CN104036166B - The user of forced symmetric centralization is supported to put forward power method - Google Patents

Abstract

The invention discloses a method for elevating user privileges supporting mandatory access control. The steps are: 1) pre-forcibly classify the privileged programs of the operating system and associate them with different administrator roles; 2) detect the user's access request, and when detected When a privileged operation request is requested, jump to step 3); 3) authenticate the user who issued the privileged operation request, if the authentication passes, a child process is derived, the security attribute of the child process is set, and the security attribute of the child process inherits the target The security attribute of the administrator role corresponding to the privileged program executes the target privileged program through a child process; if the authentication fails, reject the user's privileged operation request and exit. The present invention has the advantages of simple implementation method, user privilege escalation operation, mandatory access control support, high operating system security and strong usability.

Description

User Privilege Escalation Method Supporting Mandatory Access Control

technical field

The invention relates to the technical field of user privilege elevation of computer operating systems, in particular to a user privilege elevation method supporting mandatory access control.

Background technique

With the development of computer technology and network technology, the security of computer systems has become more and more important, and the operating system, as the manager of computer resources, is the basis of the security of the entire host system. An effective and reliable operating system should also have strong security and corresponding protection measures, that is, it can eliminate or limit the security risks posed to the system by skylights, hidden passages, Trojan horses, etc., and provide sufficient protection for the information in the system. Prevent unauthorized users from misusing or destroying system software resources.

Many users like to log in to the system with an administrator account (Administrator under Windows, root under Unix, Linux and other Unix systems), so that users can obtain the highest authority of the operating system and perform any operation without being restricted by authority. However, while users use the administrator account to bring convenience, it also poses a major threat to the security of the computer system. If a malicious program is executed under unknown circumstances, the malicious program also obtains the same authority as the administrator account, that is, it can manage all resources of the operating system, which is very dangerous and may even cause heavy losses to the system.

In order to cope with increasingly prominent security issues, it is usually recommended to log in with a common account when using the operating system, and when a privileged operation needs to be performed, the operation is completed through the method of privilege escalation. The so-called privilege escalation refers to the process of making ordinary users temporarily have the authority to manage operating system resources in a certain way. Using the above method, even if the user executes the malicious program, the authority obtained by the malicious program is limited to the authority of the ordinary user, and the privileged program cannot be executed, which will not cause great harm to the system.

At present, mainstream operating systems provide corresponding solutions for user privilege escalation, including:

1) UAC (User Account Control) mechanism provided by Windows system.

UAC is a technology introduced from Windows Vista. This technology is used to enhance the security of Windows system by restricting users from executing privileged programs. Only programs that users trust can obtain administrator privileges. At present, the UAC permission control mechanism is provided under the Windows system to prevent users from making unauthorized changes to the computer. When the user performs some operations such as installing software or setting up a firewall, UAC will be triggered. After the user completes the identity authentication, the UAC will perform it once. The privilege escalation allows the logged-in user to have higher administrator privileges to perform these privileged operations after privilege escalation.

2) The su/sudo/polkit mechanism provided by the Unix/Linux system.

The Unix/Linux system provides mechanisms such as su/sudo/polkit to allow users to elevate their privileges. su and sudo are command-line programs provided under the UNIX/Linux system, through which users can execute programs with specified UID (user ID) or GID (group ID). The su command uses the password of the switched user to complete the authentication, while the sudo command uses the user's own password to authenticate. After passing the sudo authentication, there will be a grace period of about 15 minutes. During this period, the user does not need to authenticate again to execute the sudo command . For the disadvantage that su/sudo does not have a graphical interface, gksu/gksudo provides a graphical interface for authentication; Polkit provides a pkexec command to escalate privileges. This command can execute programs with a specified user, and it also provides a graphical interface for authentication. The password of the root user is used for authentication.

A legal user of the operating system can arbitrarily modify the file access control information owned by the user, but the operating system cannot distinguish whether the modification is a legitimate operation of the user or an illegal operation of a malicious program; in addition, there is no effective method to Prevents computer viruses from passing information from one process to another through shared objects. Therefore, in order to solve the above problems and make the operating system have higher security, a mandatory access control mechanism is introduced. In a system with mandatory access control enabled, the system assigns a special security attribute that generally cannot be changed for both the subject and the object. The system determines whether a subject can access an object by comparing the security attributes of the subject and the object. When a user runs a program for a certain purpose, he cannot change the security attributes of himself and any other object, including objects owned by the user himself. However, in a system that supports mandatory access control, ordinary privilege escalation only changes the user ID and group ID, and the mandatory access control security attributes corresponding to the privileged process are inherited from the parent process by default, and there is no corresponding action with privilege escalation. Therefore, operations after privilege escalation may still be blocked by mandatory access control, resulting in the final privilege escalation failure.

