Re: Question on networking accesses

[Casey Schaufler <casey@schaufler-ca.com>]

--- Steve G <linux_4ever@yahoo.com> wrote:

> 
> >I guess with SELinux you could think of it as the following:
> >
> > - process A (subject) writes to socket A1 (object)
> > - socket A1 (subject) sends packet to compat_net/SECMARK (object)
> >
> >    packet traverses the ether (real magic)
> >
> > - socket B1 (subject) receives the packet via int/ext labels (object)
> > - process B (subject) receives the data via socket B1 (object)
> 
> I think this is missing the access control decisions. First, the sender has
> to be
> in a domain that allows a connect/sendto, the connection between domains must
> be
> allowed by policy, and the receiver has to be in a domain that allows
> listen/recvfrom. This is omitting any DAC restrictions, capability
> requirements,
> and IPTables rules which have first vote on denying the activity. The access
> control is mostly at the entry points to the transaction and not on a packet
> by
> packet basis (except perhaps udp where every packet is an entry point to the
> transaction).

The nut of my question, which I think Paul has answered, is about
the subtle distintion between A writing to B and B reading from A.
There sure is a lot of sophistication involved in the process, and
it looks as if A thinks it is writing and B thinks it is reading.
That implies an intermediate object for A to write and B to read.
As I noted before, models with insubstantial objects have been frowned
upon in the past. Y'all may be better positioned to argue in their
favor than I was back in '95 an '02.


Casey Schaufler
casey@schaufler-ca.com

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.