[RFC] selinux-support (1.0.1) available

[RFC] selinux-support (1.0.1) available

[Lorenzo Hernández García-Hierro]

[-- Attachment #1: Type: text/plain, Size: 1270 bytes --]

Hi,

I'm glad to announce the public availability of the selinux-support
(meta-)package which accomplishes the goal of installing the user-land
tools for Security-Enhanced Linux support and few configuration-related
files that will be used in a near future during the deployment of
SELinux within Ubuntu Linux.

The packages depending on selinux-support (which are subsequently
installed when installing it) are:

	* selinux-doc
	* slat
	* selinux-utils
	* libselinux1
	* libselinux1-dev
	* policycoreutils
	* libsepol1
	* checkpolicy
	* selinux-policy-default

It also provides the Python bindings for libselinux, coming from the
Hardened Gentoo project and available in the Gentoo CVS:
http://www.gentoo.org/cgi-bin/viewcvs.cgi/dev-python/python-selinux

It's available (as apt'able package) at the repository 
http://pearls.tuxedo-es.org/selinux/debian
and more concretely in
http://pearls.tuxedo-es.org/selinux/debian/selinux-support/

Please, send back comments, suggestions, critics, etc.

I would like to thank Andrew Mitchell because of his help and comments
during it's short) development :)

Thanks, cheers.
-- 
Lorenzo Hernández García-Hierro <lorenzo@gnu.org> 
[1024D/6F2B2DEC] & [2048g/9AE91A22][http://tuxedo-es.org]

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

Re: [RFC] selinux-support (1.0.1) available

[Stephen Smalley]

On Thu, 2005-03-24 at 23:47 +0100, Lorenzo Hernández García-Hierro
wrote:
> I'm glad to announce the public availability of the selinux-support
> (meta-)package which accomplishes the goal of installing the user-land
> tools for Security-Enhanced Linux support and few configuration-related
> files that will be used in a near future during the deployment of
> SELinux within Ubuntu Linux.
> 
> The packages depending on selinux-support (which are subsequently
> installed when installing it) are:
> 
> 	* selinux-doc
> 	* slat
> 	* selinux-utils
> 	* libselinux1
> 	* libselinux1-dev
> 	* policycoreutils
> 	* libsepol1
> 	* checkpolicy
> 	* selinux-policy-default
> 
> It also provides the Python bindings for libselinux, coming from the
> Hardened Gentoo project and available in the Gentoo CVS:
> http://www.gentoo.org/cgi-bin/viewcvs.cgi/dev-python/python-selinux

Can you explain the purpose of this package?  I'm not sure I understand
what you mean, or why the above packages would depend on it.  What is
the purpose of the /etc/selinux.conf file in this package, and how does
it compare to the already existing /etc/selinux/config file that is
being used by libselinux and various scripts?  Do you expect this to
remain Ubuntu-specific?

-- 
Stephen Smalley <sds@tycho.nsa.gov>
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: [RFC] selinux-support (1.0.1) available

[Stephen Smalley]

On Fri, 2005-03-25 at 09:08 -0500, Stephen Smalley wrote:
> Can you explain the purpose of this package?  I'm not sure I understand
> what you mean, or why the above packages would depend on it.  What is
> the purpose of the /etc/selinux.conf file in this package, and how does
> it compare to the already existing /etc/selinux/config file that is
> being used by libselinux and various scripts?  Do you expect this to
> remain Ubuntu-specific?

Another question is how are you handling the SELinux-patched userspace
in Ubuntu?  Integrated into the main packages as in Fedora or a separate
set of packages like Russell Coker's current packages for Debian?  The
former is obviously preferable if possible.

Note that you should check the latest SELinux userspace patches from the
Fedora CVS tree, as they have continued to evolve.  Note that there are
now two separate SELinux-related patches for sysvinit in the Fedora CVS
tree, sysvinit-selinux.patch and sysvinit-2.85-selgenusers.patch, where
the latter patch was a more recent change to support pulling in
local.users at policy load time without requiring a policy rebuild.
Also note that in some cases, SELinux support has gone into the main
sources in the Fedora packages and is no longer a separate patch at all
(or if a patch exists, it is a refinement of the original SELinux
support rather than the complete SELinux support), e.g. for libuser,
logrotate, passwd, prelink, etc.

