Welcome!

Linux Containers Authors: Elizabeth White, David Paquette, Pat Romanski, Liz McMillan, AppDynamics Blog

Related Topics: Linux Containers

Linux Containers: Article

Principles of Secure Programming

Applying basic security principles to programming

The purpose of this article is to show how basic security principles can help you develop programs that are harder for the bad guys to break. We'll examine a simple function that executes a command as though it were typed at the keyboard, exactly what the library function system does. But unlike many system implementations, we'll constrain what happens so the calling program can't trick it into executing some other program.

The system function takes a single argument: a character string with the command to be executed just as it would be typed at the keyboard. The function first invokes the Bourne shell, passing the command to that shell using the "–c" option. The shell then spawns the command. For example:

system("date")
invokes the command
/bin/sh –c "date"

This executes the program "date," which prints the date on the standard output.

Security Issues
Security issues arise when the program invoking the system function is a privileged program. The "privilege" may consist of having setuid and/or setgid privileges such as su or being able to run one of a specified set of programs such as a Web server serving CGI scripts. The attacker's goal is to trick the program into executing some other program, for example a version of date that's a command interpreter rather than just printing the date.

Problems arise because of the power of the Bourne shell as a command interpreter. That shell takes information from the environment, which consists of shell variables, file descriptors, signal-handling routines, and any other aspects of the process space that could affect program execution. For our purposes, we'll just consider environment variables.

One relevant environment variable is the PATH environment variable. When given a command that doesn't contain a '/' the Bourne shell treats the value of the PATH variable as a sequence of directory names. It looks in each directory in the given order for a program named "date" and executes the first one found. Suppose an attacker finds a setuid-to-root program that uses system to run the "date" command. The attacker can then copy the shell into a file named "date" in her current working directory, prepend "." to the list of directories in the value of PATH, and then execute the program. When system invokes the shell, it searches each directory in the value of PATH in order for a command named "date." The first directory searched will be the current working directory. The shell will find a program called "date" there and execute it, spawning the command interpreter, which will run with root privileges.

Our goal is to construct a version of system that's invulnerable to this kind of attack. Specifically, we want to guarantee that when the caller passes a command name to system, the user can't cause the program to execute a different program.

Applying the Principles
We'll apply two principles of secure design and implementation. They come from a paper by Jerome Saltzer and Michael Schroeder and are central to any security work. In practice, we would also consider the other six, but the two we'll use have more impact on the design and implementation of this particular function than the others.

Principle of Least Privilege
The first principle is the principle of least privilege. This principle, also called the need-to-know principle, says that a process should have the minimum privileges needed to perform its task. For this problem, this rule says that system should execute the command with the privileges of the user, not with those of root, if at all possible. As an example, were the privileged program to print the date and time by using system to run the command "date" as described above, there's no reason that "date" needs to be executed as root. It could just as easily be executed with the user's privileges. Hence the first step in our new system command would be to let the caller reset the privileges to those of the real user and group. Doing this means that the user can only compromise her own account - and as since she already has full access to it such a compromise is meaningless.

If the caller lets the user select one of a set of commands, then a different application of the principle of least privilege provides the required restriction. The program configuration should create a directory into which copies of the commands to be executed are placed. Then the program changes its notion of the root directory to that of the directory containing the commands. Even if the user can enter the name of a different command, only the authorized commands are accessible to the program. So only the authorized commands can be executed, and the user will get an error message. This is the technique that sendmail's restricted shell uses to ensure that sendmail only executes safe programs like procmail and vacation. Web servers should use this technique to ensure that commands to execute CGI programs can only execute the CGI programs in the Web server's directories.

Principle of Fail-Safe Defaults
The principle of fail-safe defaults says that access to resources and objects should be denied by default. If you need access to only one particular object, the usual approach of removing access to all other objects violates this principle. Instead, access to all objects should be removed, and then access privileges for that particular object should be explicitly granted. The distinction is subtle, but critical.

To see this, consider the problem of ensuring the user's PATH environment variable is set appropriately. The naive approach is to search the environment for the PATH environment variable and check that its value is acceptable. This leads to two problems. First, what happens if the value is not acceptable? In this case, the value must be replaced. Second, what happens if there are multiple occurrences of the variable? The values of all must be checked and found satisfactory, or all but one must be deleted.

