Applying security label on kernel core crash file

A system for applying security label on a kernel core crash file is disclosed. A method of the disclosure includes accessing, by a processing device, a crash recovery configuration file, parsing the crash recovery configuration file to determine a storage location of a core file, the core file comprising an image of a kernel of an operating system (OS), the image being captured when the OS fails, locating the core file at the determined storage location, and upon determining that a security label is not associated with the core file, sending a command to apply the security label to the core file.

TECHNICAL FIELD

Aspects of the disclosure relate generally to operating systems and, more specifically, relate to applying security label on kernel core crash file.

BACKGROUND

Many operating systems include advanced crash dumping mechanisms. When the crash dumping mechanism is enabled, the system is booted from the context of another kernel than the main operating kernel. This second kernel reserves a small amount of memory and its purpose is to capture crash data, such as a core dump image (e.g., core file) of the kernel when the system crashes. The ability to analyze the core file significantly helps to determine the exact cause of system failure.

Many current operating systems (OSes) implement a security labeling feature, such as Mandatory Access Control (MAC) labeling of SELinux™. However, when creating and saving the core file upon a system crash, a problem may arise with the security labeling of the core file. For example, when the core file is captured, a root file system might not be mounted for use by the second kernel and, as a result, the core file may be saved to a disk that is not the root disk. Accordingly, this results in the OS security labeling policy not being available at the time of saving the core file and not being able to apply the security label on core file at the time of system crash. This can potentially be a security issue as the core file will be unlabeled when system boots back in the main operating kernel.

DETAILED DESCRIPTION

Embodiments of the disclosure provide for applying security label on a kernel core crash file. When an operating system (OS) kernel crashes, a crash recovery component executed in a dedicated crash kernel of the system may collect an image of the kernel that crashed for use in analysis and debugging. This image may be referred to as the kernel core crash file, or as a “core file”. Once the core file has been collected and the OS re-started, embodiments of the disclosure apply the security label to the core file. The crash recovery component may access a configuration file for the crash recovery, parse this configuration file to determine a location of the core file, and access the core file at the determined location to assess whether a security label is already applied to the core file. When a security label is not present with the core file, embodiments send a command to a security labeling feature of the OS to generate and apply the security label to the core file.

Conventional solutions for security labeling of core files included different options for ensuring security labels were applied to core files from a crash recovery process. One solution included applying the security label when the core file was initially captured. However, this solution typically only works when the core file is saved to a root file system. Otherwise, when the root file system is not mounted, the security labeling policy is usually not available and cannot be accessed for accurate labeling purposes.

Another solution is to save a security labeling policy in the crash kernel space for use by the crash recovery process in collecting the core file post-crash. However, this solution generally suffers from the drawback that if an administrator has updated or changed the security labeling policy since it was saved to the crash kernel space, the security labeling policy is usually no longer accurate or reliable. Another disadvantage to this solution is that it utilizes additional memory for the crash recovery process. This memory space is not utilized by the first operating kernel for general OS operations and, as such, remains unused for a majority of time, which is inefficient.

Embodiments of the disclosure overcome the disadvantages presented by the prior solutions. The security labeling of embodiments is persistently available and accurate as it relies on the OS security labeling policy that is current and up-to-date in the operating OS. It also saves memory in the crash kernel space by avoiding having to save the security labeling policy in the crash kernel space.

FIG. 1is a block diagram of one embodiment of a system100that may be part of a computing system such as a client computer (e.g., a personal computer, a laptop, a Personal Digital Assistant (PDA), a mobile phone, a tablet device, etc.), a server computer, a gateway computer, and so on. An exemplary computer system is described in greater detail below in conjunction withFIG. 4. System100includes physical memory (e.g., main memory), that is mapped to virtual memory, which can be divided into regions, such as user space120and operational kernel space110. User space120is reserved for user mode programs including applications125. The operational kernel space110is memory space for running an operating system (OS)115(e.g., Linux™ OS, SELinux™ OS, Windows™ OS, etc.). OS115acts as an interface between an application125and the computing system hardware (not shown) of system100. OS115is responsible for providing services within system100, such as the initial loading of applications125, file management, and protection facilities. For example, upon a bootup procedure of system100, OS115can execute an initialization program/process (init process).