-- 
Stephen Smalley <sds@tycho.nsa.gov>
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: [RFC] selinux-support (1.0.1) available

[Lorenzo Hernández García-Hierro]

[-- Attachment #1: Type: text/plain, Size: 2475 bytes --]

El vie, 25-03-2005 a las 09:27 -0500, Stephen Smalley escribió:
> On Fri, 2005-03-25 at 09:08 -0500, Stephen Smalley wrote:
> > Can you explain the purpose of this package?  I'm not sure I understand
> > what you mean, or why the above packages would depend on it.  What is
> > the purpose of the /etc/selinux.conf file in this package, and how does
> > it compare to the already existing /etc/selinux/config file that is
> > being used by libselinux and various scripts?  Do you expect this to
> > remain Ubuntu-specific?
> 
> Another question is how are you handling the SELinux-patched userspace
> in Ubuntu?  Integrated into the main packages as in Fedora or a separate
> set of packages like Russell Coker's current packages for Debian?  The
> former is obviously preferable if possible.

Integrated, I'm right now working with some packages, just finished
logrotate, now working on sysvinit, openssh and PAM.

Each modified package should depend on the proper libraries: ie.
libselinux1 and libselinux1-dev

I'm putting them on http://pearls.tuxedo-es.org/selinux/ubuntu/ among
updated packages of libselinux1 and others.

> Note that you should check the latest SELinux userspace patches from the
> Fedora CVS tree, as they have continued to evolve.  Note that there are
> now two separate SELinux-related patches for sysvinit in the Fedora CVS
> tree, sysvinit-selinux.patch and sysvinit-2.85-selgenusers.patch, where
> the latter patch was a more recent change to support pulling in
> local.users at policy load time without requiring a policy rebuild.

Right, the patches imported from the Fedora CVS being used are hosted
on:
http://pearls.tuxedo-es.org/selinux/userland-patches/

Sysvinit will need more work to get also other interesting patches, I'm
working on it.

> Also note that in some cases, SELinux support has gone into the main
> sources in the Fedora packages and is no longer a separate patch at all
> (or if a patch exists, it is a refinement of the original SELinux
> support rather than the complete SELinux support), e.g. for libuser,
> logrotate, passwd, prelink, etc.

Right, in this case, I would like to know if there's someone from Red
Hat interested in getting in touch with the sources, thus providing
separate patches, or we won't be able to handle this correctly.

Cheers,
-- 
Lorenzo Hernández García-Hierro <lorenzo@gnu.org> 
[1024D/6F2B2DEC] & [2048g/9AE91A22][http://tuxedo-es.org]

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

Re: [RFC] selinux-support (1.0.1) available

[Colin Walters]

[-- Attachment #1: Type: text/plain, Size: 963 bytes --]

On Fri, 2005-03-25 at 19:05 +0100, Lorenzo Hernández García-Hierro
wrote:

> Right, the patches imported from the Fedora CVS being used are hosted
> on:
> http://pearls.tuxedo-es.org/selinux/userland-patches/

Hmm.  It seems a bit more maintainable to have e.g. a web page with
hyperlinks to the viewcvs repository, at least where the patches don't
require modification.

> Right, in this case, I would like to know if there's someone from Red
> Hat interested in getting in touch with the sources, thus providing
> separate patches, or we won't be able to handle this correctly.

This is more a question for Dan, but - what exactly would this mean?  A
web page on Dan's people.redhat.com page which acts as a "canonical"
list of patches?

Ideally, all of these patches go upstream of course, at least where
there is an upstream.  If Debian/Ubuntu adopt them in addition to Fedora
and Gentoo, making the case to upstream will be easier.


[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

Re: [RFC] selinux-support (1.0.1) available

[Lorenzo Hernández García-Hierro]

[-- Attachment #1: Type: text/plain, Size: 1488 bytes --]

El vie, 25-03-2005 a las 09:08 -0500, Stephen Smalley escribió:
> Can you explain the purpose of this package?  I'm not sure I understand
> what you mean, or why the above packages would depend on it.  What is
> the purpose of the /etc/selinux.conf file in this package, and how does
> it compare to the already existing /etc/selinux/config file that is
> being used by libselinux and various scripts?  Do you expect this to
> remain Ubuntu-specific?
> 

The purpose is to provide a meta-package such as the harden &
harden-environment ones, that installs all the user-land tools packages
for supporting SELinux, among other interesting packages or needed
stuff.