To sum up, the existing privilege escalation methods do not support or partially support mandatory access control, and when the privilege is escalated in a system that supports mandatory access control, the security attributes of the process after privilege escalation are not set correctly, resulting in Privileged operations are still blocked by the mandatory access control system, and users cannot perform privileged operations.

Contents of the invention

The technical problem to be solved by the present invention is that: aiming at the technical problems existing in the prior art, the present invention provides a simple implementation method, which can realize user privilege escalation operation and support mandatory access control, high operating system security and strong usability support User privilege escalation method for mandatory access control.

In order to solve the problems of the technologies described above, the technical solution proposed by the present invention is:

A user privilege escalation method supporting mandatory access control, the specific implementation steps are as follows:

1) Pre-forcibly classify the privileged programs of the operating system and associate them with different administrator roles;

2) Detect the access request of ordinary users, and when a privileged operation request is detected, jump to step 3);

3) Perform authentication on the ordinary user who issued the privileged operation request. If the authentication passes, a child process is spawned, the security attribute of the child process is set, and the security attribute of the child process is inherited from the target privileged program of the privileged operation request. According to the security attribute of the associated administrator role, the target privileged program is executed through the child process; if the authentication fails, the user's privileged operation request is rejected and exited.

As a further improvement of the present invention, the specific implementation steps of the step 1) are as follows:

1.1) Pre-forcibly classify the privileged programs of the operating system according to their functions;

1.2) According to the classification of the privileged programs, associate each classified privileged program with the corresponding administrator role to obtain the association relationship between each privileged program and the administrator role;

1.3) Store the association between each privileged program and the administrator role as a configuration file, and provide a privileged program for modifying the configuration file for the configuration file, and link the privileged program for modifying the configuration file with the specified administrator role Association is made so that ordinary users have read and write permissions to the configuration file only if they are elevated to a designated administrator role.

As a further improvement of the present invention: the administrator roles in the step 1.1) specifically include system administrators, security administrators, and audit administrators. Compulsory classification of privileged programs of the operating system into three categories: executed by system administrators, executed by security administrators, and executed by audit administrators.

As a further improvement of the present invention: the administrator role specified in step 1.3) specifically refers to a security administrator.

As a further improvement of the present invention: the detailed implementation steps of the step 2) are as follows:

2.1) Intercept the access request of ordinary users. If a privileged operation request is received, skip to step 2.2), otherwise continue to return and re-execute step 2.1);

2.2) Trigger the start of the client in C/S mode, the client in the C/S mode has the read-only authority of the configuration file storing the association relationship between the privileged program and the administrator role; the C/S mode The client reads the configuration file that stores the association relationship between the privileged program and the administrator role, parses the received privileged operation request and converts the user information of the privileged operation request, the target privileged program, and the target privileged program associated The administrator role is sent to the server in C/S mode through inter-process communication, and step 3) is executed through the server in C/S mode.

As a further improvement of the present invention: the step 3) is specifically implemented through the service framework program of the server in the C/S mode, and the security attribute of the service framework program is forcibly controlled to only be able to set the derived child process Security attributes, execution of privileged programs, and inter-process communication with the password verification module of the operating system realize the authentication of ordinary users, and the client of C/S mode performs inter-process communication.

Compared with the prior art, the present invention has the following technical effects:

1) The present invention classifies the privileged programs of the operating system in advance and associates them with different administrator roles, limits the access rights of the privileged programs, realizes mandatory access control, and ensures high security of the operating system; by receiving privileged operation requests from ordinary users and ordinary user authentication to complete the privilege escalation operation, which can perform privileged operations through privilege escalation when logging in as an ordinary user, improving the usability of the operating system that supports mandatory access control; The security attribute of the child process is set, so that the security attribute of the child process inherits the security attribute of the administrator role associated with the privileged program, so as to ensure the success of privilege escalation and complete the execution of the privileged program.

2) When the present invention adopts the privilege escalation mode of C/S mode, the client intercepts the user's privilege operation request, and the client parses and sends the information to the server, and the server sets the security attribute and executes the privilege instead of the user The operation and implementation method are simple, and the method of privilege escalation is flexible.

