Making OPIE/QTOPIA aware of SELinux

Making OPIE/QTOPIA aware of SELinux

[CNGUYEN]

Any thoughts on how to make the GUI environment (OPIE or QTOPIA) aware of
SELinux so that "bypassing" SELinux is prevented?

Chieu Nguyen
Mykotronx

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov
with
the words "unsubscribe selinux" without quotes as the message.


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: Making OPIE/QTOPIA aware of SELinux

[Russell Coker]

On Thu, 20 Feb 2003 17:42, CNGUYEN wrote:
> Any thoughts on how to make the GUI environment (OPIE or QTOPIA) aware of
> SELinux so that "bypassing" SELinux is prevented?

What exactly do you mean by "bypassing SE Linux" and in what ways do you think 
it should be made aware of SE Linux?

I'm working on Familiar right now but my work is just starting...

-- 
http://www.coker.com.au/selinux/   My NSA Security Enhanced Linux packages
http://www.coker.com.au/bonnie++/  Bonnie++ hard drive benchmark
http://www.coker.com.au/postal/    Postal SMTP/POP benchmark
http://www.coker.com.au/~russell/  My home page


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

RE: Making OPIE/QTOPIA aware of SELinux

[CNGUYEN]

Applications <----
----              |
OPIE/QTOPIA  <---------|
---                    |
SELinux                |
---                    | 
Device Drivers <-------|

-----Original Message-----
From: Russell Coker [mailto:russell@coker.com.au]
Sent: Thursday, February 20, 2003 11:36 AM
To: CNGUYEN; 'Stephen D. Smalley'; 'selinux@tycho.nsa.gov'
Subject: Re: Making OPIE/QTOPIA aware of SELinux


On Thu, 20 Feb 2003 17:42, CNGUYEN wrote:
> Any thoughts on how to make the GUI environment (OPIE or QTOPIA) aware of
> SELinux so that "bypassing" SELinux is prevented?

What exactly do you mean by "bypassing SE Linux" and in what ways do you
think 
it should be made aware of SE Linux?

I'm working on Familiar right now but my work is just starting...

-- 
http://www.coker.com.au/selinux/   My NSA Security Enhanced Linux packages
http://www.coker.com.au/bonnie++/  Bonnie++ hard drive benchmark
http://www.coker.com.au/postal/    Postal SMTP/POP benchmark
http://www.coker.com.au/~russell/  My home page

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: Making OPIE/QTOPIA aware of SELinux

[Tom]

On Thu, Feb 20, 2003 at 11:42:56AM -0800, CNGUYEN wrote:
> Applications <----
> ----              |
> OPIE/QTOPIA  <---------|
> ---                    |
> SELinux                |
> ---                    | 
> Device Drivers <-------|

There's no danger of this as SELinux works at the kernel level.

However, I can imagine that the qtopia software is so much "integrated"
that it won't work with any reasonably secure policy.

-- 
http://web.lemuria.org/pubkey.html
pub  1024D/2D7A04F5 2002-05-16 Tom Vogt <tom@lemuria.org>
     Key fingerprint = C731 64D1 4BCF 4C20 48A4  29B2 BF01 9FA1 2D7A 04F5

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: Making OPIE/QTOPIA aware of SELinux

[Lamont R. Peterson]

On Thursday 20 February 2003 12:42 pm, CNGUYEN wrote:
> Applications <----
> ----              |
> OPIE/QTOPIA  <---------|
> ---                    |
> SELinux                |
> ---                    |
> Device Drivers <-------|

If I understand the architecture of the kernel (and particularly, how SELinux 
affects the kernel) then I would have to say that your diagram is incorrect.  
SELinux does not sit on top of the kernel; it "IS" the kernel.

Qtopia (I don't know OPIE) does not bypass the kernel in order to talk to 
devices directly.  There is nothing (other than compiling SELinux into your 
"embedded" kernel) that needs be done for Qtopia to run securely.

