Need testers for Modules policicy on RHEL4

Need testers for Modules policicy on RHEL4

[Daniel J Walsh]

I have back ported the entire selinux tool chain to RHEL4.  I have also 
attempted to create a modular policy to match RHEL4 policy as closely as 
possible.

These packages are out on

ftp://people.redhat.com/dwalsh/SELinux/RHEL4_MODULAR

If anyone wants to play with these and do some testing that would be great.

There is no commitment from Red Hat to ever ship this.  But if it is 
ever going to ship,
we need to find problems with it now.

So if you have a spare RHEL4 box and want to play with modular policy, 
this is your chance.

Thanks,


Dan

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: Need testers for Modules policicy on RHEL4

[Stephen J. Smoogen]

On 3/29/06, Daniel J Walsh <dwalsh@redhat.com> wrote:
> I have back ported the entire selinux tool chain to RHEL4.  I have also
> attempted to create a modular policy to match RHEL4 policy as closely as
> possible.
>
> These packages are out on
>
> ftp://people.redhat.com/dwalsh/SELinux/RHEL4_MODULAR
>
> If anyone wants to play with these and do some testing that would be great.

Cool. I realize there is no promise but I will try them on a test box.
What should I look for in a test plan? Also what is the difference
between selinux-policy-2.2.28-1.rhel4.noarch.rpm and
selinux-policy-targeted-2.2.28-1.rhel4.noarch.rpm?


>
> There is no commitment from Red Hat to ever ship this.  But if it is
> ever going to ship,
> we need to find problems with it now.
>
> So if you have a spare RHEL4 box and want to play with modular policy,
> this is your chance.
>
> Thanks,
>
>
> Dan
>
> --
> fedora-selinux-list mailing list
> fedora-selinux-list@redhat.com
> https://www.redhat.com/mailman/listinfo/fedora-selinux-list
>


--
Stephen J Smoogen.
CSIRT/Linux System Administrator


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: Need testers for Modules policicy on RHEL4

[Daniel J Walsh]

Stephen J. Smoogen wrote:
> On 3/29/06, Daniel J Walsh <dwalsh@redhat.com> wrote:
>   
>> I have back ported the entire selinux tool chain to RHEL4.  I have also
>> attempted to create a modular policy to match RHEL4 policy as closely as
>> possible.
>>
>> These packages are out on
>>
>> ftp://people.redhat.com/dwalsh/SELinux/RHEL4_MODULAR
>>
>> If anyone wants to play with these and do some testing that would be great.
>>     
>
> Cool. I realize there is no promise but I will try them on a test box.
> What should I look for in a test plan? Also what is the difference
> between selinux-policy-2.2.28-1.rhel4.noarch.rpm and
> selinux-policy-targeted-2.2.28-1.rhel4.noarch.rpm?
>
>   
Look for regressions.  Want to make sure RHEL4 works the same under 
both.  The new policy has some added allows but should not have any ones 
missing.  There are some types that have been eliminated but they were 
not used.


>   
>> There is no commitment from Red Hat to ever ship this.  But if it is
>> ever going to ship,
>> we need to find problems with it now.
>>
>> So if you have a spare RHEL4 box and want to play with modular policy,
>> this is your chance.
>>
>> Thanks,
>>
>>
>> Dan
>>
>> --
>> fedora-selinux-list mailing list
>> fedora-selinux-list@redhat.com
>> https://www.redhat.com/mailman/listinfo/fedora-selinux-list
>>
>>     
>
>
> --
> Stephen J Smoogen.
> CSIRT/Linux System Administrator
>
> --
> fedora-selinux-list mailing list
> fedora-selinux-list@redhat.com
> https://www.redhat.com/mailman/listinfo/fedora-selinux-list
>   


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: Need testers for Modules policicy on RHEL4

[Christopher J. PeBenito]

On Thu, 2006-03-30 at 15:00 -0500, Daniel J Walsh wrote:
> Stephen J. Smoogen wrote:
> > On 3/29/06, Daniel J Walsh <dwalsh@redhat.com> wrote:   
> >> I have back ported the entire selinux tool chain to RHEL4.  I have also
> >> attempted to create a modular policy to match RHEL4 policy as closely as
> >> possible.
> >>
> >> These packages are out on
> >>
> >> ftp://people.redhat.com/dwalsh/SELinux/RHEL4_MODULAR
> >>
> >> If anyone wants to play with these and do some testing that would be great.
> >
> > Cool. I realize there is no promise but I will try them on a test box.
> > What should I look for in a test plan? Also what is the difference
> > between selinux-policy-2.2.28-1.rhel4.noarch.rpm and
> > selinux-policy-targeted-2.2.28-1.rhel4.noarch.rpm?
> >
> >   
> Look for regressions.  Want to make sure RHEL4 works the same under 
> both.  The new policy has some added allows but should not have any ones 
> missing.  There are some types that have been eliminated but they were 
> not used.

