* type inheritance in CIL @ 2015-06-29 7:29 Miroslav Grepl 2015-06-29 7:56 ` Dominick Grift 0 siblings, 1 reply; 8+ messages in thread From: Miroslav Grepl @ 2015-06-29 7:29 UTC (permalink / raw) To: SELinux Trying to make sandbox working using CIL but I see it does not support typeinherit statement. -- Miroslav Grepl Senior Software Engineer, SELinux Solutions Red Hat, Inc. ^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: type inheritance in CIL 2015-06-29 7:29 type inheritance in CIL Miroslav Grepl @ 2015-06-29 7:56 ` Dominick Grift 2015-06-29 11:19 ` Miroslav Grepl 0 siblings, 1 reply; 8+ messages in thread From: Dominick Grift @ 2015-06-29 7:56 UTC (permalink / raw) To: selinux [-- Attachment #1: Type: text/plain, Size: 1112 bytes --] On Mon, Jun 29, 2015 at 09:29:34AM +0200, Miroslav Grepl wrote: > Trying to make sandbox working using CIL but I see it does not support > typeinherit statement. One of those features that really define CIL but that is currently not available or fully working yet. My suggestion is to study the "cilpolicy" (which is really just a snapshot of reference policy transformed to cil with hll i believe) This will give you some pointers as to how to create an alternative implementation that achieves a similar result. When you write CIL policy, there are some "bugs" to take into account and to workaround. > > -- > Miroslav Grepl > Senior Software Engineer, SELinux Solutions > Red Hat, Inc. > _______________________________________________ > Selinux mailing list > Selinux@tycho.nsa.gov > To unsubscribe, send email to Selinux-leave@tycho.nsa.gov. > To get help, send an email containing "help" to Selinux-request@tycho.nsa.gov. -- 02DFF788 4D30 903A 1CF3 B756 FB48 1514 3148 83A2 02DF F788 http://keys.gnupg.net/pks/lookup?op=vindex&search=0x314883A202DFF788 Dominick Grift [-- Attachment #2: Type: application/pgp-signature, Size: 648 bytes --] ^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: type inheritance in CIL 2015-06-29 7:56 ` Dominick Grift @ 2015-06-29 11:19 ` Miroslav Grepl 2015-06-29 18:56 ` James Carter 0 siblings, 1 reply; 8+ messages in thread From: Miroslav Grepl @ 2015-06-29 11:19 UTC (permalink / raw) To: selinux On 06/29/2015 09:56 AM, Dominick Grift wrote: > On Mon, Jun 29, 2015 at 09:29:34AM +0200, Miroslav Grepl wrote: >> Trying to make sandbox working using CIL but I see it does not >> support typeinherit statement. > > One of those features that really define CIL but that is currently > not available or fully working yet. > > My suggestion is to study the "cilpolicy" (which is really just a > snapshot of reference policy transformed to cil with hll i > believe) > > This will give you some pointers as to how to create an alternative > implementation that achieves a similar result. > > When you write CIL policy, there are some "bugs" to take into > account and to workaround. > Sure there are different ways how to write it. I just wanted to combine it with the current Fedora policy as much as possible without re-writing the current Fedora policy. >> >> -- Miroslav Grepl Senior Software Engineer, SELinux Solutions Red >> Hat, Inc. _______________________________________________ Selinux >> mailing list Selinux@tycho.nsa.gov To unsubscribe, send email to >> Selinux-leave@tycho.nsa.gov. To get help, send an email >> containing "help" to Selinux-request@tycho.nsa.gov. > > > > _______________________________________________ Selinux mailing > list Selinux@tycho.nsa.gov To unsubscribe, send email to > Selinux-leave@tycho.nsa.gov. To get help, send an email containing > "help" to Selinux-request@tycho.nsa.gov. > -- Miroslav Grepl Senior Software Engineer, SELinux Solutions Red Hat, Inc. ^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: type inheritance in CIL 2015-06-29 11:19 ` Miroslav Grepl @ 2015-06-29 18:56 ` James Carter 2015-06-29 19:25 ` Dominick Grift 0 siblings, 1 reply; 8+ messages in thread From: James Carter @ 2015-06-29 18:56 UTC (permalink / raw) To: Miroslav Grepl, selinux On 06/29/2015 07:19 AM, Miroslav Grepl wrote: > On 06/29/2015 09:56 AM, Dominick Grift wrote: >> On Mon, Jun 29, 2015 at 09:29:34AM +0200, Miroslav Grepl wrote: >>> Trying to make sandbox working using CIL but I see it does not >>> support typeinherit statement. >> >> One