Migrating older SELinux policies to new Linux releases

Migrating older SELinux policies to new Linux releases

[Kim Lawson-Jenkins]

[-- Attachment #1: Type: text/plain, Size: 593 bytes --]

 

I'm migrating application software from Fedora Core 3 to RHEL5.  The SELinux
strict policy was used for Fedora Core 3 and as a first step I only want to
migrate the existing policy to RHEL5.  (Later I plan to make changes to the
policy using the newer SELinux development tools.)  I've seen several books
and whitepapers that discuss generating new policies using the current
SELinux tools but I have seen no whitepapers, examples, or guidelines on how
to, say, migrate older strict policies to the new reference policy.  Are
there any such guidelines or suggestions documented somewhere?


[-- Attachment #2: Type: text/html, Size: 1849 bytes --]

Re: Migrating older SELinux policies to new Linux releases

[Stephen Smalley]

On Wed, 2007-08-08 at 08:04 -0500, Kim Lawson-Jenkins wrote:
>  
> 
> I’m migrating application software from Fedora Core 3 to RHEL5.  The
> SELinux strict policy was used for Fedora Core 3 and as a first step I
> only want to migrate the existing policy to RHEL5.  (Later I plan to
> make changes to the policy using the newer SELinux development
> tools.)  I’ve seen several books and whitepapers that discuss
> generating new policies using the current SELinux tools but I have
> seen no whitepapers, examples, or guidelines on how to, say, migrate
> older strict policies to the new reference policy.  Are there any such
> guidelines or suggestions documented somewhere?

I'm not aware of anything specific, although there is certainly
documentation of the refpolicy
(http://oss.tresys.com/projects/refpolicy/wiki/Documentation) and the
SELinux by Example book provides examples of writing both kinds of
policies.  Looking at an example .te file from the refpolicy is always
helpful too.  SLIDE is an Eclipse plugin for working with refpolicy if
you like that sort of thing.

I was thinking that there was a mapping from example policy macros to
refpolicy interfaces at one time, but I don't see it now.

Just to clarify, what you are actually doing is porting from a policy
based on example policy to a policy based reference policy.  Both
policies have a "strict" form and a "targeted" form.  If your changes
are localized, then you might be able to just create and build a
loadable policy module and then add that to the existing strict policy
in RHEL5 (selinux-policy-strict) without needing to rebuild the full
reference policy.

-- 
Stephen Smalley
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: Migrating older SELinux policies to new Linux releases

[Christopher J. PeBenito]

On Wed, 2007-08-08 at 09:45 -0400, Stephen Smalley wrote:
> On Wed, 2007-08-08 at 08:04 -0500, Kim Lawson-Jenkins wrote:
> >  
> > 
> > I’m migrating application software from Fedora Core 3 to RHEL5.  The
> > SELinux strict policy was used for Fedora Core 3 and as a first step I
> > only want to migrate the existing policy to RHEL5.  (Later I plan to
> > make changes to the policy using the newer SELinux development
> > tools.)  I’ve seen several books and whitepapers that discuss
> > generating new policies using the current SELinux tools but I have
> > seen no whitepapers, examples, or guidelines on how to, say, migrate
> > older strict policies to the new reference policy.  Are there any such
> > guidelines or suggestions documented somewhere?
> 
> I'm not aware of anything specific, although there is certainly
> documentation of the refpolicy
> (http://oss.tresys.com/projects/refpolicy/wiki/Documentation) and the
> SELinux by Example book provides examples of writing both kinds of
> policies.  Looking at an example .te file from the refpolicy is always
> helpful too.  SLIDE is an Eclipse plugin for working with refpolicy if
> you like that sort of thing.
> 
> I was thinking that there was a mapping from example policy macros to
> refpolicy interfaces at one time, but I don't see it now.

Its still in the repository:

http://oss.tresys.com/projects/refpolicy/browser/docs/macro_conversion_guide

It was updated a year ago, so it may be a little out of date.

-- 
Chris PeBenito
Tresys Technology, LLC
(410) 290-1411 x150



--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

RE: Migrating older SELinux policies to new Linux releases

[Kim Lawson-Jenkins]

You're correct.  I am porting from a policy based on example policy to a
policy based on the reference policy.  I already have the SELinux Reference
policy strict base module on RHEL5 and as a next step will look at adding a
loadable policy module as you suggested.  Thanks for a response.  And thank
you Chris for the location of the macro conversion guide.

Kim

-----Original Message-----
From: Stephen Smalley [mailto:sds@tycho.nsa.gov] 
Sent: Wednesday, August 08, 2007 8:45 AM
To: Kim Lawson-Jenkins
Cc: selinux@tycho.nsa.gov; Christopher J. PeBenito; Daniel J Walsh
Subject: Re: Migrating older SELinux policies to new Linux releases

On Wed, 2007-08-08 at 08:04 -0500, Kim Lawson-Jenkins wrote:
>  
> 
> I'm migrating application software from Fedora Core 3 to RHEL5.  The
> SELinux strict policy was used for Fedora Core 3 and as a first step I
> only want to migrate the existing policy to RHEL5.  (Later I plan to
> make changes to the policy using the newer SELinux development
> tools.)  I've seen several books and whitepapers that discuss
> generating new policies using the current SELinux tools but I have
> seen no whitepapers, examples, or guidelines on how to, say, migrate
> older strict policies to the new reference policy.  Are there any such
> guidelines or suggestions documented somewhere?

I'm not aware of anything specific, although there is certainly
documentation of the refpolicy
(http://oss.tresys.com/projects/refpolicy/wiki/Documentation) and the
SELinux by Example book provides examples of writing both kinds of
policies.  Looking at an example .te file from the refpolicy is always
helpful too.  SLIDE is an Eclipse plugin for working with refpolicy if
you like that sort of thing.

I was thinking that there was a mapping from example policy macros to
refpolicy interfaces at one time, but I don't see it now.

Just to clarify, what you are actually doing is porting from a policy
based on example policy to a policy based reference policy.  Both
policies have a "strict" form and a "targeted" form.  If your changes
are localized, then you might be able to just create and build a
loadable policy module and then add that to the existing strict policy
in RHEL5 (selinux-policy-strict) without needing to rebuild the full
reference policy.

-- 
Stephen Smalley
National Security Agency



--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.