADD xxx create a new item with security context /selinux/create selinux_store() decision OPERATION_ADD security_compute_av() /selinux/access ENGINE_EACCESS Allowed? No Security link the new item Policy to btree-index Storage Engine Interface ENGINE_SUCCESS SELinux Client Application Memcached Kernel Page 23 LinuxCon Japan/Tokyo 2010 - Memcached getting secure
  24. 24. Memcached - selinux engine▐ To obtain the source code git clone git://github.com/trondn/memcached.git -b engine svn co http://sepgsql.googlecode.com/svn/trunk/memcached▐ Features Mandatory access control with SELinux policy Using B+tree index Persistent storage support▐ Future works Waiting for Memcached v1.6.x release :-) Pushing the package to Fedora project Scalability improvement Comprehensive statistical information Documentations Page 24 LinuxCon Japan/Tokyo 2010 - Memcached getting secure
  25. 25. Userspace access vector cache (avc)▐ security_compute_xxx() always invokes a system-call AVC enables to cache access control decisions recently used. Query Query avc_has_perms() Memory Memory reference reference validation check of Decision selinux_kernel_status Decision userspace cache mmap(2) still valid invalid reset avc cache /selinux/status lookup an avc entry from the cache /selinux/access In heuristic, In heuristic, not found Found the rate to hit /selinux/create the rate to hit make an avc entry overs 99.9% overs 99.9% System System call call check access permissions Security Policy validation check of SELinux still valid userspace cache invalid Page 25 LinuxCon Japan/Tokyo 2010 - Memcached getting secure
  26. 26. Benchmark default default selinux selinux IPsec(ESP) IPsec(ESP) 191,409 191,409 IPsec(AH) IPsec(AH) 251,485 251,485 No IPsec No IPsec 00 100000 100000 200000 200000 300000 300000 number of commands in 30sec number of commands in 30sec▐ Iteration of GET/SET mixture, 8threads-client, 4core server x 2, Gb-ether▐ Less significant differences in same network environment default = no access control, selinux = mandatory access control▐ Penalties in IPsec(AH) communication (~20%?) Page 26 LinuxCon Japan/Tokyo 2010 - Memcached getting secure
  27. 27. Summary▐ Why object managers apply access controls Access control should be centralized • Consistency • Coverage Server is better than applications, Kernel is better than servers.▐ SELinux as a Security Server SELinux returns its access control decision, then object manager control accesses according to the decision. User and data object need to be identified with security context.▐ Using libselinux Libselinux encapsulates raw accesses to selinuxfs. Userspace access vector cache reduces number of kernel invocations Page 27 LinuxCon Japan/Tokyo 2010 - Memcached getting secure
  28. 28. Any Questions?
  29. 29. Thank you!
  1. A particular slide catching your eye?

    Clipping is a handy way to collect important slides you want to go back to later.

×