3) The present invention sets special security attributes for configuration files associated with privileged programs and administrator roles, preventing unauthorized malicious programs from modifying configuration files and ensuring system security; at the same time, setting special security attributes for the service framework program of the server in the C/S mode Security attributes enable privileged programs and service framework programs to run within a limited range, realizing the principle of least privilege and separation of responsibilities.

Description of drawings

FIG. 1 is a schematic diagram of the implementation flow of the method for elevating user rights that supports mandatory access control in this embodiment.

FIG. 2 is a schematic diagram of the relationship between privileged programs and administrator roles in this embodiment.

Fig. 3 is a schematic flow chart of the specific implementation of step 2) in the C/S mode in this embodiment.

detailed description

The present invention will be further described below in conjunction with the accompanying drawings and specific preferred embodiments, but the protection scope of the present invention is not limited thereby.

As shown in Figure 1, the specific implementation steps of the user's privilege escalation method that supports mandatory access control in this embodiment are as follows:

1) Pre-forcibly classify the privileged programs of the operating system and associate them with different administrator roles;

2) Detect the operation requests of ordinary users, and when a privileged operation request is detected, jump to step 3);

3) Authenticate the ordinary user who issued the privileged operation request. If the authentication is passed, the child process is forked, the security attribute of the child process is set, and the security attribute of the child process is inherited from the administrator associated with the target privileged program of the privileged operation request. The security attribute of the role, execute the target privileged program through the child process; if the authentication fails, reject the user's privileged operation request and exit.

In this embodiment, by forcing the privileged programs to be classified and associated with different administrator roles, the access rights of the privileged programs are limited to realize mandatory access control, and the security of the operating system is high; by receiving the user's privileged operation request and the user's identity Verify that the user's privilege escalation operation is completed, and the operating system can perform privileged operations through privilege escalation when logging in as an ordinary user, improving the usability of the operating system that supports mandatory access control; The security attribute of the process is set, so that the security attribute of the child process inherits the security attribute of the administrator role associated with the privileged program, so as to ensure the final success of the privilege escalation and complete the execution of the privileged program.

In this embodiment, the specific implementation steps of step 1) are as follows:

1.1) Pre-forcibly classify the privileged programs of the operating system according to their functions;

1.2) According to the classification of privileged programs, each type of privileged program after classification is associated with the corresponding administrator role, and the association relationship between each privileged program and administrator role is obtained;

1.3) Store the relationship between each privileged program and the administrator role as a configuration file, and provide a privileged program for modifying the configuration file for the configuration file, and associate the privileged program for modifying the configuration file with the specified administrator role, so that Ordinary users have read and write permissions to configuration files only if they are elevated to a designated administrator role.

The administrator roles in step 1.1) of this embodiment specifically include system administrators, security administrators, and audit administrators. Forcibly classifying the privileged programs of the operating system according to their functions in advance refers to forcing the privileged programs of the operating system to be Functions are classified into three categories: executed by system administrators, executed by security administrators, and executed by audit administrators. In the existing operating system, the authority of root, which can execute all privileged programs, is assigned to three administrator roles: system administrator, security administrator, and audit administrator. The privileges of each administrator role are only part of root.

In this embodiment, according to the functions of the privileged programs, the privileged programs in the operating system are divided into three categories: executed by the system administrator, executed by the security administrator, and executed by the audit administrator. The privileged program executed by the system administrator is associated with the role of the system administrator, the privileged program executed by the security administrator is associated with the role of the security administrator, and the privileged program executed by the audit administrator is associated with the role of the audit administrator . There are multiple privileged programs in the system, and each privileged program can only be associated with one administrator role, and one administrator role can be associated with multiple privileged programs. As shown in Figure 2, taking n privileged programs (privileged program 1 to privileged program n) and n administrator roles (administrator role 1 to administrator role n) as an example, privileged program 1 is associated with administrator role 2, Privileged program 2 is associated with administrator role 1, privileged program 3 is associated with administrator role 3, ..., privileged program n is associated with administrator role n. It should be noted that Figure 2 is only a partial enumeration of the many-to-one association between privileged programs and administrator roles. Since privileged programs and administrator roles are associated in a many-to-one manner, each privilege A program must correspond to an administrator role, and an administrator role may correspond to multiple privileged programs.

