[refpolicy] Interfaces in refpolicy.

[refpolicy] Interfaces in refpolicy.

[Daniel J Walsh]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

We were have a side talk between Miroslav, Dominick and me about interfaces.

Dominick has merged lots of new policy from Fedora in to the contrib directory
of refpolicy but he has been only including the interfaces that are actually
used.  This has been the traditional way Chris has accepted interfaces into
the upstream project.  (Other then _admin and _domtrans).  This is causing
Miroslav problems merging in the lastest upstream back into Fedora, since
Fedora has many interfaces defined that other domains are not currently using.

I believe that we should have a standard that each file type defined in a policy.

For example

getattr_dir
read_dir
getattr_file
read_file
rw_inherited_file
manage_file

The current mechanism where we don't have a comprehensive list can cause two
problems for policy writers.

First it makes the chance of users/policy writers adding gen_require blocks
greatly increase

gen_require(`
     type foobar_t;
')

which breaks the separation model that interfaces were built to fix.

Secondly audit2allow -R will return a looser policy.  For example if your
domain needs to read foobar_var_lib_t, but only foobar_manage_var_lib_t exists,
audit2allow -R will return foobar_manage_var_lib(mydomain_t) and users are
likely to grab it.

sepolicy generate (sepolgen) Always generates a group of interfaces for each
type, and I believe we should add all these interfaces to upstream whether or
not other domains currently use the interface.  If we define a standard group
of interfaces required for each type, then we could go through the policy and
add all the interfaces and make tools that help in generation of policy always
create the correct interface.


-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.13 (GNU/Linux)
Comment: Using GnuPG with undefined - http://www.enigmail.net/

iEYEARECAAYFAlDq39oACgkQrlYvE4MpobNjwQCeLUBlFyjjFOBL1VYk2nfRnXS5
qh8An2qljCyKYIMxzMO02V8QGa+skpE6
=saxm
-----END PGP SIGNATURE-----

[refpolicy] Interfaces in refpolicy.

[Christopher J. PeBenito]

On 01/07/13 09:46, Daniel J Walsh wrote:
> We were have a side talk between Miroslav, Dominick and me about interfaces.
> 
> Dominick has merged lots of new policy from Fedora in to the contrib directory
> of refpolicy but he has been only including the interfaces that are actually
> used.  This has been the traditional way Chris has accepted interfaces into
> the upstream project.  (Other then _admin and _domtrans).  This is causing
> Miroslav problems merging in the lastest upstream back into Fedora, since
> Fedora has many interfaces defined that other domains are not currently using.
> 
> I believe that we should have a standard that each file type defined in a policy.
> 
> For example
> 
> getattr_dir
> read_dir
> getattr_file
> read_file
> rw_inherited_file
> manage_file

I thought that we had agreed that doing this was generally acceptable years ago?  That being said, I don't think these make sense for /all/ file types.  e.g. there should be no user_home_dir_t files.  Similarly, a different set would apply for device nodes.

> The current mechanism where we don't have a comprehensive list can cause two
> problems for policy writers.

If you want a pretty comprehensive list, the policy pattern macros would be a good place to start creating one, IMO.  We don't have to make corresponding interfaces of all of those, but they do have the correct access concepts and verbs to use in the interface names.

-- 
Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com

[refpolicy] Interfaces in refpolicy.

[Dominick Grift]

On Mon, 2013-01-07 at 10:09 -0500, Christopher J. PeBenito wrote:
> On 01/07/13 09:46, Daniel J Walsh wrote:
> > We were have a side talk between Miroslav, Dominick and me about interfaces.
> > 
> > Dominick has merged lots of new policy from Fedora in to the contrib directory
> > of refpolicy but he has been only including the interfaces that are actually
> > used.  This has been the traditional way Chris has accepted interfaces into
> > the upstream project.  (Other then _admin and _domtrans).  This is causing
> > Miroslav problems merging in the lastest upstream back into Fedora, since
> > Fedora has many interfaces defined that other domains are not currently using.
> > 
> > I believe that we should have a standard that each file type defined in a policy.
> > 
> > For example
> > 
> > getattr_dir
> > read_dir
> > getattr_file
> > read_file
> > rw_inherited_file
> > manage_file
> 
> I thought that we had agreed that doing this was generally acceptable years ago?  That being said, I don't think these make sense for /all/ file types.  e.g. there should be no user_home_dir_t files.  Similarly, a different set would apply for device nodes.
> 
> > The current mechanism where we don't have a comprehensive list can cause two
> > problems for policy writers.
> 
> If you want a pretty comprehensive list, the policy pattern macros would be a good place to start creating one, IMO.  We don't have to make corresponding interfaces of all of those, but they do have the correct access concepts and verbs to use in the interface names.
> 

ok i saved this e-mail in my documentation folder for reference and will
apply what is discussed from now on

[refpolicy] Interfaces in refpolicy.

[Daniel J Walsh]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 01/07/2013 11:25 AM, Dominick Grift wrote:
> On Mon, 2013-01-07 at 10:09 -0500, Christopher J. PeBenito wrote:
>> On 01/07/13 09:46, Daniel J Walsh wrote:
>>> We were have a side talk between Miroslav, Dominick and me about
>>> interfaces.
>>> 
>>> Dominick has merged lots of new policy from Fedora in to the contrib
>>> directory of refpolicy but he has been only including the interfaces
>>> that are actually used.  This has been the traditional way Chris has
>>> accepted interfaces into the upstream project.  (Other then _admin and
>>> _domtrans).  This is causing Miroslav problems merging in the lastest
>>> upstream back into Fedora, since Fedora has many interfaces defined
>>> that other domains are not currently using.
>>> 
>>> I believe that we should have a standard that each file type defined in
>>> a policy.
>>> 
>>> For example
>>> 
>>> getattr_dir read_dir getattr_file read_file rw_inherited_file 
>>> manage_file
>> 
>> I thought that we had agreed that doing this was generally acceptable
>> years ago?  That being said, I don't think these make sense for /all/
>> file types.  e.g. there should be no user_home_dir_t files.  Similarly, a
>> different set would apply for device nodes.
>> 
>>> The current mechanism where we don't have a comprehensive list can
>>> cause two problems for policy writers.
>> 
>> If you want a pretty comprehensive list, the policy pattern macros would
>> be a good place to start creating one, IMO.  We don't have to make
>> corresponding interfaces of all of those, but they do have the correct
>> access concepts and verbs to use in the interface names.
>> 
> 
> ok i saved this e-mail in my documentation folder for reference and will 
> apply what is discussed from now on
> 

Great.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.13 (GNU/Linux)
Comment: Using GnuPG with undefined - http://www.enigmail.net/

iEYEARECAAYFAlDq+VQACgkQrlYvE4MpobPmhgCePOtH7lxZiiY3MFNXg1ybYuYk
nlMAoNtNBtqLXLePtPVivDWeUSWlc21I
=I6DT
-----END PGP SIGNATURE-----