Functional descriptions, File and I/O management | IBM 10 SP1 EAL4

5 Functional descriptions

The kernel structure, its trusted software, and its Target of Evaluation (TOE) Security Functions (TSF) databases provide the foundation for the descriptions in this chapter.

5.1File and I/O management

The file and I/O subsystem is a management system for defining objects on secondary storage devices. The file and I/O subsystem interacts with the memory subsystem, the network subsystem, the inter-process communication (IPC) subsystem, the process subsystem, and the device drivers.

Figure 5-1: File and I/O subsystem and its interaction with other subsystems

A file system is a container for objects on the secondary storage devices. The implementation of the file system allows for the management of a variety of types of file systems. The file systems supported by TOE are ext3, proc, tmpfs, sysfs, devpts, CD-ROM, rootfs, and binfmt_misc.

At the user-interface level, a file system is organized as a tree with a single root, called a directory. A directory contains other directories and files, which are the leaf nodes of the tree. Files are the primary containers of user data. Additionally, files can be symbolic links, named pipes, sockets, or special files that represent devices.

This section briefly describes the SLES file system implementation, and focuses on how file system object attributes support the kernel’s implementation of the Discretionary Access Checks (DAC) policy of the kernel. This section also highlights how file system data and metadata are allocated and initialized to satisfy the object reuse requirement.

