MACPolicyIPAddressJail

• Student: Shivank Garg (shivank@FreeBSD.org)
• Mentor: Bjoern A. Zeeb (bz@FreeBSD.org)

Using VNET in FreeBSD jails, the root of the jail can set IP addresses of their will, however, sysadmins may need to limit these privileges for different purposes. With a MAC framework, the root of the host can restrict root of the jail to set the desired IP address. Currently, there is no MAC policy module for such restriction, implying these rules are written in the kernel itself. The project is focused on writing a MAC module for The TrustedBSD MAC framework to enable easy management of privilege(configuring the network stack) restriction of jail.

Features this new MAC policy module should include are-

• Host be able to define the list(multiple lists) of IP addresses/subnets for the jail to choose from.
• Host be able to restrict the jail from setting the certain IP addresses or prefixes(subnets).
• Nested Jails should also follow the access control policy.

Also, this mac module should have support for both IPv4 and IPv6 addresses.

This project requires to develop a loadable kernel module which can be used with MAC Framework Kernel Architecture. I have to study MAC policy architecture and mac_portacl as an example of writing a MAC module. MAC module involves various forms of checks against defined policies, these checks have to be implemented using kernel system calls. In userland, the ifconfig command is used to configure the IP addresses, which translates to SIOCAIFADDR(for IPv4) and SIOCAIFADDR_IN6(for IPv6) code and ioctl system call. Now, those policies check listed in The Problem can be integrated with these calls to make sure the root of jail set the specified IP addresses. In dealing with the problem, a set of addresses can be labeled to allow/disallow the root of jail from using those addresses.

• A MAC module restricting root of the jail to single IPv4 and IPv6 address or subnet.
• Proof of concept that it works.
• Test of MAC module

• Extending the MAC policy to restrict jail to multiple addresses or subnets.
• Prevent jail from claiming certain IP addresses reserved for Host or other jails.
• Test of new rules.

• (*optional) Ensuring nested jails follow the MAC policy.
• Documentation and Tests of MAC policy.

• Documentation will be written alongside the code, though it will be included in the final deliverable.
• *MAC policy for nested jails is suggested optional by the mentor and only if time persists.

For testing the newly written MAC module, kyua will be used. It provides a simple way of executing the test suite and generating reports. I will write various shell-scripted test checking particular IP addresses are allowed/disallowed in different scenarios. These shell scripts will have commands which allow/deny certain IP address in MAC checks as the root of the host and root of a jail allocating those IP addresses on its interfaces. Kyua will facilitate the detailed report of checks that passed/failed. The testing deliverable will include a Makefile to generate Kyuafile and various shell scripts that will contain commands and checks of MAC policy.

Example of testing the portacl: Tests for portacl are predefined and are present in /usr/src/tests/sys/mac/portacl

$ make && make install

This generates a Kyuafile in /usr/tests/sys/mac/portacl/Kyuafile

$ kyua test -k /usr/tests/sys/mac/portacl/Kyuafile

Now, we can generate a test report using kyua report. It parses the result file and generates a plain-text report. We can also print a detailed report using –verbose flag.

$ kyua report –verbose

• https://github.com/shivankgarg98/freebsd/tree/shivank_MACPolicyIPAddressJail/sys/security/mac_ipacl

• The TrustedBSD MAC Framework
• TestSuite