A second approach is to require that the program use the full path name of the program. So the invocation of the system call would be:

system("/bin/date")

This causes the shell to ignore the PATH setting. Unfortunately, this approach is also flawed.

Environment variables other than PATH affect the executed program. For some versions of the Bourne shell, the value of the environment variable IFS is a string of characters that the shell treats as word separators. (This is particularly useful when a shell script is reading lines from the password file, for example.) In such a shell, the following command prints files X and Y:

IFS="/$IFS"; export IFS; cat/x/y

because the shell sees the "/" character as a word separator, which lets the user thwart the use of a full path name as described above. All she need do is set IFS in her environment to include the "/" character and then create a program called "bin" in her current working directory. She then changes her PATH environment variable to look in the current working directory first. When she runs the command, the privileged program invokes the above system function. The subordinate shell reads the argument of system as having two words, "bin" followed by the argument "date." Hence the user's program "bin" will be executed and the shell will pass "date" to it as an argument.

Again the programmer can try to prevent this by setting IFS explicitly in the environment:

system("IFS=\" \t\n\"; export IFS; /bin/date")

As tempting as this approach is, it suffers from two problems. The first is that the attacker can easily defeat it by adding "I" to the IFS variable. Then the shell sees this as adding the environment variable FS to the environment. The second problem arises when the attacker doesn't do this. There are now two occurrences of the IFS environment variable in the environment. Which one is used? That turns out to be implementation-dependent: some versions of the shell use the first (the user's), and others use the second (the one defined in the system argument.

Following the principle of fail-safe defaults offers a simple answer to all this. First, create an empty environment for the shell. Then add preset, safe values of PATH, IFS, and any other needed environment variables to that environment. Finally, set the shell's environment to be the newly created one. Doing so makes the user's environment irrelevant to the system function and the shell it calls. The shell never refers to the user's environment. The shell only uses the newly created safe environment.

Now the order in which the shell evaluates the variables in the environment is irrelevant, because there is only one occurrence of each variable in the environment. If the user adds "/" to the value of IFS in her environment, or alters the value of the PATH environment variable, the shell ignores those changes because it never sees the values of those variables. It only sees the ones defined in the environment set up by the program.

Conclusion
Programming with security in mind is critical for today's programs. This style of programming requires a methodical approach, not one in which various tricks are used without understanding how and why they work. The problem is that tricks only apply to certain situations, and can only be used effectively if those situations arise. But the principles of secure design and implementation apply always, and dramatically improve both the quality and the security of the programs and systems they are applied to.

Recommended Reading

  • J. Saltzer and M. Schroeder, "The Protection of Information in Computer Systems," Proceedings of the IEEE 63 (9) pp. 1278-1308 (September 1975). This paper first enunciated the principles and discussed them thoroughly in a variety of contexts. A must read for anyone doing design and/or implementation in the field of computer security.
  • B. Kernighan and P. Plauger, The Elements of Programming Style, McGraw-Hill Book Co., Reading, MA (1974). The principles described in this book lead to a clear and readable programming style. Their emphasis on simplicity and clarity parallels principles in security. Highly recommended.
  • M. Graff and K. Van Wyk, Secure Coding: Principles and Practices, O'Reilly and Associates, Sebastopol, CA (June 2003). This book describes security through the lifecycle of a program or system. An excellent high-level view of how to write code that emphasizes security.
  • J. Viega and G. McGraw, Building Secure Software: How to Avoid Security Problems the Right Way, Addison-Wesley Publishing Co., Boston, MA (2002). This book discusses both principles and practice, drawing most of its examples from Unix and Linux systems. Another must read for Unix and Linux programmers.
  • M. Howard and D. LeBlanc, Writing Secure Code, Microsoft Press, Redmond, WA (2001). Similar to Viega and McGraw but focusing on Windows platforms, this book shows the application of principles to a different environment. A must read for Windows developers, and a worthwhile read for Unix and Linux programmers interested in a different programming environment.
  • A. Stavely, Towards Zero-Defect Programming, Addison-Wesley Publishing Co., Reading, MA (1998). Although focused on correctness more than security, its ideas can be readily adapted to security. Its mix of formalism and informality is refreshing.
  • More Stories By Matt Bishop

    Matt Bishop is a professor in the Department of Computer Science at the University of California at Davis. A recognized expert in vulnerability analysis, secure systems/software design, network security, access control, authentication, and UNIX security, Bishop also works to improve computer security instruction. He is the author of Computer Security: Art and Science and Introduction to Computer Security (Addison-Wesley).

