Time estimate to create Debian enforceable policy

Time estimate to create Debian enforceable policy

[Roger Brunell]

Folk;
  I am looking for some SWAGs in [days|weeks|months]
for:
Given moderately smart person, w/:
      20 years UNIX experience.
      30 years programming exp.
       1.5 years with Linux/Debian
       4 weeks SELinux exp.
      appropiate resources (SELinux running on system)

To create, test and verify a meaningful, workable and enforceable
   policy for a <<elided>> (Mish-Mash of Debian parts)
   system.

   


Roger Brunell

Infosec Engineer (retired)
"Born 20 years too early"


		
__________________________________ 
Yahoo! Mail Mobile 
Take Yahoo! Mail with you! Check email on your mobile phone. 
http://mobile.yahoo.com/learn/mail 

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: Time estimate to create Debian enforceable policy

[Luke Kenneth Casson Leighton]

hi roger,

slightly confused by your message.  there have been a couple of people
who have debian / selinux working, from russell and dan's .deb packages.

i spent nearly 5 months on the project - a lot of that was spent
trying to get KDE 3.4 (from cvs!) to work, including running the
alpha-qualitied kvm, with its support for udev.

the basic work's already been done, in there.

i would be rather concerned about the lack of SELinux experience
of your moderately smart person.  SElinux is _not_ for the
faint-hearted, from a development perspective.

... what _kind_ of policy?

are you talking about a radical departure from "strict" or
"targetted"?

i would strongly advise against that.

l.

On Mon, May 23, 2005 at 06:26:11AM -0700, Roger Brunell wrote:
> Folk;
>   I am looking for some SWAGs in [days|weeks|months]
> for:
> Given moderately smart person, w/:
>       20 years UNIX experience.
>       30 years programming exp.
>        1.5 years with Linux/Debian
>        4 weeks SELinux exp.
>       appropiate resources (SELinux running on system)
> 
> To create, test and verify a meaningful, workable and enforceable
>    policy for a <<elided>> (Mish-Mash of Debian parts)
>    system.
> 
>    
> 
> 
> Roger Brunell
> 
> Infosec Engineer (retired)
> "Born 20 years too early"
> 
> 
> 		
> __________________________________ 
> Yahoo! Mail Mobile 
> Take Yahoo! Mail with you! Check email on your mobile phone. 
> http://mobile.yahoo.com/learn/mail 
> 
> --
> This message was distributed to subscribers of the selinux mailing list.
> If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
> the words "unsubscribe selinux" without quotes as the message.

-- 
--
<a href="http://lkcl.net">http://lkcl.net</a>
--

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: Time estimate to create Debian enforceable policy

[Valdis.Kletnieks]

[-- Attachment #1: Type: text/plain, Size: 1472 bytes --]

On Mon, 23 May 2005 06:26:11 PDT, Roger Brunell said:
> Folk;
>   I am looking for some SWAGs in [days|weeks|months]
> for:
> Given moderately smart person, w/:
...
>       appropiate resources (SELinux running on system)
> 
> To create, test and verify a meaningful, workable and enforceable
>    policy for a <<elided>> (Mish-Mash of Debian parts)
>    system.

You *have* omitted "step 0" - creating a "meaningful" policy requires that
you have some *goals* of what the policy does and does not even attempt to
address (the difference of 'strict' and 'targeted' policies are an
indication of how much the goals impact the end product - similar issues will
arise for things like "should XYZ have a boolean or not?").

Assuming that you can use 'strict' or 'targeted' as a rough baseline, the
biggest time consumer there will be "getting a Debian system with SELinux
running".  Once you actually *get* all the pieces (the policy, the policy
utils, the hooks for 'init' to load it at boot, setools so you can create
labelled users, and so on), you're probably looking at "several long afternoons
fixing the file_contexts for things Debian installs in places different from
Fedora", and probably a day for each package that needs SELinux support that
doesn't already (although a few, such as "stuff run from httpd", are a bigger
challenge).

(No, I don't know what state the Debian support is currently - I'm merely providing
feedback on the specifications themselves....)

[-- Attachment #2: Type: application/pgp-signature, Size: 226 bytes --]

Re: Time estimate to create Debian enforceable policy

[Roger Brunell]

--- Valdis.Kletnieks@vt.edu wrote:

> On Mon, 23 May 2005 06:26:11 PDT, Roger Brunell said:
> > Folk;
> >   I am looking for some SWAGs in [days|weeks|months]
> > for:
> > Given moderately smart person, w/:
> ...
> >       appropiate resources (SELinux running on system)
> > 
> > To create, test and verify a meaningful, workable and enforceable
> >    policy for a <<elided>> (Mish-Mash of Debian parts)
> >    system.
> 
> You *have* omitted "step 0" - creating a "meaningful" policy requires that
> you have some *goals* of what the policy does and does not even attempt to
> address (the difference of 'strict' and 'targeted' policies are an
> indication of how much the goals impact the end product - similar issues will
> arise for things like "should XYZ have a boolean or not?").

  Actually I do have an objective.
     But before I can try that I have to modify the policy so that
   the machine will work as a general purpose machine. Old school, have to
   start with the basics. "A fool with a tool is still a fool".

  After I understand all the mechanics and interactions, then what I want
  is:

   the policy we need has just two requirements.
     1. Only ifconfig writes to any network interface.
     2. No one writes to any hard drive.

   anything else if fine. DOS is not a concern.


> 
> Assuming that you can use 'strict' or 'targeted' as a rough baseline, the
> biggest time consumer there will be "getting a Debian system with SELinux
> running".  Once you actually *get* all the pieces (the policy, the policy
> utils, the hooks for 'init' to load it at boot, setools so you can create
> labelled users, and so on), 

    that part is done, to the extent that I am able to test it. sestatus
    gives expected results; apol and seaudit don't complain, ...

    After installing that, I still have 150 unique avc messages during the
    boot process alone. These are the things that need to be cleaned up.
    I did build the initrd with labeled files, so the audit messages are
    other actions that are not accounted for in the policy.



> you're probably looking at "several long
> afternoons
> fixing the file_contexts for things Debian installs in places different from
> Fedora", and probably a day for each package that needs SELinux support that
> doesn't already (although a few, such as "stuff run from httpd", are a bigger
> challenge).



> 
> (No, I don't know what state the Debian support is currently - I'm merely
> providing
> feedback on the specifications themselves....)
> 


Roger Brunell

Infosec Engineer (retired)
"Born 20 years too early"


		
__________________________________ 
Do you Yahoo!? 
Yahoo! Mail - Find what you need with new enhanced search. 
http://info.mail.yahoo.com/mail_250

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.