SELinux

[Shaun Savage <savages@pcez.com>]

I have been customizing the policy now for about three months.  If you 
think of writing new policy as designing a state machine thing are easier.
the questions you need to ask is
1> How do you get to the execution of the program.  What domain should 
you allow to start this program?
2> What protections are required? This is the biggest issue.  Is there a 
  log file?  Does the program acceses any sockets? Is there user 
communcation?  Detail knowledge of the application is needed.  I tend to 
be paranoid so I create too many sub domains and make the policy difficult.
3> What programs are allowed to access this application data?

Read the policy/macros.te file
The linux/security/selinux/include/flask/*.h
av_permissions.h gives the bit pattern of all the permissions
av_perm_to_string.h & common_perm_to_string.h is some of the string
    permissions
class_to_string.h is most of the objects
flask.h gives the object classes

The main thing is to understand the application. Know what files, 
sockets, are being accesed and how.

I do agree that there needs to be a more documentation, but if there 
isn't the you can earn big dollars if you know it, I hope ;-).

Shaun Savage


--
You have received this message because you are subscribed to the selinux list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.