Notes - MCS
Identification, Authentication and Authorization
Notes - MCS
Identification, Authentication and Authorization
  • Identification, Authentication and Authorization
  • Access Control Models
    • Access types
    • Least privilege principle
    • Access control models
      • Access control kinds
    • Access control kinds
    • Separation of duties
    • Segregation of duties
    • Information flow models
    • Multilevel security
    • Windows mandatory integrity control
    • Clark-Wilson Integrity Model
  • OAuth 2.0 Authorization Framework
    • Goal
    • Roles (RFC 6749)
    • Communication endpoints
    • Application (client)
    • OAuth tokens
    • OAuth flows
      • Code flow
      • Implicit flow
      • Resource owner password flow
      • Client credentials flow
    • Proof Key for Code Exchange (PKCE, RFC 7636)
    • Device authorization grant (RFC 8628)
    • Actual protocol flow
  • Linux Security Mechanisms
    • Mechanisms
    • Linux management privileges
    • Privilege Elevation
    • Capabilities
    • Files extended attributes (xattr)
    • File capabilities
    • Capability transfer across exec
    • Control groups (cgroups)
    • Linux Security Modules (LSM)
    • AppArmor
    • Confinement
  • Authentication Protocols
    • Identity attributes
    • Authentication
    • Authentication interactions
    • Authentication of people
      • Biometrics
      • Token-based OTP generators
      • PAP & CHAP (RFC 1334, 1992, RFC 1994, 1996)
      • S/Key (RFC 2289, 1998)
      • GSM
    • Host authentication
    • Service/server authentication
    • TLS (Transport Layer Security, RFC 8446)
    • SSH (Secure Shell, RFC 4251)
    • Single Sign-On (SSO)
    • Authentication metaprotocols
    • Authentication services
    • Key distribution services
  • PAM (Pluggable Authentication Modules)
    • Motivation
    • PAM
    • PAM APIs
    • Orchestration of PAM actions
    • Module invocation
    • Configuration files
    • PAM orchestration files
    • Scenario 1 – Local authentication
    • Scenario 2 – LDAP auth with local backoff
    • Scenario 3 – MS AD auth with local backoff
  • FIDO and FIDO2 framework
    • FIDO (Fast Identity Online) Alliance
    • Universal 2nd Factor (U2F) protocol
    • WebAuthn
    • Client to Authenticator Protocol (CTAP)
    • Passkeys
  • Authentication with Trusted Third Parties / KDCs
    • Shared-key authentication
    • Key Distribution Center (KDC) concept
    • Kerberos
  • Identity Management
    • Digital Identity
    • Identity Manager (IdM)
    • Identity Provider (IdP)
    • Authoritative source
    • Identity claim
    • Approachs
    • Credential
    • Privacy issues
    • Verifiable credential (VC)
    • Self-Sovereign Identity (SSI)
    • Interoperability
    • eIDAS
  • Anonymity and Privacy
    • Privacy
    • IEEE Digital Privacy Model
    • Privacy with computing technology
    • Privacy and companies
    • Privacy and IAA
    • Identification
    • Authentication
    • Anonymity
    • Microdata privacy issues
    • Microdata privacy enhancing
    • L-Diversity
Powered by GitBook
On this page
  • File system
  • cgroup V2 (and V1) controllers
  • V2 definition
  • cgroups of a process
  1. Linux Security Mechanisms

Control groups (cgroups)

Collection of processes bound by the same criteria and associated with a set of parameters or limits.

cgroups are organized hierarchically.

  • cgroup file system.

  • Limits can be defined at each hierarchical level.

    • Affecting the sub-hierarchy underneath.

Subsystems.

  • Kernel component that modifies the behaviour of cgroup processes.

  • Resource controllers (or simply controllers).

File system

This file system is created by mounting several controllers as cgroup-type file system entities.

  • Usually /sys/fs/cgroup

  • In V2 all controllers are part of a single cgroup2.

Each controller defines a tree of cgroups below the mount point.

  • e.g. memory controller → /sys/fs/cgroup/…/memory.[…]

cgroup V2 (and V1) controllers

V2 definition

Directory under /sys/fs/cgroup.

  • With a set of controllers defined by cgroup.controllers

  • With hierarchy limits defined by cgroup.depth and cgroup.descendants

  • With files to send KILL signals (cgroup.kill) and freeze/unfreeze orders (cgroup.freeze) to all cgroup processes.

    • Including descendants.

  • The processes using the cgroup are given by cgroup.procs and their status reported by cgroups.events.

    • We can add a process to a cgroup just by writing its PID on the first file.

For each active controller, specific files will exist.

Processes can only belong to leaf cgroups.

  • “No internal processes” rule

cgroups of a process

A process can be controlled by an arbitrary number of cgroups.

The list of a process’ cgroups is given by the /proc file system.

  • /proc/[PID]/cgroup

Last updated 1 year ago