of those features that really define CIL but that is currently >> not available or fully working yet. >> Inheritance in CIL is handled with blocks. The following policy: (block b1 (type t) (allow t self (CLASS (PERM))) ) (block b2 (blockinherit b1)) Would result in two types (b1.t and b2.t) and two rules. See block_test.cil and name_resolution_test.cil in secilc/test/ for more examples. Everything should work, but, of course, it has seen less testing at this point. Jim >> My suggestion is to study the "cilpolicy" (which is really just a >> snapshot of reference policy transformed to cil with hll i >> believe) >> >> This will give you some pointers as to how to create an alternative >> implementation that achieves a similar result. >> >> When you write CIL policy, there are some "bugs" to take into >> account and to workaround. >> > > Sure there are different ways how to write it. I just wanted to > combine it with the current Fedora policy as much as possible without > re-writing the current Fedora policy. > >>> >>> -- Miroslav Grepl Senior Software Engineer, SELinux Solutions Red >>> Hat, Inc. _______________________________________________ Selinux >>> mailing list Selinux@tycho.nsa.gov To unsubscribe, send email to >>> Selinux-leave@tycho.nsa.gov. To get help, send an email >>> containing "help" to Selinux-request@tycho.nsa.gov. >> >> >> >> _______________________________________________ Selinux mailing >> list Selinux@tycho.nsa.gov To unsubscribe, send email to >> Selinux-leave@tycho.nsa.gov. To get help, send an email containing >> "help" to Selinux-request@tycho.nsa.gov. >> > > -- James Carter <jwcart2@tycho.nsa.gov> National Security Agency ^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: type inheritance in CIL 2015-06-29 18:56 ` James Carter @ 2015-06-29 19:25 ` Dominick Grift 2015-06-29 20:22 ` James Carter 2015-06-30 8:37 ` Miroslav Grepl 0 siblings, 2 replies; 8+ messages in thread From: Dominick Grift @ 2015-06-29 19:25 UTC (permalink / raw) To: selinux [-- Attachment #1: Type: text/plain, Size: 2959 bytes --] On Mon, Jun 29, 2015 at 02:56:34PM -0400, James Carter wrote: > On 06/29/2015 07:19 AM, Miroslav Grepl wrote: > >On 06/29/2015 09:56 AM, Dominick Grift wrote: > >>On Mon, Jun 29, 2015 at 09:29:34AM +0200, Miroslav Grepl wrote: > >>>Trying to make sandbox working using CIL but I see it does not > >>>support typeinherit statement. > >> > >>One of those features that really define CIL but that is currently > >>not available or fully working yet. > >> > > Inheritance in CIL is handled with blocks. > > The following policy: > > (block b1 > (type t) > (allow t self (CLASS (PERM))) > ) > > (block b2 > (blockinherit b1)) > > Would result in two types (b1.t and b2.t) and two rules. > > See block_test.cil and name_resolution_test.cil in secilc/test/ for more > examples. Everything should work, but, of course, it has seen less testing > at this point. Thanks I am aware of that featurew, namespacing is also still a bit buggy in my view though. If this is meant to be a substitute for typeinherit then how is one supposed to implement something that behaves like typeinheritfilter? You are aware the typeinherit and typeinheritfilter are still documented on https://github.com/SELinuxProject/cil/wiki? > > Jim > > >>My suggestion is to study the "cilpolicy" (which is really just a > >>snapshot of reference policy transformed to cil with hll i > >>believe) > >> > >>This will give you some pointers as to how to create an alternative > >>implementation that achieves a similar result. > >> > >>When you write CIL policy, there are some "bugs" to take into > >>account and to workaround. > >> > > > >Sure there are different ways how to write it. I just wanted to > >combine it with the current Fedora policy as much as possible without > >re-writing the current Fedora policy. > > > >>> > >>>-- Miroslav Grepl Senior Software Engineer, SELinux Solutions Red > >>>Hat, Inc. _______________________________________________ Selinux > >>>mailing list Selinux@tycho.nsa.gov To unsubscribe, send email to > >>>Selinux-leave@tycho.nsa.gov. To get help, send an email > >>>containing "help" to Selinux-request@tycho.nsa.gov. > >> > >> > >> > >>_______________________________________________ Selinux mailing > >>list Selinux@tycho.nsa.gov To unsubscribe, send email to > >>Selinux-leave@tycho.nsa.gov. To get help, send an email containing > >>"help" to Selinux-request@tycho.nsa.gov. > >> > > > > > > > -- > James Carter <jwcart2@tycho.nsa.gov> > National Security Agency > _______________________________________________ > Selinux mailing list > Selinux@tycho.nsa.gov > To unsubscribe, send email to Selinux-leave@tycho.nsa.gov. > To get help, send an email containing "help" to Selinux-request@tycho.nsa.gov. -- 02DFF788 4D30 903A 1CF3 B756 FB48 1514 3148 83A2 02DF F788 http://keys.gnupg.net/pks/lookup?op=vindex&search=0x314883A202DFF788 Dominick Grift [-- Attachment #2: Type: application/pgp-signature, Size: 648 bytes --] ^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: type inheritance in CIL 2015-06-29 19:25 ` Dominick Grift @ 2015-06-29 20:22 ` James Carter 2015-06-30 8:37 ` Miroslav Grepl 1 sibling, 0 replies; 8+ messages in thread From: James Carter @ 2015-06-29 20:22 UTC (permalink / raw) To: selinux On 06/29/2015 03:25 PM, Dominick Grift wrote: > On Mon, Jun 29, 2015 at 02:56:34PM -0400, James Carter wrote: >> On 06/29/2015 07:19 AM, Miroslav Grepl wrote: >>> On 06/29/2015 09:56 AM, Dominick Grift wrote: >>>> On Mon, Jun 29, 2015 at 09:29:34AM +0200, Miroslav Grepl wrote: >>>>> Trying to make sandbox working using CIL but I see it does not >>>>> support typeinherit statement. >>>> >>>> One of those features that really define CIL but that is currently >>>> not available or fully working yet. >>>> >> >> Inheritance in CIL is handled with blocks. >> >> The following policy: >> >> (block b1 >> (type t) >> (allow t self (CLASS (PERM))) >> ) >> >> (block b2 >> (blockinherit b1)) >> >> Would result in two types (b1.t and b2.t) and two rules. >> >> See block_test.cil and name_resolution_test.cil in secilc/test/ for more >> examples. Everything should work, but, of course, it has seen less testing >> at this point. > > Thanks I am aware of that featurew, namespacing is also still a bit buggy in my view though. > > If this is meant to be a substitute for typeinherit then how is one supposed to implement something that behaves like typeinheritfilter? > > You are aware the typeinherit and typeinheritfilter are still documented on https://github.com/SELinuxProject/cil/wiki? Yes, although it has been a while since I looked at that. The blockinherit is a substitute for typeinherit. There is no replacement for typeinheritfilter yet. We would like to add a mechanism to remove rules at some point. But there are all sorts of potential ordering issues when you add something like that and we have been busy with other parts of CIL. Jim >> >> Jim >> >>>> My suggestion is to study the "cilpolicy" (which is really just a >>>> snapshot of reference policy transformed to cil with hll i >>>> believe) >>>> >>>> This will give you some pointers as to how to create an alternative >>>> implementation that achieves a similar result. >>>> >>>> When you write CIL policy, there are some "bugs" to take into >>>> account and to workaround. >>>> >>> >>> Sure there are different ways how to write it. I just wanted to >>> combine it with the current Fedora policy as much as possible without >>> re-writing the current Fedora policy. >>> >>>>> >>>>> -- Miroslav Grepl Senior Software Engineer, SELinux Solutions Red >>>>> Hat, Inc. _______________________________________________ Selinux >>>>> mailing list Selinux@tycho.nsa.gov To unsubscribe, send email to >>>>> Selinux-leave@tycho.nsa.gov. To get help, send an email >>>>> containing "help" to Selinux-request@tycho.nsa.gov. >>>> >>>> >>>> >>>> _______________________________________________ Selinux mailing >>>> list Selinux@tycho.nsa.gov To unsubscribe, send email to >>>> Selinux-leave@tycho.nsa.gov. To get help, send an email containing >>>> "help" to Selinux-request@tycho.nsa.gov. >>>> >>> >>> >> >> >> -- >> James Carter <jwcart2@tycho.nsa.gov> >> National Security Agency >> _______________________________________________ >> Selinux mailing list >> Selinux@tycho.nsa.gov >> To unsubscribe, send email to Selinux-leave@tycho.nsa.gov. >> To get help, send an email containing "help" to Selinux-request@tycho.nsa.gov. > > > > _______________________________________________ > Selinux mailing