Welcome!

Linux Containers Authors: Liz McMillan, Pat Romanski, Carmen Gonzalez, Elizabeth White, Anders Wallgren

Related Topics: Linux Containers

Linux Containers: Article

Principles of Secure Programming

Applying basic security principles to programming

The purpose of this article is to show how basic security principles can help you develop programs that are harder for the bad guys to break. We'll examine a simple function that executes a command as though it were typed at the keyboard, exactly what the library function system does. But unlike many system implementations, we'll constrain what happens so the calling program can't trick it into executing some other program.

The system function takes a single argument: a character string with the command to be executed just as it would be typed at the keyboard. The function first invokes the Bourne shell, passing the command to that shell using the "–c" option. The shell then spawns the command. For example:

system("date")
invokes the command
/bin/sh –c "date"

This executes the program "date," which prints the date on the standard output.

Security Issues
Security issues arise when the program invoking the system function is a privileged program. The "privilege" may consist of having setuid and/or setgid privileges such as su or being able to run one of a specified set of programs such as a Web server serving CGI scripts. The attacker's goal is to trick the program into executing some other program, for example a version of date that's a command interpreter rather than just printing the date.

Problems arise because of the power of the Bourne shell as a command interpreter. That shell takes information from the environment, which consists of shell variables, file descriptors, signal-handling routines, and any other aspects of the process space that could affect program execution. For our purposes, we'll just consider environment variables.

One relevant environment variable is the PATH environment variable. When given a command that doesn't contain a '/' the Bourne shell treats the value of the PATH variable as a sequence of directory names. It looks in each directory in the given order for a program named "date" and executes the first one found. Suppose an attacker finds a setuid-to-root program that uses system to run the "date" command. The attacker can then copy the shell into a file named "date" in her current working directory, prepend "." to the list of directories in the value of PATH, and then execute the program. When system invokes the shell, it searches each directory in the value of PATH in order for a command named "date." The first directory searched will be the current working directory. The shell will find a program called "date" there and execute it, spawning the command interpreter, which will run with root privileges.

Our goal is to construct a version of system that's invulnerable to this kind of attack. Specifically, we want to guarantee that when the caller passes a command name to system, the user can't cause the program to execute a different program.

Applying the Principles
We'll apply two principles of secure design and implementation. They come from a paper by Jerome Saltzer and Michael Schroeder and are central to any security work. In practice, we would also consider the other six, but the two we'll use have more impact on the design and implementation of this particular function than the others.

Principle of Least Privilege
The first principle is the principle of least privilege. This principle, also called the need-to-know principle, says that a process should have the minimum privileges needed to perform its task. For this problem, this rule says that system should execute the command with the privileges of the user, not with those of root, if at all possible. As an example, were the privileged program to print the date and time by using system to run the command "date" as described above, there's no reason that "date" needs to be executed as root. It could just as easily be executed with the user's privileges. Hence the first step in our new system command would be to let the caller reset the privileges to those of the real user and group. Doing this means that the user can only compromise her own account - and as since she already has full access to it such a compromise is meaningless.

If the caller lets the user select one of a set of commands, then a different application of the principle of least privilege provides the required restriction. The program configuration should create a directory into which copies of the commands to be executed are placed. Then the program changes its notion of the root directory to that of the directory containing the commands. Even if the user can enter the name of a different command, only the authorized commands are accessible to the program. So only the authorized commands can be executed, and the user will get an error message. This is the technique that sendmail's restricted shell uses to ensure that sendmail only executes safe programs like procmail and vacation. Web servers should use this technique to ensure that commands to execute CGI programs can only execute the CGI programs in the Web server's directories.

Principle of Fail-Safe Defaults
The principle of fail-safe defaults says that access to resources and objects should be denied by default. If you need access to only one particular object, the usual approach of removing access to all other objects violates this principle. Instead, access to all objects should be removed, and then access privileges for that particular object should be explicitly granted. The distinction is subtle, but critical.

To see this, consider the problem of ensuring the user's PATH environment variable is set appropriately. The naive approach is to search the environment for the PATH environment variable and check that its value is acceptable. This leads to two problems. First, what happens if the value is not acceptable? In this case, the value must be replaced. Second, what happens if there are multiple occurrences of the variable? The values of all must be checked and found satisfactory, or all but one must be deleted.

