RE: FW: Current/Future Plans to Support Stacking LSM Modules

["Tom Fortmann" <tfortmann@xcapesolutions.net>]

Stephen,

The security measures we are trying to implement require us to actually
inspect, and in some case modify, the application data flowing over a socket
connection.  Our goal is to secure legacy server applications at the socket
layer.  We have done some proof of concept work at the netfilter layer, but
the ultimate solution is better suited above the TCP/IP packet layer.

Does SELinux provide a mechanism for us to do this, and or does it call the
secondary LSM hooks that provide this type of access.  Specifically the
socket_xxxx hooks?

Thanks again for all of your help,
Tom

Thomas Fortmann
Sr. Software Engineer
Xcape Solutions, Inc.
-----Original Message-----
From: Stephen Smalley [mailto:sds@tycho.nsa.gov] 
Sent: Tuesday, January 16, 2007 1:52 PM
To: Tom Fortmann
Cc: selinux@tycho.nsa.gov
Subject: Re: FW: Current/Future Plans to Support Stacking LSM Modules

On Tue, 2007-01-16 at 13:41 -0600, Tom Fortmann wrote:
> Can you send me a pointer to the limited stacking that selinux supports?

http://www.nsa.gov/selinux/papers/module/x341.html

> I will join the LSM list.  I started here because LSM already supports a
> basic stacking method.  However, SELinux does not support the
> mod_reg_security call necessary to take advantage of this capability.  

No, SELinux does support trivial stacking by implementing a
register_security hook, which is what mod_reg_security() calls.  That is
used to combine SELinux with the Linux capabilities module.

> The product we are developing adds additional security at the application
> data layer.  It is a commercial product so I can't say a lot, other then
to
> say that SELinux currently does not provide the additional features we are
> working on.

If you are adding additional security at the application data layer,
then you can do that in userspace, and use SELinux Type Enforcement to
make it unbypassable and tamperproof.  You don't need to change the
kernel.

-- 
Stephen Smalley
National Security Agency



--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.