/etc/selinux.conf is to be used by front-end utilities, configuration
tools and other stuff.
We are now thinking in a "Security Center"-like [1] solution for Ubuntu,
so, it also makes sense for such thing.

In my opinion, it's going to be Ubuntu specific until it's back-accepted
in Debian, anyways, I expect to have, at least, the user-land ready for
SELinux support within the Ubuntu Linux distribution, for the Hoary+1
release (Breezy).

[1]:
http://lists.ubuntu.com/archives/ubuntu-hardened/2005-March/000003.html

Cheers,
PS: I'm CC'ing to ubuntu-hardened to keep the thread, just if someone
needs to know or ask about the same information and ends up on
ubuntu-hardened.
-- 
Lorenzo Hernández García-Hierro <lorenzo@gnu.org> 
[1024D/6F2B2DEC] & [2048g/9AE91A22][http://tuxedo-es.org]

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

Re: [RFC] selinux-support (1.0.1) available

[Colin Walters]

[-- Attachment #1: Type: text/plain, Size: 2217 bytes --]

On Fri, 2005-03-25 at 15:41 +0100, Lorenzo Hernández García-Hierro
wrote:

> In my opinion, it's going to be Ubuntu specific until it's back-accepted
> in Debian, anyways, I expect to have, at least, the user-land ready for
> SELinux support within the Ubuntu Linux distribution, for the Hoary+1
> release (Breezy).

That's probably reasonable.  If Ubuntu can get SELinux working well on a
Debian-derived system out of the box, it will probably be easier for
Debian to then pull all of the current patches into their distribution.

Nevertheless, I encourage you to work with Debian on this as much as
possible.  SELinux, like any access control system worth something,
requires extensive integration with the rest of the OS.  And core parts
of the OS at that.  You do not want to be deviating much from the Debian
core for packages such as dpkg and coreutils in the long term.  

Also, I strongly suggest that you look at the "targeted" policy shipping
with Fedora.  I had a glance at the Ubuntu wiki page for SELinux and it
seems the proposed policy is "selinux-policy-default", which IIRC is the
"strict" policy.  The experience with Fedora is that strict is not yet
workable as the default for a general-purpose OS, as Ubuntu is.  If you
can get the targeted policy as the Ubuntu default and most importantly
*on* by default, then "Hardened Ubuntu" becomes just s/targeted/strict/,
and perhaps a few other features.  Much less work for the "Hardened"
team.  Getting as many features of "Hardened" into the core should be
your goal anyways; I think that permanently-forked "Hardened" variants
are basically wrong.  They're kind of inherently doomed to be only used
by a very small subset of users.  You want it to be more of a proving
ground or staging area than a fork.

We're doing a lot of work in Fedora to make targeted work well, and I
think we could work together on it to good effect.

I haven't really done any Debian development in a year, but I think I
still remember much of how things work, so I'd be happy to help with any
integration issues you might have.  I'm sure the same is true of
Russell.  Posting to selinux@tycho.nsa.gov is probably your best bet.


[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

Re: [RFC] selinux-support (1.0.1) available

[Luke Kenneth Casson Leighton]

On Fri, Mar 25, 2005 at 10:31:32AM -0500, Colin Walters wrote:

> I haven't really done any Debian development in a year, but I think I
> still remember much of how things work, so I'd be happy to help with any
> integration issues you might have.  I'm sure the same is true of
> Russell.  Posting to selinux@tycho.nsa.gov is probably your best bet.
 
 about six/eight months ago, i worked for about four months on
 getting debian to work with selinux (strict).

 including getting udev to work (with tmpfs).

 so, likewise, i'd be happy to help.

 many of the patches are delayed until sarge is released, at which point
 libselinux1 can be made "Required" rather than "Optional".

 at _that_ point, the patch floodgates open, and patches to coreutils
 etc. can be put forward.

 l.


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: [RFC] selinux-support (1.0.1) available

[Lorenzo Hernández García-Hierro]

[-- Attachment #1: Type: text/plain, Size: 1452 bytes --]

El vie, 25-03-2005 a las 17:59 +0000, Luke Kenneth Casson Leighton
escribió:
> On Fri, Mar 25, 2005 at 10:31:32AM -0500, Colin Walters wrote:
> 
> > I haven't really done any Debian development in a year, but I think I
> > still remember much of how things work, so I'd be happy to help with any
> > integration issues you might have.  I'm sure the same is true of
> > Russell.  Posting to selinux@tycho.nsa.gov is probably your best bet.
>  
>  about six/eight months ago, i worked for about four months on
>  getting debian to work with selinux (strict).
> 
>  including getting udev to work (with tmpfs).
> 
>  so, likewise, i'd be happy to help.

