Securelevel

Last updated February 21, 2019

securelevel is a security mechanism in *BSD kernels, which can optionally restrict certain capabilities. Securelevel is controlled by a sysctl variable kern.securelevel. This value is an integer, which set to a value > 0 enables certain class of restrictions. Any superuser process can raise securelevel, but only init process (and not even that on FreeBSD) can lower it.

The Berkeley Software Distribution (BSD) was an operating system based on Research Unix, developed and distributed by the Computer Systems Research Group (CSRG) at the University of California, Berkeley. Today, "BSD" often refers to its descendants, such as FreeBSD, OpenBSD, NetBSD, or DragonFly BSD.

sysctl is a software utility of some Unix-like operating systems that reads and modifies the attributes of the system kernel such as its version number, maximum limits, and security settings. It is available both as a system call for compiled programs, and an administrator command for interactive use and scripting. Linux additionally exposes sysctl as a virtual file system.

In computing, the superuser is a special user account used for system administration. Depending on the operating system (OS), the actual name of this account might be root, administrator, admin or supervisor. In some cases, the actual name of the account is not the determining factor; on Unix-like systems, for example, the user with a user identifier (UID) of zero is the superuser, regardless of the name of that account; and in systems which implement a role based security model, any user with the role of superuser can carry out all actions of the superuser account. The principle of least privilege recommends that most users and applications run under an ordinary account to perform their work, as a superuser account is capable of making unrestricted, potentially adverse, system-wide changes.

When used with FreeBSD jails, each jail maintains its own securelevel in addition to the global securelevel. When evaluated, the higher of the two securelevels will be used. This allows the host environment to run at a lower securelevel than jails, so that it can manipulate file flags that the jails may not be able to.

The FreeBSD jail mechanism is an implementation of operating system-level virtualization that allows system administrators to partition a FreeBSD-based computer system into several independent mini-systems called jails.

When compiled with options REGRESSION, a new sysctl is added to the FreeBSD kernel that allows the securelevel to be lowered for the purposes of automated regression testing.

Securelevel is not to be confused with runlevel.

Definitions

On OpenBSD the securelevels are defined as follows:^[1]

-1(Permanently insecure mode) is functionally identical to securelevel 0 except the Kernel will never attempt to increase the level as it would in level 0. This effectively disables securelevel protections.
0(Insecure mode) all devices can be read or written to (if they have appropriate permissions) and system file flags can be cleared using chflags. This mode is typically used while the system is booting, and once boot is completed and system enters multi-user mode, it is elevated to level 1.
1(Secure mode) this is the default mode when the system is booted into multi-user mode. In this mode the securelevel can not be lowered, the raw memory devices can not be written to, the raw devices of mounted file systems can not be written to, important kernel variables (such as fs.posix.setuid, hw.allowpowerdown, net.inet.ip.sourceroute, machdep.kbdreset, ddb.console, ddb.panic and machdep.allowaperture) are locked down and only GPIO pins that were present during boot may be accessed.
2(Highly secure mode) has the same effects are securelevel 1, and in addition raw disk devices can not be written to even if unmounted, certain time related functions are locked down so the time cannot be set in the past (to help ensure the times of actions recorded in the logs are useful) and pf rules may not be altered. This mode is designed to provide some semblance of defence in the event that the root user account is compromised.

Related Research Articles

An operating system (OS) is system software that manages computer hardware and software resources and provides common services for computer programs.

In computer science, a thread of execution is the smallest sequence of programmed instructions that can be managed independently by a scheduler, which is typically a part of the operating system. The implementation of threads and processes differs between operating systems, but in most cases a thread is a component of a process. Multiple threads can exist within one process, executing concurrently and sharing resources such as memory, while different processes do not share these resources. In particular, the threads of a process share its executable code and the values of its dynamically allocated variables and non-thread-local global variables at any given time.

In computing, a core dump, crash dump, memory dump, or system dump consists of the recorded state of the working memory of a computer program at a specific time, generally when the program has crashed or otherwise terminated abnormally. In practice, other key pieces of program state are usually dumped at the same time, including the processor registers, which may include the program counter and stack pointer, memory management information, and other processor and operating system flags and information. A snapshot dump is a memory dump requested by the computer operator or by the running program, after which the program is able to continue. Core dumps are often used to assist in diagnosing and debugging errors in computer programs.

A live CD is a complete bootable computer installation including operating system which runs directly from a CD-ROM or similar storage device into a computer's memory, rather than loading from a hard disk drive. A Live CD allows users to run an operating system for any purpose without installing it or making any changes to the computer's configuration. Live CDs can run on a computer without secondary storage, such as a hard disk drive, or with a corrupted hard disk drive or file system, allowing data recovery.

In computing, a loadable kernel module (LKM) is an object file that contains code to extend the running kernel, or so-called base kernel, of an operating system. LKMs are typically used to add support for new hardware and/or filesystems, or for adding system calls. When the functionality provided by a LKM is no longer required, it can be unloaded in order to free memory and other resources.