Operational kernel space110can also be referred to as a first kernel space. OS115can provide a crash recovery component130. In one embodiment, crash recovery component130is a kdump service in Red Hat Enterprise Linux™ OS. The crash recovery component130provides a second kernel (crash kernel) using a protected region of memory known as the reserved crash kernel space112. In some embodiments, the second kernel may also be referred to as a capture kernel. Because the booting (initial set of operations used to initialize a component) of the crash kernel utilizes a set amount of memory space, the operational kernel (also referred to as the ‘first kernel’ and/or the ‘first operational kernel’) sets aside (reserves) this memory112for the crash kernel. The reserved crash kernel space112is protected from general user (i.e., is not available during normal operation of the operational OS115A in the operational kernel space110. The crash recovery component130also configures and provides a disk image including one or more crash recovery utilities that are utilized by the crash kernel when the crash kernel is booted into upon a crash of the first kernel.

When the OS115in the operational kernel space110experiences a system failure, the first kernel jumps to the crash kernel to boot into. Once booted, the crash kernel starts a kernel space crash recovery process117A that can reinitialize the hardware of system100without modifying the state of the crashed OS115memory. The crash recovery process117A also starts a user space crash recovery process117B that can collect state data of the crashed OS115for post-mortem analysis. The state data may include a core dump image file (also referred to as ‘core file’ or a ‘kernel core crash file’) that captures an image of the kernel memory upon the crash event. Once the crash recovery process117A,117B has executed and saved the core file, the OS115is re-booted into operational kernel space110to resume providing general operating services for system100.

When OS115implements a security labeling feature, such as Mandatory Access Control (MAC) labeling of SELinux™, labeling of the core file collected by the crash recovery process117can be problematic. For example, when the core file is captured, a root file system might not be mounted for use by the second kernel and, as a result, the core file may be saved to a disk that is not the root disk. Accordingly, this results in a security labeling policy of the OS115not being available at the time of saving the core file and, as such, a security label cannot be applied to the core file at the time of the system100crash. This can potentially be a security issue as the core file will be unlabeled when the system100boots back in the main operating kernel110.

Embodiments of the disclosure provide a crash core file security label component135of crash recovery component130to apply a security label to the core file after the OS115has been re-booted. The OA115is re-booted subsequent to crash recovery process117A,117B performing the crash recovery, including saving the core file, for the crashed OS115. At the time of collection of the core file, it is not labeled with a security label. Once the OS115initializes, the root file system is mounted and the policy data related to the security labeling feature is available. At this time, the crash file security label component135can determine that the core file should be labeled and cause such labeling to occur via a security labeling feature of the OS115. One embodiment of a crash core file security label component135is described in greater detail below with respect toFIG. 2.

FIG. 2is a block diagram of one embodiment of a crash core file security label component200for applying security labels to core files generated from a system crash. The crash core file security label component200may be part of a crash recovery component, such as crash recovery component130ofFIG. 1, which resides in user space and may by the same as crash core file security label component135ofFIG. 1.

The crash core file security label component200can include a crash configuration file parser210, a core file locator220, and a security label checker230. When an operational OS implementing a security labeling feature, such as operational OS115A ofFIG. 1, initializes, the crash core file security label component200executes as part of the initialization routine.

As part of the crash core file security label component200routine, the crash configuration file parser210obtains and parses a crash configuration file240. The crash configuration file240may be a settings file of a crash recovery component of the OS that includes various parameters controlling a crash dump routine of the OS. For example, parameters in the crash configuration file240may include a location of reserved crash kernel space, a size of the reserved crash kernel space, an image file of the crash recovery process, a storage location of a the collected core file, a file system type of the core file storage location, an identifier (ID) or other label of a disk location of the core file store location, and so on. The crash configuration file parser210may examine and identify the different parameters in the core configuration file to determine the location of the core file250saved by a crash recovery process.

Once the crash configuration file parser210determines the location of the core file250, the core file locator navigates to the destination in the system and locates the core file250. Then, security label checker230determines whether a security label is already associated with the core file250. In one embodiment, if the security label checker230determines that there is not a security label associated with the core file250, then the security label checker230issues a command to security labeling feature subsystem260to generate a label for the core file250and apply this generated label to the core file250. The security labeling feature subsystem260may utilize a combination of both user space utilities and OS kernel functionality to provide security labeling feature for an OS. The security labeling feature subsystem260may utilize an existing security labeling policy of the OS to determine the appropriate rules to apply to the core file250in order to generate and apply the label to the core file250.

