Re: [gentoo-hardened] How do I use grSecurity mandatory access control?

[Peter S. Mazinger]

On Tue, 9 May 2006, Alex Efros wrote:

> Hi!
>
> On Mon, May 08, 2006 at 07:26:54PM -0400, Ned Ludd wrote:
> > > * How do I make a policy?
> > > * Are there reference policies? In that case, where can I get them?
> > > * How do I check a policy for correctness?
> > > * Where can I find more documentation (I found more documentation on
> > > the kernel side of things than on the access control)?
> > Your questions would start a huge thread if we begun at this level
> > without you doing some homework first.
>
> Yeah. But I don't think it's bad idea. Problem with RBAC and grlearn is
> what there no single place with comprehensive yet simple enough HOWTO's,
> policy examples, etc.
>
> > learning modes. It's quite intuitive to administer once you get the
> > initial hang of it.
>
> You right!!! After I try learning mode first time I found it very
> intuitive... but after I've activated rules produced by "learning mode"
> my system "hang" and I have to press RESET button. :)
>
> So I delay learning how to use learning mode without locking my system
> for better time. :(
>
> So, if somebody will summarize all documentation sources you mention -
> I'll be really happy.
>
> P.S. I _had_ read both urls you mention, at least three times each, :)
> and searched google/gmane too, but this was about year ago.
>
> P.P.S. AFAIK SELinux has much more rich documentation and a lot of
> predefined policy, but my intuition says what there something wrong
> with SELinux and I prefer to use RBAC as soon as I found enough
> documentation. (I don't used SELinux myself, so probably my intuition
> feeling based mostly on articles/posts readed on GrSecurity-related sites
> and some posts about SELinux in this maillist...)

I have some "predefined policies" but I haven't ever tested them in a 
pure gentoo environment (I do not use gentoo in "production environment"), 
if you want them as startup and will provide the gentoo counterparts, I 
will send them to you (read the earlier __carefully__, if you are not 
able/not willing to provide them, then it was the last time I am doing 
this, I am not willing to support any of them and do any of the needed 
tests to work in conjunction w/ gentoo)

Peter

-- 
Peter S. Mazinger <ps dot m at gmx dot net>           ID: 0xA5F059F2
Key fingerprint = 92A4 31E1 56BC 3D5A 2D08  BB6E C389 975E A5F0 59F2

-- 
gentoo-hardened@g.o mailing list