    Comments (0)

    Share your thoughts on this story.

    Add your comment
    You must be signed in to add a comment. Sign-in | Register

    In accordance with our Comment Policy, we encourage comments that are on topic, relevant and to-the-point. We will remove comments that include profanity, personal attacks, racial slurs, threats of violence, or other inappropriate material that violates our Terms and Conditions, and will block users who make repeated violations. We ask all readers to expect diversity of opinion and to treat one another with dignity and respect.


    @ThingsExpo Stories
    Internet of @ThingsExpo, taking place November 1-3, 2016, at the Santa Clara Convention Center in Santa Clara, CA, is co-located with 19th Cloud Expo and will feature technical sessions from a rock star conference faculty and the leading industry players in the world. The Internet of Things (IoT) is the most profound change in personal and enterprise IT since the creation of the Worldwide Web more than 20 years ago. All major researchers estimate there will be tens of billions devices - comp...
    The 19th International Cloud Expo has announced that its Call for Papers is open. Cloud Expo, to be held November 1-3, 2016, at the Santa Clara Convention Center in Santa Clara, CA, brings together Cloud Computing, Big Data, Internet of Things, DevOps, Digital Transformation, Microservices and WebRTC to one location. With cloud computing driving a higher percentage of enterprise IT budgets every year, it becomes increasingly important to plant your flag in this fast-expanding business opportuni...
    For basic one-to-one voice or video calling solutions, WebRTC has proven to be a very powerful technology. Although WebRTC’s core functionality is to provide secure, real-time p2p media streaming, leveraging native platform features and server-side components brings up new communication capabilities for web and native mobile applications, allowing for advanced multi-user use cases such as video broadcasting, conferencing, and media recording.
    Data is the fuel that drives the machine learning algorithmic engines and ultimately provides the business value. In his session at Cloud Expo, Ed Featherston, a director and senior enterprise architect at Collaborative Consulting, will discuss the key considerations around quality, volume, timeliness, and pedigree that must be dealt with in order to properly fuel that engine.
    SYS-CON Events announced today that 910Telecom will exhibit at the 19th International Cloud Expo, which will take place on November 1–3, 2016, at the Santa Clara Convention Center in Santa Clara, CA. Housed in the classic Denver Gas & Electric Building, 910 15th St., 910Telecom is a carrier-neutral telecom hotel located in the heart of Denver. Adjacent to CenturyLink, AT&T, and Denver Main, 910Telecom offers connectivity to all major carriers, Internet service providers, Internet backbones and ...
    DevOps at Cloud Expo, taking place Nov 1-3, 2016, at the Santa Clara Convention Center in Santa Clara, CA, is co-located with 19th Cloud Expo and will feature technical sessions from a rock star conference faculty and the leading industry players in the world. The widespread success of cloud computing is driving the DevOps revolution in enterprise IT. Now as never before, development teams must communicate and collaborate in a dynamic, 24/7/365 environment. There is no time to wait for long dev...
    Amazon has gradually rolled out parts of its IoT offerings in the last year, but these are just the tip of the iceberg. In addition to optimizing their back-end AWS offerings, Amazon is laying the ground work to be a major force in IoT – especially in the connected home and office. Amazon is extending its reach by building on its dominant Cloud IoT platform, its Dash Button strategy, recently announced Replenishment Services, the Echo/Alexa voice recognition control platform, the 6-7 strategic...
    19th Cloud Expo, taking place November 1-3, 2016, at the Santa Clara Convention Center in Santa Clara, CA, will feature technical sessions from a rock star conference faculty and the leading industry players in the world. Cloud computing is now being embraced by a majority of enterprises of all sizes. Yesterday's debate about public vs. private has transformed into the reality of hybrid cloud: a recent survey shows that 74% of enterprises have a hybrid cloud strategy. Meanwhile, 94% of enterpri...
    Akana has announced the availability of version 8 of its API Management solution. The Akana Platform provides an end-to-end API Management solution for designing, implementing, securing, managing, monitoring, and publishing APIs. It is available as a SaaS platform, on-premises, and as a hybrid deployment. Version 8 introduces a lot of new functionality, all aimed at offering customers the richest API Management capabilities in a way that is easier than ever for API and app developers to use.