list > Selinux@tycho.nsa.gov > To unsubscribe, send email to Selinux-leave@tycho.nsa.gov. > To get help, send an email containing "help" to Selinux-request@tycho.nsa.gov. > -- James Carter <jwcart2@tycho.nsa.gov> National Security Agency ^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: type inheritance in CIL 2015-06-29 19:25 ` Dominick Grift 2015-06-29 20:22 ` James Carter @ 2015-06-30 8:37 ` Miroslav Grepl 2015-06-30 14:48 ` James Carter 1 sibling, 1 reply; 8+ messages in thread From: Miroslav Grepl @ 2015-06-30 8:37 UTC (permalink / raw) To: selinux On 06/29/2015 09:25 PM, Dominick Grift wrote: > On Mon, Jun 29, 2015 at 02:56:34PM -0400, James Carter wrote: >> On 06/29/2015 07:19 AM, Miroslav Grepl wrote: >>> On 06/29/2015 09:56 AM, Dominick Grift wrote: >>>> On Mon, Jun 29, 2015 at 09:29:34AM +0200, Miroslav Grepl >>>> wrote: >>>>> Trying to make sandbox working using CIL but I see it does >>>>> not support typeinherit statement. >>>> >>>> One of those features that really define CIL but that is >>>> currently not available or fully working yet. >>>> >> >> Inheritance in CIL is handled with blocks. >> >> The following policy: >> >> (block b1 (type t) (allow t self (CLASS (PERM))) ) >> >> (block b2 (blockinherit b1)) >> >> Would result in two types (b1.t and b2.t) and two rules. >> >> See block_test.cil and name_resolution_test.cil in secilc/test/ >> for more examples. Everything should work, but, of course, it has >> seen less testing at this point. > > Thanks I am aware of that featurew, namespacing is also still a bit > buggy in my view though. > > If this is meant to be a substitute for typeinherit then how is one > supposed to implement something that behaves like > typeinheritfilter? > > You are aware the typeinherit and typeinheritfilter are still > documented on https://github.com/SELinuxProject/cil/wiki? >> Yeap. So the point is I need to re-write the current sandbox policy to CIL using block statements to use inheritance. >> Jim >> >>>> My suggestion is to study the "cilpolicy" (which is really >>>> just a snapshot of reference policy transformed to cil with >>>> hll i believe) >>>> >>>> This will give you some pointers as to how to create an >>>> alternative implementation that achieves a similar result. >>>> >>>> When you write CIL policy, there are some "bugs" to take >>>> into account and to workaround. >>>> >>> >>> Sure there are different ways how to write it. I just wanted >>> to combine it with the current Fedora policy as much as >>> possible without re-writing the current Fedora policy. >>> >>>>> >>>>> -- Miroslav Grepl Senior Software Engineer, SELinux >>>>> Solutions Red Hat, Inc. >>>>> _______________________________________________ Selinux >>>>> mailing list Selinux@tycho.nsa.gov To unsubscribe, send >>>>> email to Selinux-leave@tycho.nsa.gov. To get help, send an >>>>> email containing "help" to Selinux-request@tycho.nsa.gov. >>>> >>>> >>>> >>>> _______________________________________________ Selinux >>>> mailing list Selinux@tycho.nsa.gov To unsubscribe, send email >>>> to Selinux-leave@tycho.nsa.gov. To get help, send an email >>>> containing "help" to Selinux-request@tycho.nsa.gov. >>>> >>> >>> >> >> >> -- James Carter <jwcart2@tycho.nsa.gov> National Security Agency >> _______________________________________________ Selinux mailing >> list Selinux@tycho.nsa.gov To unsubscribe, send email to >> Selinux-leave@tycho.nsa.gov. To get help, send an email >> containing "help" to Selinux-request@tycho.nsa.gov. > > > > _______________________________________________ Selinux mailing > list Selinux@tycho.nsa.gov To unsubscribe, send email to > Selinux-leave@tycho.nsa.gov. To get help, send an email containing > "help" to Selinux-request@tycho.nsa.gov. > -- Miroslav Grepl Senior Software Engineer, SELinux Solutions Red Hat, Inc. ^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: type inheritance in CIL 2015-06-30 8:37 ` Miroslav Grepl @ 2015-06-30 14:48 ` James Carter 0 siblings, 0 replies; 8+ messages in thread From: James Carter @ 2015-06-30 14:48 UTC (permalink / raw) To: Miroslav Grepl, selinux On 06/30/2015 04:37 AM, Miroslav Grepl wrote: > On 06/29/2015 09:25 PM, Dominick Grift wrote: >> On Mon, Jun 29, 2015 at 02:56:34PM -0400, James Carter wrote: >>> On 