selinux support on kernel 2.6.19.2 pt.2

selinux support on kernel 2.6.19.2 pt.2

[Vincenzo Ciaglia]

Regarding to my previous problem about SeLinux support on Linux Kernel
2.6.19.2, i wanna say that i solved by patching it with the latest
2.6.20-rc5 prepatch.

Thank you!

-- 
Vincenzo Ciaglia, <vin(at)netwosix(dot)org>
Linux Netwosix - <www.netwosix.org>



--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

MITRE releases Polgen 1.4

[Brian T. Sniffen]

Polgen is a collection of scripts and tools developed by the MITRE
corporation to automate the SELinux policy generation process.  You
can download the latest release from <http://polgen.sourceforge.net/>.

This release incorporates two major changes to polgen. First, polgen
now supports generation of reference policy.  Second, polgen uses
Polgen Specification Language (PSL) files to bootstrap analysis.

Polgen handles the modularity of reference policy by searching through
.if files to find interfaces that will handle access requirements of
the program under analysis.  The technique used appears complementary
to Karl MacMillan's Madison library.  There are several polgen user
interface changes that we have made in support of generating
reference policy.  The menu-style interface asks users to fill in
information about known capabilities of program entry points and about
expectations for how the program module might be used by other
to-be-written modules.

PSL allows users to declare those directories and program entry points
that will need to be given special types. For example if configuration
files are used, the psl writer will indicate that a program component
reads from a particular directory and/or reads specific files. PSL can
also be used in a mode where program developers know the behavior of
the program and can offer advice that will statically complement
polgen's dynamic analysis strategy.


--
Brian T. Sniffen                                      bsniffen@mitre.org
The MITRE Corporation                                       781-271-2904

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: MITRE releases Polgen 1.4

[Karl MacMillan]

Brian T. Sniffen wrote:
> 
> Polgen handles the modularity of reference policy by searching through
> .if files to find interfaces that will handle access requirements of
> the program under analysis.  The technique used appears complementary
> to Karl MacMillan's Madison library.

Can you point me to the implementation inside of polgen? It would seem 
to be nice to merge this functionality into a single upstream 
implementation. Do you have any interest in pursuing this?

Karl


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: MITRE releases Polgen 1.4

[Brian T. Sniffen]

[-- Attachment #1: Type: text/plain, Size: 1005 bytes --]

Karl MacMillan <kmacmillan@mentalrootkit.com> writes:

> Brian T. Sniffen wrote:
>>
>> Polgen handles the modularity of reference policy by searching through
>> .if files to find interfaces that will handle access requirements of
>> the program under analysis.  The technique used appears complementary
>> to Karl MacMillan's Madison library.
>
> Can you point me to the implementation inside of polgen? It would seem
> to be nice to merge this functionality into a single upstream
> implementation. Do you have any interest in pursuing this?

Absolutely.  The implementor, David Harris, is out on leave
for the next few weeks.  I believe the analogous code is in
polgen/src/patterns/{extract_ifs,refpol}.py.  We don't do everything
Sepolgen does, but we do generate new types.  I'd love to see these
capabilities merged.

-Brian

-- 
Brian T. Sniffen                                      bsniffen@mitre.org
The MITRE Corporation                                       781-271-2904

[-- Attachment #2: smime.p7s --]
[-- Type: application/x-pkcs7-signature, Size: 1381 bytes --]

Re: MITRE releases Polgen 1.4

[Karl MacMillan]

Brian T. Sniffen wrote:
> Karl MacMillan <kmacmillan@mentalrootkit.com> writes:
> 
>> Brian T. Sniffen wrote:
>>> Polgen handles the modularity of reference policy by searching through
>>> .if files to find interfaces that will handle access requirements of
>>> the program under analysis.  The technique used appears complementary
>>> to Karl MacMillan's Madison library.
>> Can you point me to the implementation inside of polgen? It would seem
>> to be nice to merge this functionality into a single upstream
>> implementation. Do you have any interest in pursuing this?
> 
> Absolutely.  The implementor, David Harris, is out on leave
> for the next few weeks.  I believe the analogous code is in
> polgen/src/patterns/{extract_ifs,refpol}.py.  We don't do everything
> Sepolgen does, but we do generate new types.  I'd love to see these
> capabilities merged.
> 

The easiest short term solution may be for you to use the generated 
information about interface vectors from sepolgen-ifgen. That is 
currently stored in /usr/share/sepolgen/interface_info, but will be 
moving to /var to support read-only /usr.

That file has information about each interface in the form of:

[InterfaceVector files_read_etc_files $1:source ]
$1,etc_t,lnk_file,read,getattr
$1,etc_t,file,read,lock,getattr,ioctl
$1,etc_t,dir,getattr,search,read,lock,ioctl

So a header - keyword, name, parameters (including whether it is used as 
a source, target, object class, or perm). The access vectors in the form 
of source_type,target_type,object_class,perms. You could feed this 
information straight into your current interface selection algorithm.

Alternatively, you can also use the interface selection algorithm. It 
already works pretty well (including using information flow information 
to select interfaces closer to the requested access). I'd welcome help 
making this better.

Karl

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.