A second approach is to require that the program use the full path name of the program. So the invocation of the system call would be:

system("/bin/date")

This causes the shell to ignore the PATH setting. Unfortunately, this approach is also flawed.

Environment variables other than PATH affect the executed program. For some versions of the Bourne shell, the value of the environment variable IFS is a string of characters that the shell treats as word separators. (This is particularly useful when a shell script is reading lines from the password file, for example.) In such a shell, the following command prints files X and Y:

IFS="/$IFS"; export IFS; cat/x/y

because the shell sees the "/" character as a word separator, which lets the user thwart the use of a full path name as described above. All she need do is set IFS in her environment to include the "/" character and then create a program called "bin" in her current working directory. She then changes her PATH environment variable to look in the current working directory first. When she runs the command, the privileged program invokes the above system function. The subordinate shell reads the argument of system as having two words, "bin" followed by the argument "date." Hence the user's program "bin" will be executed and the shell will pass "date" to it as an argument.

Again the programmer can try to prevent this by setting IFS explicitly in the environment:

system("IFS=\" \t\n\"; export IFS; /bin/date")

As tempting as this approach is, it suffers from two problems. The first is that the attacker can easily defeat it by adding "I" to the IFS variable. Then the shell sees this as adding the environment variable FS to the environment. The second problem arises when the attacker doesn't do this. There are now two occurrences of the IFS environment variable in the environment. Which one is used? That turns out to be implementation-dependent: some versions of the shell use the first (the user's), and others use the second (the one defined in the system argument.

Following the principle of fail-safe defaults offers a simple answer to all this. First, create an empty environment for the shell. Then add preset, safe values of PATH, IFS, and any other needed environment variables to that environment. Finally, set the shell's environment to be the newly created one. Doing so makes the user's environment irrelevant to the system function and the shell it calls. The shell never refers to the user's environment. The shell only uses the newly created safe environment.

Now the order in which the shell evaluates the variables in the environment is irrelevant, because there is only one occurrence of each variable in the environment. If the user adds "/" to the value of IFS in her environment, or alters the value of the PATH environment variable, the shell ignores those changes because it never sees the values of those variables. It only sees the ones defined in the environment set up by the program.

Conclusion
Programming with security in mind is critical for today's programs. This style of programming requires a methodical approach, not one in which various tricks are used without understanding how and why they work. The problem is that tricks only apply to certain situations, and can only be used effectively if those situations arise. But the principles of secure design and implementation apply always, and dramatically improve both the quality and the security of the programs and systems they are applied to.

Recommended Reading

  • J. Saltzer and M. Schroeder, "The Protection of Information in Computer Systems," Proceedings of the IEEE 63 (9) pp. 1278-1308 (September 1975). This paper first enunciated the principles and discussed them thoroughly in a variety of contexts. A must read for anyone doing design and/or implementation in the field of computer security.
  • B. Kernighan and P. Plauger, The Elements of Programming Style, McGraw-Hill Book Co., Reading, MA (1974). The principles described in this book lead to a clear and readable programming style. Their emphasis on simplicity and clarity parallels principles in security. Highly recommended.
  • M. Graff and K. Van Wyk, Secure Coding: Principles and Practices, O'Reilly and Associates, Sebastopol, CA (June 2003). This book describes security through the lifecycle of a program or system. An excellent high-level view of how to write code that emphasizes security.
  • J. Viega and G. McGraw, Building Secure Software: How to Avoid Security Problems the Right Way, Addison-Wesley Publishing Co., Boston, MA (2002). This book discusses both principles and practice, drawing most of its examples from Unix and Linux systems. Another must read for Unix and Linux programmers.
  • M. Howard and D. LeBlanc, Writing Secure Code, Microsoft Press, Redmond, WA (2001). Similar to Viega and McGraw but focusing on Windows platforms, this book shows the application of principles to a different environment. A must read for Windows developers, and a worthwhile read for Unix and Linux programmers interested in a different programming environment.
  • A. Stavely, Towards Zero-Defect Programming, Addison-Wesley Publishing Co., Reading, MA (1998). Although focused on correctness more than security, its ideas can be readily adapted to security. Its mix of formalism and informality is refreshing.
  • More Stories By Matt Bishop

    Matt Bishop is a professor in the Department of Computer Science at the University of California at Davis. A recognized expert in vulnerability analysis, secure systems/software design, network security, access control, authentication, and UNIX security, Bishop also works to improve computer security instruction. He is the author of Computer Security: Art and Science and Introduction to Computer Security (Addison-Wesley).

