Click here to close now.


Linux Containers Authors: Carmen Gonzalez, Sanjeev Sharma, Liz McMillan, Tim Hinds, Blue Box Blog

Related Topics: Linux Containers

Linux Containers: Article

Principles of Secure Programming

Applying basic security principles to programming

The purpose of this article is to show how basic security principles can help you develop programs that are harder for the bad guys to break. We'll examine a simple function that executes a command as though it were typed at the keyboard, exactly what the library function system does. But unlike many system implementations, we'll constrain what happens so the calling program can't trick it into executing some other program.

The system function takes a single argument: a character string with the command to be executed just as it would be typed at the keyboard. The function first invokes the Bourne shell, passing the command to that shell using the "–c" option. The shell then spawns the command. For example:

invokes the command
/bin/sh –c "date"

This executes the program "date," which prints the date on the standard output.

Security Issues
Security issues arise when the program invoking the system function is a privileged program. The "privilege" may consist of having setuid and/or setgid privileges such as su or being able to run one of a specified set of programs such as a Web server serving CGI scripts. The attacker's goal is to trick the program into executing some other program, for example a version of date that's a command interpreter rather than just printing the date.

Problems arise because of the power of the Bourne shell as a command interpreter. That shell takes information from the environment, which consists of shell variables, file descriptors, signal-handling routines, and any other aspects of the process space that could affect program execution. For our purposes, we'll just consider environment variables.

One relevant environment variable is the PATH environment variable. When given a command that doesn't contain a '/' the Bourne shell treats the value of the PATH variable as a sequence of directory names. It looks in each directory in the given order for a program named "date" and executes the first one found. Suppose an attacker finds a setuid-to-root program that uses system to run the "date" command. The attacker can then copy the shell into a file named "date" in her current working directory, prepend "." to the list of directories in the value of PATH, and then execute the program. When system invokes the shell, it searches each directory in the value of PATH in order for a command named "date." The first directory searched will be the current working directory. The shell will find a program called "date" there and execute it, spawning the command interpreter, which will run with root privileges.

Our goal is to construct a version of system that's invulnerable to this kind of attack. Specifically, we want to guarantee that when the caller passes a command name to system, the user can't cause the program to execute a different program.

Applying the Principles
We'll apply two principles of secure design and implementation. They come from a paper by Jerome Saltzer and Michael Schroeder and are central to any security work. In practice, we would also consider the other six, but the two we'll use have more impact on the design and implementation of this particular function than the others.

Principle of Least Privilege
The first principle is the principle of least privilege. This principle, also called the need-to-know principle, says that a process should have the minimum privileges needed to perform its task. For this problem, this rule says that system should execute the command with the privileges of the user, not with those of root, if at all possible. As an example, were the privileged program to print the date and time by using system to run the command "date" as described above, there's no reason that "date" needs to be executed as root. It could just as easily be executed with the user's privileges. Hence the first step in our new system command would be to let the caller reset the privileges to those of the real user and group. Doing this means that the user can only compromise her own account - and as since she already has full access to it such a compromise is meaningless.

If the caller lets the user select one of a set of commands, then a different application of the principle of least privilege provides the required restriction. The program configuration should create a directory into which copies of the commands to be executed are placed. Then the program changes its notion of the root directory to that of the directory containing the commands. Even if the user can enter the name of a different command, only the authorized commands are accessible to the program. So only the authorized commands can be executed, and the user will get an error message. This is the technique that sendmail's restricted shell uses to ensure that sendmail only executes safe programs like procmail and vacation. Web servers should use this technique to ensure that commands to execute CGI programs can only execute the CGI programs in the Web server's directories.

Principle of Fail-Safe Defaults
The principle of fail-safe defaults says that access to resources and objects should be denied by default. If you need access to only one particular object, the usual approach of removing access to all other objects violates this principle. Instead, access to all objects should be removed, and then access privileges for that particular object should be explicitly granted. The distinction is subtle, but critical.

To see this, consider the problem of ensuring the user's PATH environment variable is set appropriately. The naive approach is to search the environment for the PATH environment variable and check that its value is acceptable. This leads to two problems. First, what happens if the value is not acceptable? In this case, the value must be replaced. Second, what happens if there are multiple occurrences of the variable? The values of all must be checked and found satisfactory, or all but one must be deleted.

A second approach is to require that the program use the full path name of the program. So the invocation of the system call would be:


This causes the shell to ignore the PATH setting. Unfortunately, this approach is also flawed.