One known thing would be the missing su(do)+pam_login rules.  I plan on
making a rhel4 distro tunable (which infers the redhat tunable too), to
handle things that are in RHEL4, but no longer in newer Red Hat
releases.

-- 
Chris PeBenito
Tresys Technology, LLC
(410) 290-1411 x150


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: Need testers for Modules policicy on RHEL4

[James de Lurker]

Daniel J Walsh wrote:

> I have back ported the entire selinux tool chain to RHEL4.  I have also
> attempted to create a modular policy to match RHEL4 policy as closely as
> possible.

> These packages are out on
> ftp://people.redhat.com/dwalsh/SELinux/RHEL4_MODULAR

No offence Dan, but I happen to be one of those marginalised "enthusiasts"
that cannot afford the costs of personally supporting RHEL. Nor would I if
it were offered Free and Gratis.

Standard Contract rates apply if RH wish to benefit from any more effort
expended by me for RH commercial distros.

I became inactive on the project after spending months building RH9 test
setups only to see it switch to FC. That was to support the early rpm
packaging.

I'll likely become an active and thorough tester again on a community basis
when the selinux project decides to base its work on a genuine community
based Linux distro that would also be treated seriously in the enterprise
by commercial entities. With FC the poor relation.

I already find it distasteful that Redhat are effectively gaining
commercial advantage from a project support by a US government body.

The separation of FC and RHEL is mere sophistry IMHO.

In the UK one of our defense organisations was effectively forced to hand
over work on hardening a commercial OS because EU competition rules
forbade subsidy of commercial projects from government / taxpayer funds.

Sorry if this is OT for a tech developers list, but it is important.

Novell are struggling as competitors to RedHat to gain certifications for
enterprise level products, and I dont see the US Govt offering them the
equivalent assistance for community based projects.

-- 

  -- James

>From and Reply To are INVALID.

All public postings use munged headers[1]- To contact me off list:
  1) Remove "M U N G I E j u m p" ONLY: leave that "nospam" in there!
  2) change "hotmail" 2 "myrealbox" after the @


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: Need testers for Modules policicy on RHEL4

[Stephen Smalley]

On Thu, 2006-03-30 at 07:18 +0100, James de Lurker wrote:
> I'll likely become an active and thorough tester again on a community basis
> when the selinux project decides to base its work on a genuine community
> based Linux distro that would also be treated seriously in the enterprise
> by commercial entities. With FC the poor relation.
> 
> I already find it distasteful that Redhat are effectively gaining
> commercial advantage from a project support by a US government body.
> 
> The separation of FC and RHEL is mere sophistry IMHO.

I think you are confused.  Red Hat trail-blazed the path of integrating
SELinux into a full distribution and enabling it by default for all
users.  Their work yielded major improvements in SELinux, including:
- significant expansion of the userland modifications,
- expansion and refinement of the policy,
- maturing of the SELinux kernel and userland code,
- getting SELinux into a state where it could be enabled by default for
typical users.

They did a lot of hard work, and they made all of their enhancements
open source, contributing them to the upstream SELinux where there is an
upstream component and otherwise making them available in the Fedora
Core tree for reference by other distros.

Meanwhile, the Debian and Gentoo SELinux folks have been hard at work
likewise integrating SELinux into their respective distros, and they
have leveraged the contributions made by Red Hat while making
contributions of their own.  And people have been packaging SELinux on
the side for SuSE and Slackware among others for quite some time,
although sadly the SuSE-related efforts have been stalled by Novell's
choice.

Also, if you look at the minutes from the SELinux developer summit,
you'll see that there are plans to improve pan-distribution support and
create a more viable upstream SELinux development community that is not
so closely coupled to Fedora, see:
http://www.selinux-symposium.org/2006/summit.php

> Novell are struggling as competitors to RedHat to gain certifications for
> enterprise level products, and I dont see the US Govt offering them the
> equivalent assistance for community based projects.

