Static analysis to assist policy creation?

Static analysis to assist policy creation?

[Andrew Ruef]

[-- Attachment #1: Type: text/plain, Size: 1150 bytes --]

Hello SELinux list, 

We’ve been thinking about creating a static (or potentially concolic) analysis and testing infrastructure that would assist in the creation of finer grained SELinux policies than audit2allow. We think that some work can be done through alias analysis and domain specific object (strings, memory regions/files, etc) analysis wholly statically, but we’ve developed an extensive symbolic execution system for C/binary programs that could also be applied. 

I’ve done some searching and asking around and it doesn’t seem like there are any tools that do this. I’m aware of some past projects that made use of static analysis tools to help create security policies, like the IBM SWORD4J work. The IBM people seemed really happy with those results and they have relayed that it really helped their internal efforts for security labeling, so maybe there is some hope for tools in this area. 

My question is two-fold

1. Is there a history of using static analysis to create SELinux policies that I haven’t found so far?

2. Is there any interest in the community for such an effort today?

Thank you,

Andrew

[-- Attachment #2: smime.p7s --]
[-- Type: application/pkcs7-signature, Size: 3868 bytes --]

Re: Static analysis to assist policy creation?

[Jason Zaman]

On Tue, Oct 20, 2015 at 01:17:27PM -0400, Andrew Ruef wrote:
> Hello SELinux list, 
> 
> We’ve been thinking about creating a static (or potentially concolic) analysis and testing infrastructure that would assist in the creation of finer grained SELinux policies than audit2allow. We think that some work can be done through alias analysis and domain specific object (strings, memory regions/files, etc) analysis wholly statically, but we’ve developed an extensive symbolic execution system for C/binary programs that could also be applied. 
> 
> I’ve done some searching and asking around and it doesn’t seem like there are any tools that do this. I’m aware of some past projects that made use of static analysis tools to help create security policies, like the IBM SWORD4J work. The IBM people seemed really happy with those results and they have relayed that it really helped their internal efforts for security labeling, so maybe there is some hope for tools in this area. 
> 
> My question is two-fold
> 
> 1. Is there a history of using static analysis to create SELinux policies that I haven’t found so far?
> 
> 2. Is there any interest in the community for such an effort today?
> 
> Thank you,
> 
> Andrew

Hey Andrew,

This sounds interesting and I'd love a tool to verify things. An often
overlooked part in policies is removing permissions that are no longer
required when a new version is released. A tool like this could be a
great help to re-run whenever there is a major bump in a package to keep
the policy as slim as possible.

You might also want to try the reference policy list. That one is a
little oriented towards actual policy development:
refpolicy@oss.tresys.com

-- Jason

Re: Static analysis to assist policy creation?

[Miroslav Grepl]

On 10/20/2015 07:17 PM, Andrew Ruef wrote:
> Hello SELinux list, 
> 
> We’ve been thinking about creating a static (or potentially concolic) analysis and testing infrastructure that would assist in the creation of finer grained SELinux policies than audit2allow. We think that some work can be done through alias analysis and domain specific object (strings, memory regions/files, etc) analysis wholly statically, but we’ve developed an extensive symbolic execution system for C/binary programs that could also be applied. 
> 
> I’ve done some searching and asking around and it doesn’t seem like there are any tools that do this. I’m aware of some past projects that made use of static analysis tools to help create security policies, like the IBM SWORD4J work. The IBM people seemed really happy with those results and they have relayed that it really helped their internal efforts for security labeling, so maybe there is some hope for tools in this area. 
> 
> My question is two-fold
> 
> 1. Is there a history of using static analysis to create SELinux policies that I haven’t found so far?
> 
> 2. Is there any interest in the community for such an effort today?
> 
> Thank you,
> 
> Andrew

Hi Andrew,
we have a guy (Vit Mojzis) in Red Hat who works on

"SELinux policy analysis tool" diploma thesis consisting of the following

1) Get acquainted with Security Enhanced Linux (SELinux).
2) Design SELinux policy analysis tool capable of
 (a) representing SELinux policies as well as given integrity goals
 (b) identifying conflicts between them (i.e., capable of analysis of
interactions between policy modules)
 (c) providing information necessary for resolution of such conflicts.
3) Implement the tool so that it can be integrated with current SELinux
user-space tools.
4) Demonstrate functionality of the developed tool on a non-trivial use
case.
5) Evaluate the obtained results and discuss possible future
improvements of the developed tool.

It is not the same what you want but I believe there is a certain
overlap with your idea.

> 
> 
> 
> _______________________________________________
> Selinux mailing list
> Selinux@tycho.nsa.gov
> To unsubscribe, send email to Selinux-leave@tycho.nsa.gov.
> To get help, send an email containing "help" to Selinux-request@tycho.nsa.gov.
> 


-- 
Miroslav Grepl
Senior Software Engineer, SELinux Solutions
Red Hat, Inc.