Environment variables other than PATH affect the executed program. For some versions of the Bourne shell, the value of the environment variable IFS is a string of characters that the shell treats as word separators. (This is particularly useful when a shell script is reading lines from the password file, for example.) In such a shell, the following command prints files X and Y:

IFS="/$IFS"; export IFS; cat/x/y

because the shell sees the "/" character as a word separator, which lets the user thwart the use of a full path name as described above. All she need do is set IFS in her environment to include the "/" character and then create a program called "bin" in her current working directory. She then changes her PATH environment variable to look in the current working directory first. When she runs the command, the privileged program invokes the above system function. The subordinate shell reads the argument of system as having two words, "bin" followed by the argument "date." Hence the user's program "bin" will be executed and the shell will pass "date" to it as an argument.

Again the programmer can try to prevent this by setting IFS explicitly in the environment:

system("IFS=\" \t\n\"; export IFS; /bin/date")

As tempting as this approach is, it suffers from two problems. The first is that the attacker can easily defeat it by adding "I" to the IFS variable. Then the shell sees this as adding the environment variable FS to the environment. The second problem arises when the attacker doesn't do this. There are now two occurrences of the IFS environment variable in the environment. Which one is used? That turns out to be implementation-dependent: some versions of the shell use the first (the user's), and others use the second (the one defined in the system argument.

Following the principle of fail-safe defaults offers a simple answer to all this. First, create an empty environment for the shell. Then add preset, safe values of PATH, IFS, and any other needed environment variables to that environment. Finally, set the shell's environment to be the newly created one. Doing so makes the user's environment irrelevant to the system function and the shell it calls. The shell never refers to the user's environment. The shell only uses the newly created safe environment.

Now the order in which the shell evaluates the variables in the environment is irrelevant, because there is only one occurrence of each variable in the environment. If the user adds "/" to the value of IFS in her environment, or alters the value of the PATH environment variable, the shell ignores those changes because it never sees the values of those variables. It only sees the ones defined in the environment set up by the program.

Programming with security in mind is critical for today's programs. This style of programming requires a methodical approach, not one in which various tricks are used without understanding how and why they work. The problem is that tricks only apply to certain situations, and can only be used effectively if those situations arise. But the principles of secure design and implementation apply always, and dramatically improve both the quality and the security of the programs and systems they are applied to.

Recommended Reading

  • J. Saltzer and M. Schroeder, "The Protection of Information in Computer Systems," Proceedings of the IEEE 63 (9) pp. 1278-1308 (September 1975). This paper first enunciated the principles and discussed them thoroughly in a variety of contexts. A must read for anyone doing design and/or implementation in the field of computer security.
  • B. Kernighan and P. Plauger, The Elements of Programming Style, McGraw-Hill Book Co., Reading, MA (1974). The principles described in this book lead to a clear and readable programming style. Their emphasis on simplicity and clarity parallels principles in security. Highly recommended.
  • M. Graff and K. Van Wyk, Secure Coding: Principles and Practices, O'Reilly and Associates, Sebastopol, CA (June 2003). This book describes security through the lifecycle of a program or system. An excellent high-level view of how to write code that emphasizes security.
  • J. Viega and G. McGraw, Building Secure Software: How to Avoid Security Problems the Right Way, Addison-Wesley Publishing Co., Boston, MA (2002). This book discusses both principles and practice, drawing most of its examples from Unix and Linux systems. Another must read for Unix and Linux programmers.
  • M. Howard and D. LeBlanc, Writing Secure Code, Microsoft Press, Redmond, WA (2001). Similar to Viega and McGraw but focusing on Windows platforms, this book shows the application of principles to a different environment. A must read for Windows developers, and a worthwhile read for Unix and Linux programmers interested in a different programming environment.
  • A. Stavely, Towards Zero-Defect Programming, Addison-Wesley Publishing Co., Reading, MA (1998). Although focused on correctness more than security, its ideas can be readily adapted to security. Its mix of formalism and informality is refreshing.
  • More Stories By Matt Bishop

    Matt Bishop is a professor in the Department of Computer Science at the University of California at Davis. A recognized expert in vulnerability analysis, secure systems/software design, network security, access control, authentication, and UNIX security, Bishop also works to improve computer security instruction. He is the author of Computer Security: Art and Science and Introduction to Computer Security (Addison-Wesley).

    Comments (0)

    Share your thoughts on this story.

    Add your comment
    You must be signed in to add a comment. Sign-in | Register

    In accordance with our Comment Policy, we encourage comments that are on topic, relevant and to-the-point. We will remove comments that include profanity, personal attacks, racial slurs, threats of violence, or other inappropriate material that violates our Terms and Conditions, and will block users who make repeated violations. We ask all readers to expect diversity of opinion and to treat one another with dignity and respect.