In this embodiment, the association relationship between each privileged program and the administrator role is stored in the configuration file of the system. By setting the security attribute of the configuration file, the configuration file is protected by mandatory access control to prevent unauthorized program modification. The specific method is: provide a privileged program for modifying the configuration file for the configuration file, and associate the privileged program for modifying the configuration file with the role of the security administrator, so that only the privileged administrator role can access and edit the configuration file. Neither users nor other administrators can directly access and edit configuration files.

In this embodiment, a special security attribute is set for a configuration file storing the association relationship between each privileged program and an administrator role, and a privileged program for modifying the configuration file is provided, and the privileged program for modifying the configuration file is associated with a security administrator. Ordinary users have read and write permissions to configuration files only when they are elevated to the designated administrator role, so that they can access and edit configuration files. Ordinary users, system administrators, and audit administrators cannot directly access and edit Or check to prevent the modification of the roles of ordinary users, system administrators, and audit administrators, so as to associate the privileged program that modifies the configuration file with the role of the security administrator, and protect the configuration file so that ordinary users can only elevate their privileges to the security administrator. Only administrators can modify configuration files to prevent unauthorized malicious programs from modifying configuration files and ensure system security.

In this embodiment, the detailed implementation steps of step 2) are as follows:

2.1) Intercept the access request of ordinary users. If a privileged operation request is received, skip to step 2.2), otherwise continue to return and re-execute step 2.1);

2.2) Trigger the start of the client in C/S mode. The client in C/S mode has the read-only permission to store the configuration file associated with the relationship between the privileged program and the administrator role; the client in C/S mode reads the stored A configuration file with the association relationship between the privileged program and the administrator role, parses the privileged operation request and sends the user information of the privileged operation request, the target privileged program, and the administrator role associated with the target privileged program to the For the server in C/S mode, execute step 3) through the server in C/S mode.

In this embodiment, step 2) and step 3) are realized through the C/S mode, step 2) is realized by the client of the C/S mode, and step 3) is realized by the server of the C/S mode, in other embodiments It can also be realized in other ways. When an ordinary user executes the privilege escalation program, it will trigger the C/S mode client to read the configuration file. The C/S mode client (C/S client) in the system is configured to have stored privileged programs and The read-only permission of the configuration file of the association relationship between administrator roles, so the configuration file can be read directly (read-only); while ordinary users only have the read-write permission to the configuration file when the privilege is elevated to the specified administrator role, thus The configuration file can be accessed and edited. Through the above settings, the main purpose is to protect the configuration file from illegal access and modification. The read permission of the configuration file is only for the client running C/S (it will be converted to a special context when running) and configuration file modification procedures (elevation of privileges to security administrators).

In this embodiment, when an access request from a common user is intercepted, the client is triggered to receive the privileged operation request and the client parses the privileged operation request, and the corresponding user who initiates the privileged operation request and the target privilege to execute the privileged operation request Information such as the administrator role associated with the target privileged program in the program and the configuration file, and related system environment variables are sent to the server in the C/S mode through inter-process communication.

In this embodiment, step 3) is specifically implemented through the service framework program as a server in the C/S mode, and the security attributes of the service framework program are forcibly controlled to only set the security attributes of derived child processes and execute privileged programs. , communicate with the password authentication module of the operating system to implement the authentication of ordinary users, and communicate with the client in the C/S mode. After receiving the information sent by the client in C/S mode through inter-process communication, the service framework program first invokes the password verification module of the operating system through inter-process communication to authenticate the ordinary user who initiated the privileged operation request. If the identity verification is passed, the child process is derived and the security attribute of the child process is set, so that the security attribute of the child process inherits the security attribute of the administrator role corresponding to the target privileged program requested by the privileged operation, and then the privileged program is executed through the derived child process; If the authentication fails, reject the privileged operation request of ordinary users and exit. When the present embodiment adopts the privilege escalation mode of C/S mode, the client intercepts the user's privileged operation request, and the client analyzes and sends the information to the server, and the server sets the security attribute and executes the privileged operation instead of the user , the implementation method is simple, and the method of privilege escalation is flexible. In this embodiment, special security attributes are set for the service framework program at the same time. When the service framework program is running, the security attributes of its process are also set with special security attributes. The security attributes of the child process, the execution of the privileged program in the configuration file, and the client in the C/S mode, the password verification module for inter-process communication, and other operations will be restricted.

In this embodiment, special security attributes are set for the configuration file storing the association relationship between the privileged program and the administrator role and the service framework process in the C/S mode, so that the privileged program and the privileged service framework process are all run within a limited range, realizing The principle of least privilege and separation of responsibilities.

