Re: wish-list item for selinux policy analyss

[Ron Kuris <rk@unify.com>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Casey Schaufler wrote:

| I say amen to points 1-3. I add ...
|
| 4) A derived policy set will only tell you what the programs do,
| not what they are intended to do. Should I leave doors unlocked
| because burglers attempt to use them? If no burgler tries my door
| for a year does that mean having a lock on my door is unnecessary?

I think the logic here is backwards.  If nobody is using that door for
a year, then that door is a candidate for becoming a wall instead of a
door.  Otherwise, you end up in a maze of twisty passages, where
nobody knows what doors are needed and why.  Fewer doors means less
memory also, which can be important for embedded systems.

I think this wish-list item doesn't tell you what you can remove from
a policy.  However, it might tell you which rules are candidates to be
changed to a "deny" rule (or lack of an "allow" rule really).  Lets
say a particular program used to create temp files but they don't any
more.  Chances are, the rule will stay around, unless you realize it
isn't getting used any more, in which case you might want to
investigate it.

I do the same thing with iptables.  I have rules for services/ports
that have counters.  If the counters are zero, I look at the service
and decide whether or not I still need that service any more.

Ron
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)
Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org

iD8DBQFCwtx/VkC/44kdyuYRAre/AKDlOMgNkc5M790lbwWM3sT7M9UCrgCg264u
Om80p6tVIIr77yhxpXj7mnw=
=MBlJ
-----END PGP SIGNATURE-----



--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.