Re: [gentoo-hardened] Call for policy and devs (was: qmail on selinux)

[Chris PeBenito]

On Fri, 2003-11-28 at 15:18, Michael Reilly wrote:
> Do you have any guidelines for things like supported roles (I have user_r,
> staff_r, sysadm_r and am integrating portage from the gentoo policy)?

I'm not sure what you're asking.  But there Gentoo base policy has three
roles (user_r, staff_r, sysadm_r, and portage_r).  User_r is only for
regular users, admins use staff_r and sysadm_r.  Admins that can run
portage have portage_r too.  Except for portage, which is a limited
role, all of the full roles show up in the policy/domains/*.te.  I split
staff_r out of user.te since user_r and staff_r are logically separate,
and it makes it easier to add in extra abilities to staff_r if wanted.

> I also notice that gentoo sets up the user's slightly differently than NSA -
> gentoo has the username in the context for staff_r, for example.  Any other
> things I should know about?

When users create files, the files have the identity of the user in the
context, and this is desired.  Normally users can relabel their files to
a few different contexts (like httpd_user_content_t for apache
~/public_html directories).  However, the identity on the files has to
match the identity of the user, unless its a special role, like
sysadm_r.  This is specified in the constraints file.

> I may also be interested in being a policy dev.  Any special requirements?

No extra requirements.  In general, the Hardened team looks for people
with ability, but also for people that are willing to be invested in the
project, and can function in team.  We're not asking that you ignore
your real life responsibilities, but try to be around a reasonable
amount of time, for contributing, taking bugs, etc.  We don't want
people to disappear all of a sudden.  So for those who really interested
in becoming devs, the best way is, if possible, to be in the IRC
channel, speak up, and contribute.  In short, if you want to become a
dev, act like one :)

-- 
Chris PeBenito
<pebenito@g.o>
Developer,
Hardened Gentoo Linux
Embedded Gentoo Linux
 
Public Key: http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xE6AF9243
Key fingerprint = B0E6 877A 883F A57A 8E6A  CB00 BC8E E42D E6AF 9243