We would have been glad to have worked with Novell/SuSE on SELinux
integration (and did talk with them), and still would be glad to do so
in the future if the opportunity presents itself.  Our goal has always
been the mainstreaming of the technology.  But Novell/SuSE chose to not
pursue it.  Their choice.
 
-- 
Stephen Smalley
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: Need testers for Modules policicy on RHEL4

[James de Lurker]

Apologies to any on the list that I may have offended with a distraction.
(readers focussed only upon RHEL rpm testing can safely skip this subthread)

On Thu, 30 Mar 2006 08:20:06 -0500  Stephen Smalley wrote:
> On Thu, 2006-03-30 at 07:18 +0100, James de Lurker wrote:
> I think you are confused.
Confusion is likely, even to many looking closely at the project.
As it was re-based upon FC Following EOL of RedHat Linux products.
FC is the community supported openly available non-profit distro.

Thank you for addressing the points seriously with quality
replies, both on-list and off, in private email. The time that you
took to do that is appreciated, and the spirit that you did it in
is commendable.


> Also, if you look at the minutes from the SELinux developer summit,
> you'll see that there are plans to improve pan-distribution support and
> create a more viable upstream SELinux development community that is not
> so closely coupled to Fedora, see:
> http://www.selinux-symposium.org/2006/summit.php

Thanks!
I will indeed do that. Skimming this list as a non-participant since the
EOL of the last mainstream enterprise distro selinux was based upon is
clearly insufficient. The experimental gentoo LiveCD selinux distros
are of some interest. Its less painful to learn or demonstrate by breaking
things in ramdisk ( or virtual machine hosted filesystems, come to that )

Should the project core return to a neutral base that also has enterprise
credibility, I'll be back, with personal contribution, testing, even if no
longer as competent at the developer / packager leading edge.

Constructive points outstanding on competition issues are OT, and I will
not pollute this list with them. (Followups later by private email).

The hard work that many here have put in since the projects inception, as
an invasive kernel patch to an already heavily vendor patched kernel, is
quite remarkable. For those that care to pause, look back, and compare.

Now, there is the world of LSM.
A summary on progress of convergence of LSM and the selinux LSM
could be valuable for readers that deal with kernel issues besides
selinux but might benefit from knowledge of the most crucial
differences. Other LSM projects that perhaps ought to be designed to
co-exist with selinux LSM come to mind here. The LSM developers list
seems a bit indefinate in this area.

-- 

  -- James

>From and Reply To are INVALID.

All public postings use munged headers[1]- To contact me off list:
  1) Remove "M U N G I E j u m p" ONLY: leave that "nospam" in there!
  2) change "hotmail" 2 "myrealbox" after the @


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

End User Mailing List / Group

[Randal T. Rioux]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: RIPEMD160

James de Lurker wrote:
> Sorry if this is OT for a tech developers list, but it is important.

This comment made me wonder... is there a user group, mailing list or
newsgroup for general SE Linux usage? Most projects will split lists for
developers and users. I found nothing available for those not involved
with development. Though I did see some vendor specific offerings, that
is in my opinion too specialized. I would like to keep the vendor and SE
Linux implementation dependency as distant as possible.

If indeed there is nothing like this, would it be wise to start
something? I would be more than happy to host a listserv if there is
interest. Thoughts?

Also, kudos to any involved with the O'Reilly book by Bill McCarty -
excellent work.

Thanks!

Randal T. Rioux | Procyon Labs
IT Security R&D and Consulting
Virtual: www.procyonlabs.com
Physical: DC / Baltimore
PGP: gpg --keyserver pgp.mit.edu --recv-keys 0xD08D1941

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2 (GNU/Linux)
Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org

iD8DBQFEMKq+RrGMQdCNGUERAxptAKCHKqvufRgRcCCLKNkEZcu4INbyIQCfUTSA
sWyLo0MdmTM6VJt1YM5i20w=
=9VBi
-----END PGP SIGNATURE-----

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: End User Mailing List / Group

[Erich Schubert]

Hi,
I've done that split for the Debian SELinux lists, but these are pretty
much no-traffic lists so far.
In my personal opinion, SELinux isn't end-user ready yet (or not
anymore, it was when we were still using the old policy). Too many
pitfalls (module linking not yet working entirely right, so you need to
put everything in base you want) and way too little documentation.

best regards,
Erich Schubert
-- 
   erich@(vitavonni.de|debian.org)    --    GPG Key ID: 4B3A135C    (o_
       The best things in life are free: Friendship and Love.       //\
    Der Anfang aller Erkenntnis ist das Staunen. --- Aristoteles    V_/_


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: End User Mailing List / Group

[Stephen Smalley]

On Mon, 2006-04-03 at 14:32 +0200, Erich Schubert wrote:
> Hi,
> I've done that split for the Debian SELinux lists, but these are pretty
> much no-traffic lists so far.
> In my personal opinion, SELinux isn't end-user ready yet (or not
> anymore, it was when we were still using the old policy). Too many
> pitfalls (module linking not yet working entirely right, so you need to
> put everything in base you want) and way too little documentation.