    @ThingsExpo Stories
    The buzz continues for cloud, data analytics and the Internet of Things (IoT) and their collective impact across all industries. But a new conversation is emerging - how do companies use industry disruption and technology enablers to lead in markets undergoing change, uncertainty and ambiguity? Organizations of all sizes need to evolve and transform, often under massive pressure, as industry lines blur and merge and traditional business models are assaulted and turned upside down. In this new data-driven world, marketplaces reign supreme while interoperability, APIs and applications deliver un...
    WebRTC converts the entire network into a ubiquitous communications cloud thereby connecting anytime, anywhere through any point. In his session at WebRTC Summit,, Mark Castleman, EIR at Bell Labs and Head of Future X Labs, will discuss how the transformational nature of communications is achieved through the democratizing force of WebRTC. WebRTC is doing for voice what HTML did for web content.
    Too often with compelling new technologies market participants become overly enamored with that attractiveness of the technology and neglect underlying business drivers. This tendency, what some call the “newest shiny object syndrome,” is understandable given that virtually all of us are heavily engaged in technology. But it is also mistaken. Without concrete business cases driving its deployment, IoT, like many other technologies before it, will fade into obscurity.
    The IoT is upon us, but today’s databases, built on 30-year-old math, require multiple platforms to create a single solution. Data demands of the IoT require Big Data systems that can handle ingest, transactions and analytics concurrently adapting to varied situations as they occur, with speed at scale. In his session at @ThingsExpo, Chad Jones, chief strategy officer at Deep Information Sciences, will look differently at IoT data so enterprises can fully leverage their IoT potential. He’ll share tips on how to speed up business initiatives, harness Big Data and remain one step ahead by apply...
    Today air travel is a minefield of delays, hassles and customer disappointment. Airlines struggle to revitalize the experience. GE and M2Mi will demonstrate practical examples of how IoT solutions are helping airlines bring back personalization, reduce trip time and improve reliability. In their session at @ThingsExpo, Shyam Varan Nath, Principal Architect with GE, and Dr. Sarah Cooper, M2Mi's VP Business Development and Engineering, will explore the IoT cloud-based platform technologies driving this change including privacy controls, data transparency and integration of real time context w...
    The broad selection of hardware, the rapid evolution of operating systems and the time-to-market for mobile apps has been so rapid that new challenges for developers and engineers arise every day. Security, testing, hosting, and other metrics have to be considered through the process. In his session at Big Data Expo, Walter Maguire, Chief Field Technologist, HP Big Data Group, at Hewlett-Packard, will discuss the challenges faced by developers and a composite Big Data applications builder, focusing on how to help solve the problems that developers are continuously battling.
    Nowadays, a large number of sensors and devices are connected to the network. Leading-edge IoT technologies integrate various types of sensor data to create a new value for several business decision scenarios. The transparent cloud is a model of a new IoT emergence service platform. Many service providers store and access various types of sensor data in order to create and find out new business values by integrating such data.
    WebRTC services have already permeated corporate communications in the form of videoconferencing solutions. However, WebRTC has the potential of going beyond and catalyzing a new class of services providing more than calls with capabilities such as mass-scale real-time media broadcasting, enriched and augmented video, person-to-machine and machine-to-machine communications. In his session at @ThingsExpo, Luis Lopez, CEO of Kurento, will introduce the technologies required for implementing these ideas and some early experiments performed in the Kurento open source software community in areas ...
    There are so many tools and techniques for data analytics that even for a data scientist the choices, possible systems, and even the types of data can be daunting. In his session at @ThingsExpo, Chris Harrold, Global CTO for Big Data Solutions for EMC Corporation, will show how to perform a simple, but meaningful analysis of social sentiment data using freely available tools that take only minutes to download and install. Participants will get the download information, scripts, and complete end-to-end walkthrough of the analysis from start to finish. Participants will also be given the pract...
    Today’s connected world is moving from devices towards things, what this means is that by using increasingly low cost sensors embedded in devices we can create many new use cases. These span across use cases in cities, vehicles, home, offices, factories, retail environments, worksites, health, logistics, and health. These use cases rely on ubiquitous connectivity and generate massive amounts of data at scale. These technologies enable new business opportunities, ways to optimize and automate, along with new ways to engage with users.