    Personalization has long been the holy grail of marketing. Simply stated, communicate the most relevant offer to the right person and you will increase sales. To achieve this, you must understand the individual. Consequently, digital marketers developed many ways to gather and leverage customer information to deliver targeted experiences. In his session at @ThingsExpo, Lou Casal, Founder and Principal Consultant at Practicala, discussed how the Internet of Things (IoT) has accelerated our abil...
    With so much going on in this space you could be forgiven for thinking you were always working with yesterday’s technologies. So much change, so quickly. What do you do if you have to build a solution from the ground up that is expected to live in the field for at least 5-10 years? This is the challenge we faced when we looked to refresh our existing 10-year-old custom hardware stack to measure the fullness of trash cans and compactors.
    The emerging Internet of Everything creates tremendous new opportunities for customer engagement and business model innovation. However, enterprises must overcome a number of critical challenges to bring these new solutions to market. In his session at @ThingsExpo, Michael Martin, CTO/CIO at nfrastructure, outlined these key challenges and recommended approaches for overcoming them to achieve speed and agility in the design, development and implementation of Internet of Everything solutions wi...
    Cloud computing is being adopted in one form or another by 94% of enterprises today. Tens of billions of new devices are being connected to The Internet of Things. And Big Data is driving this bus. An exponential increase is expected in the amount of information being processed, managed, analyzed, and acted upon by enterprise IT. This amazing is not part of some distant future - it is happening today. One report shows a 650% increase in enterprise data by 2020. Other estimates are even higher....
    I wanted to gather all of my Internet of Things (IOT) blogs into a single blog (that I could later use with my University of San Francisco (USF) Big Data “MBA” course). However as I started to pull these blogs together, I realized that my IOT discussion lacked a vision; it lacked an end point towards which an organization could drive their IOT envisioning, proof of value, app dev, data engineering and data science efforts. And I think that the IOT end point is really quite simple…
    "My role is working with customers, helping them go through this digital transformation. I spend a lot of time talking to banks, big industries, manufacturers working through how they are integrating and transforming their IT platforms and moving them forward," explained William Morrish, General Manager Product Sales at Interoute, in this SYS-CON.tv interview at 18th Cloud Expo, held June 7-9, 2016, at the Javits Center in New York City, NY.
    Internet of @ThingsExpo, taking place November 1-3, 2016, at the Santa Clara Convention Center in Santa Clara, CA, is co-located with the 19th International Cloud Expo and will feature technical sessions from a rock star conference faculty and the leading industry players in the world and ThingsExpo Silicon Valley Call for Papers is now open.
    Today we can collect lots and lots of performance data. We build beautiful dashboards and even have fancy query languages to access and transform the data. Still performance data is a secret language only a couple of people understand. The more business becomes digital the more stakeholders are interested in this data including how it relates to business. Some of these people have never used a monitoring tool before. They have a question on their mind like “How is my application doing” but no id...
    SYS-CON Events announced today that Venafi, the Immune System for the Internet™ and the leading provider of Next Generation Trust Protection, will exhibit at @DevOpsSummit at 19th International Cloud Expo, which will take place on November 1–3, 2016, at the Santa Clara Convention Center in Santa Clara, CA. Venafi is the Immune System for the Internet™ that protects the foundation of all cybersecurity – cryptographic keys and digital certificates – so they can’t be misused by bad guys in attacks...
    Smart Cities are here to stay, but for their promise to be delivered, the data they produce must not be put in new siloes. In his session at @ThingsExpo, Mathias Herberts, Co-founder and CTO of Cityzen Data, will deep dive into best practices that will ensure a successful smart city journey.
    In today's uber-connected, consumer-centric, cloud-enabled, insights-driven, multi-device, global world, the focus of solutions has shifted from the product that is sold to the person who is buying the product or service. Enterprises have rebranded their business around the consumers of their products. The buyer is the person and the focus is not on the offering. The person is connected through multiple devices, wearables, at home, on the road, and in multiple locations, sometimes simultaneously...