Support for a modular base policy didn't exist at all in old policy - it
hadn't been invented yet ;)  So no regression there.  And the breakage
in the modular policy support is only for optionals-in-base, which
wasn't part of the original design and implementation.  Documentation
for the new support is improving, contributions welcome.

On the end user mailing list question, I'm not sure it would have much
life isolated from the distribution-focused lists and from the upstream
developers list.  Most end users will deal with SELinux through their
particular distributions, as integrating SELinux does take work and is
difficult to maintain long term outside of the main packages of a
distribution.  If there is a real demand for such a list, possibly it
could be created on a community site like selinuxnews.org.   But I'm not
sure if there is a such demand presently.

-- 
Stephen Smalley
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: End User Mailing List / Group / Policy Made Easy

[Randal T. Rioux]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: RIPEMD160

Stephen Smalley wrote:
> On Mon, 2006-04-03 at 14:32 +0200, Erich Schubert wrote:
<snip>
>>In my personal opinion, SELinux isn't end-user ready yet (or not
>>anymore, it was when we were still using the old policy). Too many
>>pitfalls (module linking not yet working entirely right, so you need to
>>put everything in base you want) and way too little documentation.
<snip>
> On the end user mailing list question, I'm not sure it would have much
> life isolated from the distribution-focused lists and from the upstream
> developers list.  Most end users will deal with SELinux through their
> particular distributions, as integrating SELinux does take work and is
> difficult to maintain long term outside of the main packages of a
> distribution.   

In reference to user interfacing, I was considering developing an
ncurses based editor. I generally don't install X libraries on servers
(wish Solaris made that an easy process), so I wanted something terminal
friendly. I have noticed a couple really good projects (such as SELinux
Policy Editor), but they are based on X. I will kick that idea around
further, but please let me know if something already exists or if you
have any design suggestions.

> But I'm not sure if there is a such demand presently.

We must create it! :-)

Thanks,
Randy
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2 (GNU/Linux)
Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org

iD8DBQFEMzydRrGMQdCNGUERAyX1AJ4rt16P9Er3tSPrtTCjbuo0PhegVACfXtA2
+YPZ/FXupUCLR1FCOCBDtXE=
=wAAx
-----END PGP SIGNATURE-----

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: End User Mailing List / Group / Policy Made Easy

[Erich Schubert]

Hi Randy,
> In reference to user interfacing, I was considering developing an
> ncurses based editor. I generally don't install X libraries on servers

I definitely do agree here, I don't have X on any of my SELinux boxes
either.
You can do certain things remotely by copying files around (but that,
too, can be a PITA if you e.g. don't have ssh_sysadm logins), so I'd
like to see a ncurses frontent e.g. for picking the modules to link.

When you are tackling the module selection, please try to come up with
an interface that handles
- dependencies - users selecting "postfix" need "mta", too.
- suggestions - if postfix is installed, "postfix.pp" should be
preselected; however the "rsync.pp" module is only needed for running an
rsync server IIRC, not for running rsync manually over SSH which is
probably more common.

I wouldn't do this just by "preseeding", but I would display all modules
that the distribution magic spits out specially.
You can run the magic in the inital run, analyze the installed software,
then preselect the relevant modules. However, people may install
additional software later, or deinstall some. Therefore it would be nice
if the user could fire up the module picker and see the relevant entries
highlighted.

Aptitude has a pretty nice text UI for such things, albeit pretty
complex by now. But it can handle all kinds of dependencies,
suggestions, automatically installed packages and so on.

Some things I'd like to see discussed on the mailing list here:
1. How to extract dependency information from modules?
2. Where to store package -> module mappings for module autoselection?

best regards,
Erich Schubert
-- 
   erich@(vitavonni.de|debian.org)    --    GPG Key ID: 4B3A135C    (o_
     You know we all became mathematicians for the same reason:     //\
                  we were lazy. --- Max Rosenlicht                  V_/_
          Ein schöner Moment leuchtet das Leben hindurch.



--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.