    Comments (0)

    Share your thoughts on this story.

    Add your comment
    You must be signed in to add a comment. Sign-in | Register

    In accordance with our Comment Policy, we encourage comments that are on topic, relevant and to-the-point. We will remove comments that include profanity, personal attacks, racial slurs, threats of violence, or other inappropriate material that violates our Terms and Conditions, and will block users who make repeated violations. We ask all readers to expect diversity of opinion and to treat one another with dignity and respect.


    @ThingsExpo Stories
    Customer experience has become a competitive differentiator for companies, and it’s imperative that brands seamlessly connect the customer journey across all platforms. With the continued explosion of IoT, join us for a look at how to build a winning digital foundation in the connected era – today and in the future. In his session at @ThingsExpo, Chris Nguyen, Group Product Marketing Manager at Adobe, will discuss how to successfully leverage mobile, rapidly deploy content, capture real-time d...
    SYS-CON Events announced today that Super Micro Computer, Inc., a global leader in Embedded and IoT solutions, will exhibit at SYS-CON's 18th International Cloud Expo®, which will take place on June 7-9, 2016, at the Javits Center in New York City, NY. Supermicro (NASDAQ: SMCI), the leading innovator in high-performance, high-efficiency server technology, is a premier provider of advanced server Building Block Solutions® for Data Center, Cloud Computing, Enterprise IT, Hadoop/Big Data, HPC and ...
    18th Cloud Expo, taking place June 7-9, 2016, at the Javits Center in New York City, NY, will feature technical sessions from a rock star conference faculty and the leading industry players in the world. Cloud computing is now being embraced by a majority of enterprises of all sizes. Yesterday's debate about public vs. private has transformed into the reality of hybrid cloud: a recent survey shows that 74% of enterprises have a hybrid cloud strategy. Meanwhile, 94% of enterprises are using some...
    What a difference a year makes. Organizations aren’t just talking about IoT possibilities, it is now baked into their core business strategy. With IoT, billions of devices generating data from different companies on different networks around the globe need to interact. From efficiency to better customer insights to completely new business models, IoT will turn traditional business models upside down. In the new customer-centric age, the key to success is delivering critical services and apps wit...
    Join us at Cloud Expo | @ThingsExpo 2016 – June 7-9 at the Javits Center in New York City and November 1-3 at the Santa Clara Convention Center in Santa Clara, CA – and deliver your unique message in a way that is striking and unforgettable by taking advantage of SYS-CON's unmatched high-impact, result-driven event / media packages.
    As cloud and storage projections continue to rise, the number of organizations moving to the cloud is escalating and it is clear cloud storage is here to stay. However, is it secure? Data is the lifeblood for government entities, countries, cloud service providers and enterprises alike and losing or exposing that data can have disastrous results. There are new concepts for data storage on the horizon that will deliver secure solutions for storing and moving sensitive data around the world. ...
    In his keynote at 18th Cloud Expo, Andrew Keys, Co-Founder of ConsenSys Enterprise, will provide an overview of the evolution of the Internet and the Database and the future of their combination – the Blockchain. Andrew Keys is Co-Founder of ConsenSys Enterprise. He comes to ConsenSys Enterprise with capital markets, technology and entrepreneurial experience. Previously, he worked for UBS investment bank in equities analysis. Later, he was responsible for the creation and distribution of life ...
    SYS-CON Events announced today that IBM Cloud Data Services has been named “Bronze Sponsor” of SYS-CON's 18th Cloud Expo, which will take place on June 7-9, 2016, at the Javits Center in New York City, NY. IBM Cloud Data Services offers a portfolio of integrated, best-of-breed cloud data services for developers focused on mobile computing and analytics use cases.
    Cloud computing delivers on-demand resources that provide businesses with flexibility and cost-savings. The challenge in moving workloads to the cloud has been the cost and complexity of ensuring the initial and ongoing security and regulatory (PCI, HIPAA, FFIEC) compliance across private and public clouds. Manual security compliance is slow, prone to human error, and represents over 50% of the cost of managing cloud applications. Determining how to automate cloud security compliance is critical...