06/29/2015 07:19 AM, Miroslav Grepl wrote: >>>> On 06/29/2015 09:56 AM, Dominick Grift wrote: >>>>> On Mon, Jun 29, 2015 at 09:29:34AM +0200, Miroslav Grepl >>>>> wrote: >>>>>> Trying to make sandbox working using CIL but I see it does >>>>>> not support typeinherit statement. >>>>> >>>>> One of those features that really define CIL but that is >>>>> currently not available or fully working yet. >>>>> >>> >>> Inheritance in CIL is handled with blocks. >>> >>> The following policy: >>> >>> (block b1 (type t) (allow t self (CLASS (PERM))) ) >>> >>> (block b2 (blockinherit b1)) >>> >>> Would result in two types (b1.t and b2.t) and two rules. >>> >>> See block_test.cil and name_resolution_test.cil in secilc/test/ >>> for more examples. Everything should work, but, of course, it has >>> seen less testing at this point. >> >> Thanks I am aware of that featurew, namespacing is also still a bit >> buggy in my view though. >> >> If this is meant to be a substitute for typeinherit then how is one >> supposed to implement something that behaves like >> typeinheritfilter? >> >> You are aware the typeinherit and typeinheritfilter are still >> documented on https://github.com/SELinuxProject/cil/wiki? >>> > > Yeap. > > So the point is I need to re-write the current sandbox policy to CIL > using block statements to use inheritance. > Yes. Please keep me informed of any difficulties and bugs. I've tested the name resolution and block handling as much as I could, but you're likely to discover corner cases which I didn't think about. I am also curious about how you plan on using inheritance. What are you going to put in blocks? Which blocks are going to inherit from which blocks? I am not sure if it will be useful in your case, but there is a blockabstract statement which tells CIL that the block is to be ignored except for inheritance. Jim >>> Jim >>> >>>>> My suggestion is to study the "cilpolicy" (which is really >>>>> just a snapshot of reference policy transformed to cil with >>>>> hll i believe) >>>>> >>>>> This will give you some pointers as to how to create an >>>>> alternative implementation that achieves a similar result. >>>>> >>>>> When you write CIL policy, there are some "bugs" to take >>>>> into account and to workaround. >>>>> >>>> >>>> Sure there are different ways how to write it. I just wanted >>>> to combine it with the current Fedora policy as much as >>>> possible without re-writing the current Fedora policy. >>>> >>>>>> >>>>>> -- Miroslav Grepl Senior Software Engineer, SELinux >>>>>> Solutions Red Hat, Inc. >>>>>> _______________________________________________ Selinux >>>>>> mailing list Selinux@tycho.nsa.gov To unsubscribe, send >>>>>> email to Selinux-leave@tycho.nsa.gov. To get help, send an >>>>>> email containing "help" to Selinux-request@tycho.nsa.gov. >>>>> >>>>> >>>>> >>>>> _______________________________________________ Selinux >>>>> mailing list Selinux@tycho.nsa.gov To unsubscribe, send email >>>>> to Selinux-leave@tycho.nsa.gov. To get help, send an email >>>>> containing "help" to Selinux-request@tycho.nsa.gov. >>>>> >>>> >>>> >>> >>> >>> -- James Carter <jwcart2@tycho.nsa.gov> National Security Agency >>> _______________________________________________ Selinux mailing >>> list Selinux@tycho.nsa.gov To unsubscribe, send email to >>> Selinux-leave@tycho.nsa.gov. To get help, send an email >>> containing "help" to Selinux-request@tycho.nsa.gov. >> >> >> >> _______________________________________________ Selinux mailing >> list Selinux@tycho.nsa.gov To unsubscribe, send email to >> Selinux-leave@tycho.nsa.gov. To get help, send an email containing >> "help" to Selinux-request@tycho.nsa.gov. >> > > -- James Carter <jwcart2@tycho.nsa.gov> National Security Agency ^ permalink raw reply [flat|nested] 8+ messages in thread
end of thread, other threads:[~2015-06-30 14:48 UTC | newest] Thread overview: 8+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2015-06-29 7:29 type inheritance in CIL Miroslav Grepl 2015-06-29 7:56 ` Dominick Grift 2015-06-29 11:19 ` Miroslav Grepl 2015-06-29 18:56 ` James Carter 2015-06-29 19:25 ` Dominick Grift 2015-06-29 20:22 ` James Carter 2015-06-30 8:37 ` Miroslav Grepl 2015-06-30 14:48 ` James Carter
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.