1 |
On 1/6/2011 5:32 PM, Sven Vermeulen wrote: |
2 |
> I've been working on bringing the SELinux handbook as currently available on |
3 |
> http://www.gentoo.org/proj/en/hardened/selinux/selinux-handbook.xml more |
4 |
> up2date. It's somewhat of a rewrite, but with all elements of the original |
5 |
> SELinux handbook still inside it (apart from the troubleshooting as I guess |
6 |
> those are quite outdated, being from 2006 and older). |
7 |
|
8 |
The troubleshooting is not outdated, though there could be a few additions. |
9 |
|
10 |
> The draft is currently available in the hardened-docs.git repository. In |
11 |
> http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-docs.git;a=tree;f=html/selinux;hb=HEAD |
12 |
> you should be able to select individual chapters (HTML format) in the "raw" |
13 |
> tree to view them somewhat like they would on the Gentoo site, but for your |
14 |
> convenience there's also a PDF available at |
15 |
> http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-docs.git;a=tree;f=pdf;hb=HEAD |
16 |
|
17 |
I looked through section 1 and 2 of the pdf version, and here are my |
18 |
notes so far: |
19 |
|
20 |
1.2.1 The best way to look at security is by defining your security |
21 |
goals. An example would be protecting critical system files, such as |
22 |
the kernel image, shadow passwords, and SELinux policy binary from being |
23 |
written except by trusted processes. |
24 |
|
25 |
1.2.2 I don't understand the point of this section |
26 |
|
27 |
1.2.3 I'd say this is not appropriate for this document. |
28 |
|
29 |
1.2.4 This has problems; authentication is related to access control, |
30 |
but not part of it. Also, "discretionary" in the sense of access |
31 |
control means that users can change the policy. Contrast that with |
32 |
mandatory access control, where the security admin sets the policy. |
33 |
|
34 |
1.3.1 SELinux has been included in the kernel for years, we can drop the |
35 |
"kernel patch" part. |
36 |
|
37 |
2.2.1 This should be users, roles, and types. "Domain" used in SELinux |
38 |
refers to a type that labels a process. The amount of access to |
39 |
unlabeled processes is defined by the policy, not by the SELinux |
40 |
mechanisms. I also think that the newrole example is out of scope for |
41 |
this section. |
42 |
|
43 |
2.2.2 "Contexts for permission rules" doesn't make sense. "Rules" or |
44 |
"Access control policy" or something similar makes more sense. You also |
45 |
jump into rules with no discussion of object classes. The part where |
46 |
you say that if access is denied by DAC, then SELinux isn't checked |
47 |
should be earlier in the intro. |
48 |
|
49 |
2.3.1 same thing about domain vs. type. A type is not a state, it is a |
50 |
security attribute. |
51 |
|
52 |
2.3.2 I think discussion of the specific rules required for a successful |
53 |
domain transition are not relevant for this part of the doc. |
54 |
|
55 |
2.4.1 You say what can be technically done by using a role, but you |
56 |
don't discuss what the concept of a role is. |
57 |
|
58 |
2.4.2 Technically, the only default role is object_r. The remainder are |
59 |
just common ones that you see if you use refpolicy. |
60 |
|
61 |
2.4.3 The key reason for having a SELinux user id that is separate from |
62 |
the Linux user id is that the seuser doesn't change during a login |
63 |
session, but the Linux uid can be changed, eg by setuid or su. |
64 |
|
65 |
2.5.1 The purpose of MLS is to provide a hierarchical confidentiality |
66 |
policy. "This allows administrators to ensure that |
67 |
information flow is more closely governed" is incorrect. MLS can be |
68 |
implemented in TE, but it causes an explosion of types, so its easier to |
69 |
have an additional mechanism. |
70 |
|
71 |
2.6.1 The discussion on why an access is allowed or denied always starts |
72 |
with TE. In this case, user_t can't alter the clock, nor can it reach |
73 |
the hwclock_t domain since there is no domain transition. |
74 |
|
75 |
-- |
76 |
Chris PeBenito |
77 |
<pebenito@g.o> |
78 |
Developer, |
79 |
Hardened Gentoo Linux |