    The Internet of Things (IoT) is growing rapidly by extending current technologies, products and networks. By 2020, Cisco estimates there will be 50 billion connected devices. Gartner has forecast revenues of over $300 billion, just to IoT suppliers. Now is the time to figure out how you’ll make money – not just create innovative products. With hundreds of new products and companies jumping into the IoT fray every month, there’s no shortage of innovation. Despite this, McKinsey/VisionMobile data shows "less than 10 percent of IoT developers are making enough to support a reasonably sized team....
    Internet of Things (IoT) will be a hybrid ecosystem of diverse devices and sensors collaborating with operational and enterprise systems to create the next big application. In their session at @ThingsExpo, Bramh Gupta, founder and CEO of, and Fred Yatzeck, principal architect leading product development at, discussed how choosing the right middleware and integration strategy from the get-go will enable IoT solution developers to adapt and grow with the industry, while at the same time reduce Time to Market (TTM) by using plug and play capabilities offered by a robust IoT ...
    “In the past year we've seen a lot of stabilization of WebRTC. You can now use it in production with a far greater degree of certainty. A lot of the real developments in the past year have been in things like the data channel, which will enable a whole new type of application," explained Peter Dunkley, Technical Director at Acision, in this interview at @ThingsExpo, held Nov 4–6, 2014, at the Santa Clara Convention Center in Santa Clara, CA.
    Through WebRTC, audio and video communications are being embedded more easily than ever into applications, helping carriers, enterprises and independent software vendors deliver greater functionality to their end users. With today’s business world increasingly focused on outcomes, users’ growing calls for ease of use, and businesses craving smarter, tighter integration, what’s the next step in delivering a richer, more immersive experience? That richer, more fully integrated experience comes about through a Communications Platform as a Service which allows for messaging, screen sharing, video...
    SYS-CON Events announced today that Dyn, the worldwide leader in Internet Performance, will exhibit at SYS-CON's 17th International Cloud Expo®, which will take place on November 3-5, 2015, at the Santa Clara Convention Center in Santa Clara, CA. Dyn is a cloud-based Internet Performance company. Dyn helps companies monitor, control, and optimize online infrastructure for an exceptional end-user experience. Through a world-class network and unrivaled, objective intelligence into Internet conditions, Dyn ensures traffic gets delivered faster, safer, and more reliably than ever.
    The IoT market is on track to hit $7.1 trillion in 2020. The reality is that only a handful of companies are ready for this massive demand. There are a lot of barriers, paint points, traps, and hidden roadblocks. How can we deal with these issues and challenges? The paradigm has changed. Old-style ad-hoc trial-and-error ways will certainly lead you to the dead end. What is mandatory is an overarching and adaptive approach to effectively handle the rapid changes and exponential growth.
    Mobile messaging has been a popular communication channel for more than 20 years. Finnish engineer Matti Makkonen invented the idea for SMS (Short Message Service) in 1984, making his vision a reality on December 3, 1992 by sending the first message ("Happy Christmas") from a PC to a cell phone. Since then, the technology has evolved immensely, from both a technology standpoint, and in our everyday uses for it. Originally used for person-to-person (P2P) communication, i.e., Sally sends a text message to Betty – mobile messaging now offers tremendous value to businesses for customer and empl...
    Can call centers hang up the phones for good? Intuitive Solutions did. WebRTC enabled this contact center provider to eliminate antiquated telephony and desktop phone infrastructure with a pure web-based solution, allowing them to expand beyond brick-and-mortar confines to a home-based agent model. It also ensured scalability and better service for customers, including MUY! Companies, one of the country's largest franchise restaurant companies with 232 Pizza Hut locations. This is one example of WebRTC adoption today, but the potential is limitless when powered by IoT.
    You have your devices and your data, but what about the rest of your Internet of Things story? Two popular classes of technologies that nicely handle the Big Data analytics for Internet of Things are Apache Hadoop and NoSQL. Hadoop is designed for parallelizing analytical work across many servers and is ideal for the massive data volumes you create with IoT devices. NoSQL databases such as Apache HBase are ideal for storing and retrieving IoT data as “time series data.”
    Clearly the way forward is to move to cloud be it bare metal, VMs or containers. One aspect of the current public clouds that is slowing this cloud migration is cloud lock-in. Every cloud vendor is trying to make it very difficult to move out once a customer has chosen their cloud. In his session at 17th Cloud Expo, Naveen Nimmu, CEO of Clouber, Inc., will advocate that making the inter-cloud migration as simple as changing airlines would help the entire industry to quickly adopt the cloud without worrying about any lock-in fears. In fact by having standard APIs for IaaS would help PaaS expl...