In computing, specifically in Unix and Unix-like operating systems, a raw device is a special kind of logical device associated with a character device file that allows a storage device such as a hard disk drive to be accessed directly, bypassing the operating system's caches and buffers. Applications like a database management system can use raw devices directly, enabling them to manage how data is cached, rather than deferring this task to the operating system.

XNU is the computer operating system kernel developed at Apple Inc. since December 1996 for use in the macOS operating system and released as free and open-source software as part of the Darwin operating system. It is also used as the kernel for the Apple TV Software, iOS, watchOS, tvOS, and audioOS operating systems. XNU is an abbreviation of X is Not Unix.

The Unified Extensible Firmware Interface (UEFI) is a specification that defines a software interface between an operating system and platform firmware. UEFI replaces the Basic Input/Output System (BIOS) firmware interface originally present in all IBM PC-compatible personal computers, with most UEFI firmware implementations providing legacy support for BIOS services. UEFI can support remote diagnostics and repair of computers, even with no operating system installed.

In computer security, a "sandbox" is a security mechanism for separating running programs, usually in an effort to mitigate system failures or software vulnerabilities from spreading. It is often used to execute untested or untrusted programs or code, possibly from unverified or untrusted third parties, suppliers, users or websites, without risking harm to the host machine or operating system. A sandbox typically provides a tightly controlled set of resources for guest programs to run in, such as scratch space on disk and memory. Network access, the ability to inspect the host system or read from input devices are usually disallowed or heavily restricted.

The proc filesystem (procfs) is a special filesystem in Unix-like operating systems that presents information about processes and other system information in a hierarchical file-like structure, providing a more convenient and standardized method for dynamically accessing process data held in the kernel than traditional tracing methods or direct access to kernel memory. Typically, it is mapped to a mount point named /proc at boot time. The proc file system acts as an interface to internal data structures in the kernel. It can be used to obtain information about the system and to change certain kernel parameters at runtime (sysctl).

sysfs is a pseudo file system provided by the Linux kernel that exports information about various kernel subsystems, hardware devices, and associated device drivers from the kernel's device model to user space through virtual files. In addition to providing information about various devices and kernel subsystems, exported virtual files are also used for their configuration.

The magic SysRq key is a key combination understood by the Linux kernel, which allows the user to perform various low-level commands regardless of the system's state. It is often used to recover from freezes, or to reboot a computer without corrupting the filesystem. Its effect is similar to the computer's hardware reset button but with many more options and much more control.

A hybrid kernel is an operating system kernel architecture that attempts to combine aspects and benefits of microkernel and monolithic kernel architectures used in computer operating systems.

A live USB is a USB flash drive or external hard disk drive containing a full operating system that can be booted. They are the evolutionary next step after live CDs, but with the added benefit of writable storage on the live USB itself, allowing customizations to the booted operating system. Live USBs can be used in embedded systems for system administration, data recovery, or test driving, and can persistently save settings and install software packages on the USB device.

FreeNAS is a free and open-source network-attached storage (NAS) software based on FreeBSD and the OpenZFS file system. It is licensed under the terms of the BSD License and runs on commodity x86-64 hardware. FreeNAS supports Windows, macOS and Unix clients and various virtualization hosts such as XenServer and VMware using the SMB, AFP, NFS, iSCSI, SSH, rsync and FTP/TFTP protocols. Advanced FreeNAS features include full-disk encryption and a plug-in architecture for third-party software.

Linux startup process is the multi-stage initialization process performed during booting a Linux installation. It is in many ways similar to the BSD and other Unix-style boot processes, from which it derives.

The Berkeley Packet Filter (BPF) provides a raw interface to data link layers, permitting raw link-layer packets to be sent and received. It is available on most Unix-like operating systems. In addition, if the driver for the network interface supports promiscuous mode, it allows the interface to be put into that mode so that all packets on the network can be received, even those destined to other hosts.

In computer data storage, Rapid Storage Technology (RST), until 2010 called Matrix RAID, is a firmware, hardware and software RAID system. This software monitors essential parts of the RAID function, including the S.M.A.R.T. parameters of connected/supported data devices. It gives an OK/NOK state of devices and RAID. Chipset and BIOS revision must match to the RST revision, and older revisions will endanger SMART monitoring. Supported Intel chipsets may change with each revision of RST.

References

↑ "SECURELEVEL(7)". OpenBSD manual pages.

External links

Securelevel in FreeBSD Handbook

This Unix-related article is a stub. You can help Wikipedia by expanding it.

This page is based on this Wikipedia article
Text is available under the CC BY-SA 4.0 license; additional terms may apply.
Images, videos and audio are available under their respective licenses.

[1] "SECURELEVEL(7)". OpenBSD manual pages.

Securelevel

Contents

Definitions

Related Research Articles

References

External links