As shown in Figure 3, the specific implementation process of step 2) in the C/S mode in this embodiment, when an ordinary user sends a request for a privileged service, the client intercepts the request of the ordinary user, and after receiving the privileged service request, the client sends the The privileged service framework on the server sends information, which includes user information, target privileged program, and administrator role associated with the target privileged program; after receiving the client’s information, the privileged service framework on the server calls the password verification module to verify the identity of the privileged service request. The identity of the user determines whether the user is an authorized user. If the user is successfully authorized, switch the user role, that is, the privileged service framework will derive a child process and set the security attribute of the child process, so that the security attribute of the child process inherits the target privilege of the privileged operation request The security attributes of the administrator role corresponding to the program, and then execute the target privileged program through the child process; if the user is not successfully authorized, return to perform user authentication.

The above are only preferred embodiments of the present invention, and do not limit the present invention in any form. Although the present invention has been disclosed above with preferred embodiments, it is not intended to limit the present invention. Any person familiar with the art, without departing from the scope of the technical solution of the present invention, can use the technical content disclosed above to make many possible changes and modifications to the technical solution of the present invention, or modify it into an equivalent implementation of equivalent changes example. Therefore, any simple modifications, equivalent changes and modifications made to the above embodiments according to the technical essence of the present invention shall fall within the protection scope of the technical solution of the present invention.

Claims (6)

1. A user privilege escalation method supporting mandatory access control, characterized in that the specific implementation steps are as follows: 1) pre-forcibly classifying privileged programs of the operating system and associating them with different administrator roles; 2) Detect the access request of ordinary users, and when a privileged operation request is detected, jump to step 3); 3) Perform authentication on the ordinary user who issued the privileged operation request. If the authentication passes, a child process is spawned, the security attribute of the child process is set, and the security attribute of the child process is inherited from the target privileged program of the privileged operation request. According to the security attribute of the associated administrator role, the target privileged program is executed through the child process; if the authentication fails, the user's privileged operation request is rejected and exited. 2. The method for elevating user rights supporting mandatory access control according to claim 1, characterized in that the specific implementation steps of the step 1) are as follows: 1.1) Pre-forcibly classify the privileged programs of the operating system according to their functions; 1.2) According to the classification of the privileged programs, associate each classified privileged program with the corresponding administrator role to obtain the association relationship between each privileged program and the administrator role; 1.3) Store the association between each privileged program and the administrator role as a configuration file, and provide a privileged program for modifying the configuration file for the configuration file, and link the privileged program for modifying the configuration file with the specified administrator role Association is made so that ordinary users have read and write permissions to the configuration file only if they are elevated to a designated administrator role. 3. The method for escalating user privileges that supports mandatory access control according to claim 2, wherein the administrator roles in step 1.1) specifically include three types: system administrator, security administrator, and audit administrator. The pre-forced classification of the privileged programs of the operating system according to their functions specifically refers to the forced classification of the privileged programs of the operating system into three categories: executed by the system administrator, executed by the security administrator, and executed by the audit administrator. 4. The method for user privilege escalation supporting mandatory access control according to claim 3, wherein the administrator role specified in step 1.3) specifically refers to a security administrator. 5. The method for elevating user rights that supports mandatory access control according to any one of claims 2 to 4, wherein the detailed implementation steps of step 2) are as follows: 2.1) Intercept the access request of ordinary users. If a privileged operation request is received, skip to step 2.2), otherwise continue to return and re-execute step 2.1); 2.2) Trigger the start of the client in C/S mode, the client in the C/S mode has the read-only authority to store the configuration file associated with the relationship between the privileged program and the administrator role; the client in the C/S mode The terminal reads the configuration file storing the association relationship between the privileged program and the administrator role, parses the received privileged operation request and sends the user information of the privileged operation request, the target privileged program, and the administrator role associated with the target privileged program Send it to the server in C/S mode through inter-process communication, and execute step 3) through the server in C/S mode. 6. The method for elevating user privileges supporting mandatory access control according to claim 5, characterized in that: said step 3) is specifically implemented through a service framework program as a server in C/S mode, and said service framework The security attribute of the program is forcibly controlled to only set the security attribute of the derived child process, execute the privileged program, communicate with the password verification module of the operating system to realize the authentication of ordinary users, and the client of C/S mode for inter-process communication.