32

Image 44

IBM 10 SP1 EAL4 manual Functional descriptions, File and I/O management

Contents

Page EJR Table of Contents 2.1 DAC AppArmor Programs with software privilege Permission bits Access Control Lists 100 142 175 207 250 252 269 Purpose of this document Document overviewConventions used in this document Terminology System Overview Product history Suse Linux Enterprise ServerEServer systems High-level product overview EServer host computer structure Overall structure of the TOEPage TOE services EServer system structure Local and network services provided by Sles Security policy Operation and administration TSF interfaces Approach to TSF identification Page Page System System x hardware overview System x hardware architecture System p hardware architecture System pSystem p hardware overview System z System z hardware overview System z hardware architecture EServer 326 hardware architecture EServerEServer 326 hardware overview AMD x86-64 architecture in compatibility mode Page Privilege level Hardware and software privilegeHardware privilege Levels of Privilege Software privilege 2.1 DAC AppArmor TOE Security Functions software structure Programs with software privilege Kernel TSF software Logical components Logical kernel subsystems and their interactions Kernel threads Execution componentsBase kernel Non-kernel TSF software Kernel modules and device driversPage TSF databases Definition of subsystems for the CC evaluation Hardware FirmwareKernel subsystems Trusted process subsystems User-level audit subsystem Page Functional descriptions File and I/O management Virtual File System Ext3 and CD-ROM file systems before mounting Ext3 and CD-ROM file systems after mounting Pathname translation VFS pathname translation and access control checks Open Shared subtrees WriteMount Extended Attributes Disk-based file systems2.1 Ext3 file system Data structures Page Page ISO 9660 file system for CD-ROM Data structures and algorithms Tmpfs Pseudo file systemsProcfs Rootfs SysfsDevpts Discretionary Access Control DAC ConfigfsInotify Binfmtmisc Permission bits Indicates read ACL qualifier Access Control ListsTypes of ACL tags Default ACLs and ACL inheritance ACL permissionsRelationship to file permission bits Aclmask ACL enforcement Asynchronous I/O 7 I/O scheduler Completely Fair Queuing scheduler Deadline I/O schedulerAnticipatory I/O scheduler 8 I/O interrupts Noop I/O schedulerTop halves Bottom halves Processor interrupts Machine checkTasklets Work queue Process control and management Data structuresPage DAC controls Process creation and destructionControl of child processes Process switch Kernel threadsSetresuidand setresgid Execve Scheduling Hyperthreading scheduler Kernel preemption 14 Hyperthreaded scheduling Inter-process communication Pipes Data structures and algorithms First-In First-Out Named pipes Fifo creation Common data structures System V IPCFifo open Common functions Message queues Semaphores Shared memory regions Signals SocketsData structures Algorithms Network subsystem 16 Object reuse handling in socket allocation Overview of the network protocol stack 18 How data travels through the Network protocol stack Transport layer protocols Network layer protocols Addressing 3.2.2 IPv6 Header Flow Labels SecurityTransition between IPv4 and IPv6 IP Security IPsec Functional Description of IPsec AH Header An IP Packet with tunnel mode AH An IP Packet with tunnel mode ESP Internet Control Message Protocol Icmp Link layer protocols Network services interface Address Resolution Protocol ARP Socket Bind Connect ListenAccept Generic calls Access controlMemory management Page Four-Level Page Tables 24 Previous three-level page-tables architecture Memory addressing System 26 System x virtual addressing space 28 Access control through segmentation Segmentation Paging 30 Regular paging 32 Access control through paging For more information about call gates, refer to 33 Paging data structures System p 34 Logical partitions Privilege State 36 Determination of processor mode in Lpar Hypervisor Real mode addressingAddress Translation on LPARs Direct Memory Access addressing Virtual mode addressingAccess to I/O address space System p native mode Run-Time Abstraction ServicesPreventing denial of service 39 Effective address 41 Block address Machine State Register Block descriptor DescriptorSegment descriptor 45 Block Address Translation entry Address translation mechanisms 47 Block Address Translation access control Address Translation and access controlPage 48 Page Address Translation and access control Native hardware mode Lpar mode2.4.3 z/VM Guest mode System z Address translations Address sizesAddress spaces 49 System z address types and their translation 51 Address translation modes 52 64-bit or 31-bit Dynamic Address Translation Memory protection mechanisms 53 Low-address protection on effective address Table protection 113 114 56 Key match logic for key-controlled protection EServer Logical address Physical address Effective addressLinear address 59 Data access privilege checks Access control through type check Page 121 63 Page map level four entry Kernel memory management Translation Lookaside Buffers Support for Numa servers Reverse map Virtual Memory 65 Rmap VM Huge Translation Lookaside Buffers 66 TLB Operation Remapfilepages Frame management Noncontiguous memory area management Process address spaceMemory area management 68 Object reuse handling while allocating new linear address Memory barriers Symmetric multiprocessing and synchronizationAtomic operations Audit subsystem Audit componentsSpin locks Kernel semaphores Audit kernel components Kernel-userspace interface Task structure Syscall auditingFilesystem watches 71 Task Structure Audit context fields File system audit components User space audit components Audit operation and configuration options Configuration Option Description Possible values Operation Kernel record generation Audit recordsAudit record generation 73 Audit Record Generation Syscall audit record generation 74 Extension to system calls interface File system audit record generation Audit record format Socket call and IPC audit record generationRecord generation by trusted programs Page Event Description LAF audit events Login uid association Audit toolsKernel modules Auditctl Linux Security Module framework Structure AppArmor LSM capabilities moduleLSM AppArmor module AppArmor administrative utilities Var/log/boot.msg Rwl Var/run/klogd.pid AppArmor access control functions Securityfs Interpretive-execution facility Device drivers1 I/O virtualization on System z State description Character device driver Hardware virtualization and simulation Block device driver System initialization Init System Boot process Boot methodsBoot loader Linuxrc 79 System x Sles boot sequence System p Page 80 System p Sles boot sequence System p in Lpar Etc/sysconfig/init script 81 System p Lpar Sles boot sequence System z Control program 82describes the boot process for Sles as a z/VM guest 82 System z Sles boot sequence EServer 169 83schematically describes the boot process of eServer 170 Identification and authentication 83 eServer 326 Sles boot sequence Pluggable Authentication Module Overview Configuration terminology Modules Etc/security/pamenv.conf Protected databases Trusted commands and trusted processes Access control rules11.2.1.1 DAC Agetty Login Gpasswd Mingetty Newgrp Passwd 11.3.7 su OpenSSL Secure socket-layer interface Interaction with auditNetwork applications 84 SSL location in the network stack Concepts Encryption 87 Encryption Algorithm and Key 88 Asymmetric keys Message Authentication Code MAC Message digestDigital certificates and certificate authority SSL architecture 90 SSL Protocol SSL handshake protocol 187 OpenSSL algorithms Symmetric ciphers Hash functions Asymmetric ciphersCertificates Secure Shell SSH client SSH server daemon Very Secure File Transfer Protocol daemon Cups Cupsd Openssl PingPing6 Stunnel System management Account ManagementXinetd Chage Chfn Chsh Usermod User managementUseradd Userdel Group management Groupadd Groupmod Groupdel 202 System Time management Other System ManagementDate Hwclock Supervisor mode instructions MemoryMemory separation 13.5.1.3 I/O controller and network System p Amtu output Star 207 Batch processing Batch processing user commands13.6 I&A support 14.1.2 at 14.2.2 atd Batch processing daemonsCron User-level audit subsystem Audit daemonAudit utilities Aureport Autrace Audit configuration filesAudit logs Supporting functions TSF libraries LibraryDescription Library linking mechanism System call linking mechanism System call argument verification Pageoffset Audit Security management Discretionary Access ControlObject reuse Secure communications TSF protection Testing the TOE protection mechanisms TP.7 Trusted processes TP.4TSF Databases TP.5 Internal TOE protection mechanisms TP.6 External Interfaces Summary of kernel subsystem interfacesKernel subsystem file and I/O Internal Interfaces 1.1.3 Internal function Interfaces defined Kernel subsystem process control and management External interfaces system calls Internal Interfaces Kernel subsystem inter-process communication Dopipe Kernel subsystem networking Kernel subsystem memory management Kernel subsystem audit Internal interfaces Kernel subsystem device drivers Other functions Summary of trusted processes interfaces Kernel subsystems kernel modules References RSA 234