Great, there's a page on the wiki that might be a start point:
http://www.ubuntulinux.org/wiki/SELinux
just write your name there if you want to (formerly) contribute.

By now, the "TODO" is there.

>  many of the patches are delayed until sarge is released, at which point
>  libselinux1 can be made "Required" rather than "Optional".

Right, Ubuntu Breezy (Hoary+1) is our target, and sure that we can have
many work done for it.

Then such work could get back into Debian, as in many other fields of
the project.

>  at _that_ point, the patch floodgates open, and patches to coreutils
>  etc. can be put forward.

I hope so ;)

Thanks, cheers.
-- 
Lorenzo Hernández García-Hierro <lorenzo@gnu.org> 
[1024D/6F2B2DEC] & [2048g/9AE91A22][http://tuxedo-es.org]

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

Re: [RFC] selinux-support (1.0.1) available

[Lorenzo Hernández García-Hierro]

[-- Attachment #1: Type: text/plain, Size: 3499 bytes --]

El vie, 25-03-2005 a las 10:31 -0500, Colin Walters escribió:
> On Fri, 2005-03-25 at 15:41 +0100, Lorenzo Hernández García-Hierro
> wrote:
> 
> > In my opinion, it's going to be Ubuntu specific until it's back-accepted
> > in Debian, anyways, I expect to have, at least, the user-land ready for
> > SELinux support within the Ubuntu Linux distribution, for the Hoary+1
> > release (Breezy).
> 
> That's probably reasonable.  If Ubuntu can get SELinux working well on a
> Debian-derived system out of the box, it will probably be easier for
> Debian to then pull all of the current patches into their distribution.
> 
> Nevertheless, I encourage you to work with Debian on this as much as
> possible.  SELinux, like any access control system worth something,
> requires extensive integration with the rest of the OS.  And core parts
> of the OS at that.  You do not want to be deviating much from the Debian
> core for packages such as dpkg and coreutils in the long term.  

I agree, the changes are not that difficult to give back for Debian,
Ubuntu is also not that different when talking about core stuff.

In short, I keep in mind both Debian and Ubuntu, just that Manoj is
doing a great job within Debian.

> Also, I strongly suggest that you look at the "targeted" policy shipping
> with Fedora.  I had a glance at the Ubuntu wiki page for SELinux and it
> seems the proposed policy is "selinux-policy-default", which IIRC is the
> "strict" policy.  The experience with Fedora is that strict is not yet
> workable as the default for a general-purpose OS, as Ubuntu is.  If you
> can get the targeted policy as the Ubuntu default and most importantly
> *on* by default, then "Hardened Ubuntu" becomes just s/targeted/strict/,
> and perhaps a few other features.  Much less work for the "Hardened"
> team.  Getting as many features of "Hardened" into the core should be
> your goal anyways; I think that permanently-forked "Hardened" variants
> are basically wrong.  They're kind of inherently doomed to be only used
> by a very small subset of users.  You want it to be more of a proving
> ground or staging area than a fork.

Right, I agree.

I'm still getting in touch with the policy language and so on, no real
work done, but I think I will be able to work on it without difficulties
soon.

The current "selinux-policy-default" package needs to be *re-worked*,
the configuration method is a mess, painful and not easy at all, even
for maintenance.

I would like to know the opinion on separate policy packages.

> We're doing a lot of work in Fedora to make targeted work well, and I
> think we could work together on it to good effect.

Sure, I will take a look at it.

> I haven't really done any Debian development in a year, but I think I
> still remember much of how things work, so I'd be happy to help with any
> integration issues you might have.  I'm sure the same is true of
> Russell.  Posting to selinux@tycho.nsa.gov is probably your best bet.

Right, I will CC related messages to both ubuntu-hardened and selinux
lists.

There's no formal recruitment, but if it's not all clear, everybody can
feel free to contribute and help with the work.

We are just 2 guys working on this, and I've been doing most of the
work, so, we would really appreciate help.

Thanks for the comments, cheers.
-- 
Lorenzo Hernández García-Hierro <lorenzo@gnu.org> 
[1024D/6F2B2DEC] & [2048g/9AE91A22][http://tuxedo-es.org]

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 189 bytes --]