    SYS-CON Events announced today that MobiDev will exhibit at SYS-CON's 18th International Cloud Expo®, which will take place on June 7-9, 2016, at the Javits Center in New York City, NY. MobiDev is a software company that develops and delivers turn-key mobile apps, websites, web services, and complex software systems for startups and enterprises. Since 2009 it has grown from a small group of passionate engineers and business managers to a full-scale mobile software company with over 200 develope...
    SoftLayer operates a global cloud infrastructure platform built for Internet scale. With a global footprint of data centers and network points of presence, SoftLayer provides infrastructure as a service to leading-edge customers ranging from Web startups to global enterprises. SoftLayer's modular architecture, full-featured API, and sophisticated automation provide unparalleled performance and control. Its flexible unified platform seamlessly spans physical and virtual devices linked via a world...
    SYS-CON Events announced today that BMC Software has been named "Siver Sponsor" of SYS-CON's 18th Cloud Expo, which will take place on June 7-9, 2015 at the Javits Center in New York, New York. BMC is a global leader in innovative software solutions that help businesses transform into digital enterprises for the ultimate competitive advantage. BMC Digital Enterprise Management is a set of innovative IT solutions designed to make digital business fast, seamless, and optimized from mainframe to mo...
    "What we see what happens when you have a completely networked society and the potential to now drive the value creation and the collaboration and the ecosystems that are possible when you start to be able to connect people and industries together in ways that have never been possible before," explained Esmeralda Swartz, VP of Marketing Enterprise & Cloud at Ericsson, in this SYS-CON.tv interview at @ThingsExpo, held November 3-5, 2015, at the Santa Clara Convention Center in Santa Clara, CA.
    Companies can harness IoT and predictive analytics to sustain business continuity; predict and manage site performance during emergencies; minimize expensive reactive maintenance; and forecast equipment and maintenance budgets and expenditures. Providing cost-effective, uninterrupted service is challenging, particularly for organizations with geographically dispersed operations.
    The Internet of Things (IoT) is growing rapidly by extending current technologies, products and networks. By 2020, Cisco estimates there will be 50 billion connected devices. Gartner has forecast revenues of over $300 billion, just to IoT suppliers. Now is the time to figure out how you’ll make money – not just create innovative products. With hundreds of new products and companies jumping into the IoT fray every month, there’s no shortage of innovation. Despite this, McKinsey/VisionMobile data...
    The IoTs will challenge the status quo of how IT and development organizations operate. Or will it? Certainly the fog layer of IoT requires special insights about data ontology, security and transactional integrity. But the developmental challenges are the same: People, Process and Platform. In his session at @ThingsExpo, Craig Sproule, CEO of Metavine, will demonstrate how to move beyond today's coding paradigm and share the must-have mindsets for removing complexity from the development proc...
    SYS-CON Events announced today that MangoApps will exhibit at SYS-CON's 18th International Cloud Expo®, which will take place on June 7-9, 2016, at the Javits Center in New York City, NY. MangoApps provides modern company intranets and team collaboration software, allowing workers to stay connected and productive from anywhere in the world and from any device. For more information, please visit https://www.mangoapps.com/.
    SYS-CON Events announced today TechTarget has been named “Media Sponsor” of SYS-CON's 18th International Cloud Expo, which will take place on June 7–9, 2016, at the Javits Center in New York City, NY, and the 19th International Cloud Expo, which will take place on November 1–3, 2016, at the Santa Clara Convention Center in Santa Clara, CA. TechTarget is the Web’s leading destination for serious technology buyers researching and making enterprise technology decisions. Its extensive global networ...
    SYS-CON Events announced today that Commvault, a global leader in enterprise data protection and information management, has been named “Bronze Sponsor” of SYS-CON's 18th International Cloud Expo, which will take place on June 7–9, 2016, at the Javits Center in New York City, NY, and the 19th International Cloud Expo, which will take place on November 1–3, 2016, at the Santa Clara Convention Center in Santa Clara, CA. Commvault is a leading provider of data protection and information management...
    The essence of data analysis involves setting up data pipelines that consist of several operations that are chained together – starting from data collection, data quality checks, data integration, data analysis and data visualization (including the setting up of interaction paths in that visualization). In our opinion, the challenges stem from the technology diversity at each stage of the data pipeline as well as the lack of process around the analysis.