However, if I were to do this, I would write some Qtopia apps to wrap around 
SELinux specific tools such as spasswd, and would explore the "login" 
facility that Qtopia Desktop uses to communicate with Qtopia devices.
-- 
Sincerely,
Lamont R. Peterson <lrp@xmission.com>

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

RE: Making OPIE/QTOPIA aware of SELinux

[CNGUYEN]

Thank you for your advices, we will take these into consideration as we
investigate further into the QTOPIA/OPIE SDKs.

-----Original Message-----
From: Lamont R. Peterson [mailto:lrp@xmission.com]
Sent: Friday, February 21, 2003 6:58 AM
To: CNGUYEN; 'Russell Coker'; 'Stephen D. Smalley';
'selinux@tycho.nsa.gov'
Subject: Re: Making OPIE/QTOPIA aware of SELinux


On Thursday 20 February 2003 12:42 pm, CNGUYEN wrote:
> Applications <----
> ----              |
> OPIE/QTOPIA  <---------|
> ---                    |
> SELinux                |
> ---                    |
> Device Drivers <-------|

If I understand the architecture of the kernel (and particularly, how
SELinux 
affects the kernel) then I would have to say that your diagram is incorrect.

SELinux does not sit on top of the kernel; it "IS" the kernel.

Qtopia (I don't know OPIE) does not bypass the kernel in order to talk to 
devices directly.  There is nothing (other than compiling SELinux into your 
"embedded" kernel) that needs be done for Qtopia to run securely.

However, if I were to do this, I would write some Qtopia apps to wrap around

SELinux specific tools such as spasswd, and would explore the "login" 
facility that Qtopia Desktop uses to communicate with Qtopia devices.
-- 
Sincerely,
Lamont R. Peterson <lrp@xmission.com>

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: Making OPIE/QTOPIA aware of SELinux

[Russell Coker]

On Fri, 21 Feb 2003 15:57, Lamont R. Peterson wrote:
> If I understand the architecture of the kernel (and particularly, how
> SELinux affects the kernel) then I would have to say that your diagram is
> incorrect. SELinux does not sit on top of the kernel; it "IS" the kernel.

Yes, that is a good way to think of it.

SE Linux is part of the kernel, and apart from kernel bugs and programs with 
write access to /dev/kmem (IE an X server) there's no way to bypass SE Linux.

> Qtopia (I don't know OPIE) does not bypass the kernel in order to talk to
> devices directly.  There is nothing (other than compiling SELinux into your
> "embedded" kernel) that needs be done for Qtopia to run securely.
>
> However, if I were to do this, I would write some Qtopia apps to wrap
> around SELinux specific tools such as spasswd, and would explore the
> "login" facility that Qtopia Desktop uses to communicate with Qtopia
> devices.

One problem with embedded devices is that when you link multiple programs into 
one executable (like busybox does) then it's more difficult to arrange 
process domain transitions.

On a desktop or server system running SE Linux it's easy to have the 
administrator shell in the sysadm_t domain transition to the insmod_t domain 
to run "insmod" or "rmmod" as they are different programs.  When you have 
"insmod" and /bin/sh in the same binary with the same type it becomes more 
complex.

I am considering writing a privileged wrapper program which would run in 
sysadm_wrapper_t if run from sysadm_t or user_wrapper_t if run from user_t.  
Then it would look at a configuration file to map the name it was run as to a 
command and a security context.

EG If it was run as "insmod" then it might run "busybox insmod" as insmod_t.  
Of course the SE Linux policy would not permit a transition from 
user_wrapper_t to insmod_t...

-- 
http://www.coker.com.au/selinux/   My NSA Security Enhanced Linux packages
http://www.coker.com.au/bonnie++/  Bonnie++ hard drive benchmark
http://www.coker.com.au/postal/    Postal SMTP/POP benchmark
http://www.coker.com.au/~russell/  My home page


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.