Tip of the Trade: Grsecurity

Although SELinux and AppArmor get all the attention as the hot new Mandatory Access Control (MAC) infrastructures for Linux and Unix kernels, there is an oft-neglected, battle-scarred oldtimer that has long served well using Role-Based Access Controls (RBAC): grsecurity.

RBAC is similar to MAC but is more flexible and easier to manage. Suppose you’re running a Web server: With grsecurity, you’ll create a role or a number of roles, depending on the complexity of your server, for the various services and processes needed to run the server. Each role will have a set of permissions that ideally will be the minimum necessary, and no more. You’ll have system users and human users, just like in an ordinary Unix system.

However, instead of controlling access with users, groups and file permissions, the users are assigned specific roles. Like SELinux and AppArmor, grsecurity takes away the power of root compromises.
This opens up all kinds of possibilities for delegating and controlling resources. Rather than hassling with permissions and ownership, you can create different roles for different situations (e.g., users who require only a limited set of network clients, such as e-mail and Web browsers, or server administrators restricted to a limited set of services). You can easily assign a junior admin control of an NFS server without giving him keys to the kingdom, and you can just as easily take it away.

grsecurity scales up nicely, as demonstrated by the hosting company Dreamhost, which uses grsecurity to manage shared hosting accounts. It comes with a “learning” tool that builds system policies for you. Visit grsecurity for excellent documentation and help. Kernel Rebuild Guide may also be helpful.

This article was first published on ServerWatch.com.

RELATED NEWS AND ANALYSIS

• Huawei’s AI Update: Things Are Moving Faster Than We Think

  FEATURE |  By Rob Enderle,
  December 04, 2020

• Keeping Machine Learning Algorithms Honest in the ‘Ethics-First’ Era

  ARTIFICIAL INTELLIGENCE |  By Guest Author,
  November 18, 2020

• Key Trends in Chatbots and RPA

  FEATURE |  By Guest Author,
  November 10, 2020

• Top 10 AIOps Companies

  FEATURE |  By Samuel Greengard,
  November 05, 2020

• What is Text Analysis?

  ARTIFICIAL INTELLIGENCE |  By Guest Author,
  November 02, 2020

• How Intel’s Work With Autonomous Cars Could Redefine General Purpose AI

  ARTIFICIAL INTELLIGENCE |  By Rob Enderle,
  October 29, 2020

• Dell Technologies World: Weaving Together Human And Machine Interaction For AI And Robotics

  ARTIFICIAL INTELLIGENCE |  By Rob Enderle,
  October 23, 2020

• The Super Moderator, or How IBM Project Debater Could Save Social Media

  FEATURE |  By Rob Enderle,
  October 16, 2020

• Top 10 Chatbot Platforms

  FEATURE |  By Cynthia Harvey,
  October 07, 2020

• Finding a Career Path in AI

  ARTIFICIAL INTELLIGENCE |  By Guest Author,
  October 05, 2020

• CIOs Discuss the Promise of AI and Data Science

  FEATURE |  By Guest Author,
  September 25, 2020

• Microsoft Is Building An AI Product That Could Predict The Future

  FEATURE |  By Rob Enderle,
  September 25, 2020

• Top 10 Machine Learning Companies 2020

  FEATURE |  By Cynthia Harvey,
  September 22, 2020

• NVIDIA and ARM: Massively Changing The AI Landscape

  ARTIFICIAL INTELLIGENCE |  By Rob Enderle,
  September 18, 2020

• Continuous Intelligence: Expert Discussion [Video and Podcast]

  ARTIFICIAL INTELLIGENCE |  By James Maguire,
  September 14, 2020

• Artificial Intelligence: Governance and Ethics [Video]

  ARTIFICIAL INTELLIGENCE |  By James Maguire,
  September 13, 2020

• IBM Watson At The US Open: Showcasing The Power Of A Mature Enterprise-Class AI

  FEATURE |  By Rob Enderle,
  September 11, 2020

• Artificial Intelligence: Perception vs. Reality

  FEATURE |  By James Maguire,
  September 09, 2020

• Anticipating The Coming Wave Of AI Enhanced PCs

  FEATURE |  By Rob Enderle,
  September 05, 2020

• The Critical Nature Of IBM’s NLP (Natural Language Processing) Effort

  ARTIFICIAL INTELLIGENCE |  By Rob Enderle,
  August 14, 2020