In one embodiment, if a security label is already associated with the core file250, then crash file security label component200ends its routine without further action. However, in other embodiments, the crash file security label component200may perform further analysis with respect to the existing core file250label, such as determining if the label is the correct security label for the core file250(e.g., in cooperation with the OS security labeling feature subsystem260).

FIG. 3is a flow diagram illustrating a method300for applying security label on kernel core files according to an embodiment of the disclosure. Method300may be performed by processing logic that may comprise hardware (e.g., circuitry, dedicated logic, programmable logic, microcode, etc.), software (such as instructions run on a processing device), firmware, or a combination thereof. In one embodiment, method300is performed by crash core file security label component200ofFIG. 2.

Method300begins at block310where an indication to execute a security label check process is received. In one embodiment, the indication is provided to the crash core file security label component in response to an OS of the system initializing. At block320, a crash recovery configuration file is accessed. The crash configuration file may be a settings file of a crash recovery component of the OS that includes various parameters controlling a crash dump routine of the OS. For example, parameters in the crash configuration file240may include a location of reserved crash kernel space, a size of the reserved crash kernel space, an image file of the crash recovery process, a storage location of a the collected core file, a file system type of the core file storage location, an identifier (ID) or other label of a disk location of the core file store location, and so on.

Then, at block330, the accessed crash recovery configuration file is parsed to determine a core file storage location. The core file storage location may be specified in the crash recovery configuration file, or a general file system location of the core file may be specified in the crash recovery configuration file. At block340, the core file is located and accessed at the core file storage location as determined in block330.

At decision block350, it is determined whether a security label is associated with the core file. If so, then method300ends. If not, then method300continues to block360, where a command is issued to a security labeling subsystem to generate and apply a security label to the core file. The security labeling feature subsystem may utilize existing security labeling policy of the OS to determine the appropriate rules to apply to the core file in order to generate and apply the label to the core file.

The computer system400includes a processing device402, a main memory404(e.g., read-only memory (ROM), flash memory, dynamic random access memory (DRAM) (such as synchronous DRAM (SDRAM) or DRAM (RDRAM), etc.), a static memory406(e.g., flash memory, static random access memory (SRAM), etc.), and a data storage device418, which communicate with each other via a bus430.

The computer system400may further include a network interface device408communicably coupled to a network420. The computer system400also may include a video display unit410(e.g., a liquid crystal display (LCD) or a cathode ray tube (CRT)), an alphanumeric input device412(e.g., a keyboard), a cursor control device414(e.g., a mouse), and a signal generation device416(e.g., a speaker).

The data storage device418may include a machine-accessible storage medium424on which is stored software426embodying any one or more of the methodologies of functions described herein. The software426may also reside, completely or at least partially, within the main memory404as instructions426and/or within the processing device402as processing logic426during execution thereof by the computer system400; the main memory404and the processing device402also constituting machine-accessible storage media.

The machine-readable storage medium424may also be used to store instructions426to implement a crash core file security labeling component200to perform applying security label on kernel core files in a computer system, such as crash core file security labeling component200described with respect toFIG. 2, and/or a software library containing methods that call the above applications. While the machine-accessible storage medium428is shown in an example embodiment to be a single medium, the term “machine-accessible storage medium” should be taken to include a single medium or multiple media (e.g., a centralized or distributed database, and/or associated caches and servers) that store the one or more sets of instructions. The term “machine-accessible storage medium” shall also be taken to include any medium that is capable of storing, encoding or carrying a set of instruction for execution by the machine and that cause the machine to perform any one or more of the methodologies of the disclosure. The term “machine-accessible storage medium” shall accordingly be taken to include, but not be limited to, solid-state memories, and optical and magnetic media.

In the foregoing description, numerous details are set forth. It will be apparent, however, that the disclosure may be practiced without these specific details. In some instances, well-known structures and devices are shown in block diagram form, rather than in detail, in order to avoid obscuring the disclosure.