[gentoo-hardened] rsbac subproject

[Michal Purzynski]

helo all

I would like to propose new hardened subproject - RSBAC.


SBAC is a flexible, powerful and fast open source access control framework for current Linux kernels, which has been in stable production use since January 2000 (version 1.0.9a). All development is independent of governments and big companies, and no existing access control code has been reused.

The standard package includes a range of access control models like MAC, RC, ACL (see below). Furthermore, the runtime registration facility (REG) makes it easy to implement your own access control model as a kernel module and get it registered at runtime.

The RSBAC framework is based on the Generalized Framework for Access Control (GFAC) by Abrams and LaPadula. All security relevant system calls are extended by security enforcement code. This code calls the central decision component, which in turn calls all active decision modules and generates a combined decision. This decision is then enforced by the system call extensions.

Decisions are based on the type of access (request type), the access target and on the values of attributes attached to the subject calling and to the target to be accessed. Additional independent attributes can be used by individual modules, e.g. the privacy module (PM). All attributes are stored in fully protected directories, one on each mounted device. Thus changes to attributes require special system calls provided.

>From version 1.2.0, all types of network accesses can be controlled individually for all users and programs. This gives you full control over their network behaviour and makes unintended network accesses easier to prevent and detect.

As all types of access decisions are based on general decision requests, many different security policies can be implemented as a decision module. Apart from the builtin models shown below, the optional Module Registration (REG) allows for registration of additional, individual decision modules at runtime.

(quotting from www.rsbac.org/overview.htm)

In hardened project there is already one MAC system - it is selinux. RSBAC can achieve the same level of security, and, (before someone starts flaming, please don't) using some of them is rather about individual preferences not anything else.

Adding RSBAC would allow for choice for users who want use MAC security system. In fact, we would already have three such a systems: Selinux, RSBAC and Grsecurity ACL.

What RSBAC require:
Patched Linux kernel (both versions 2.4 and 2.6 are supported)
RSBAC admin tools - small package with utilities for managing RSBAC
(mayby in future) patch for portage, what would allow labeling files from packages after instalation (assignig their type).
Of course policy - minimal working is easy to do, if RSBAC would join to hardened project full policy along with tools would be developed (yes, it needs time).

Patches for userland are not required.

Ebuilds and patched kernel can be found on:
zeus.polsl.gliwice.pl/~albeiro/rsbac/1.2.2 (2.4.26 kernel and 1.2.2 n `stable`)
zeus.polsl.gliwice.pl/~albeiro/rsbac/1.2.3 (2.6.5 kernel and 1.2.3 rsbac version 1.2.3 `development`)
along with admin-tools ebuilds in the same dirs.
RSBAC-sources are bascialy hardened-sources without Grsecurity patch but with latest PaX and with RSBAC instead.

Ebuilds were written by gentoo developer Zhware, from now on i am maintaining these.

Albeiro