RBAC with SELinux MCS

RBAC with SELinux MCS

[Shaz]

[-- Attachment #1: Type: text/plain, Size: 731 bytes --]

Dear list,

I was studying some earlier work on RBAC and came across Kuhn98 [1], which
says that RBAC can be implemented if some interface function is used to map
privilege sets of RBAC with MCS. James Moris blog article on MCS [2] states
that MCS is just dicretionary like DAC if hierarchies like of MLS levels are
not used. It might be because of the implementation of current LSPP on Linux
distros. So my question is that can RBAC be used with SELinux if the mapping
function is provided?

Some further literature or existing work being pointed out will be
appreciated.

Thank you.

[1]
http://csrc.nist.gov/groups/SNS/rbac/documents/design_implementation/kuhn-98.pdf
[2] http://james-morris.livejournal.com/5583.html

-- 
Shaz

[-- Attachment #2: Type: text/html, Size: 947 bytes --]

Re: RBAC with SELinux MCS

[Justin P. Mattock]

Shaz wrote:
> Dear list,
>
> I was studying some earlier work on RBAC and came across Kuhn98 [1], 
> which says that RBAC can be implemented if some interface function is 
> used to map privilege sets of RBAC with MCS. James Moris blog article 
> on MCS [2] states that MCS is just dicretionary like DAC if 
> hierarchies like of MLS levels are not used. It might be because of 
> the implementation of current LSPP on Linux distros. So my question is 
> that can RBAC be used with SELinux if the mapping function is provided?
>
> Some further literature or existing work being pointed out will be 
> appreciated.
>
> Thank you.
>
> [1] 
> http://csrc.nist.gov/groups/SNS/rbac/documents/design_implementation/kuhn-98.pdf
> [2] http://james-morris.livejournal.com/5583.html
>
> -- 
> Shaz
>
Im guessing the mapping function is "newrole" right!
if then yeah you should be able too i.g.
newrole -r  *_r -- -c /usr/bin/* (or wherever/whatever your
wanting to use in that role).
might get complicated with the sensitivity
levels and categories(that is if you really tweak them).

Justin P. Mattock


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: RBAC with SELinux MCS

[Shaz]

[-- Attachment #1: Type: text/plain, Size: 1370 bytes --]

On Wed, Jul 1, 2009 at 12:01 PM, Justin P. Mattock
<justinmattock@gmail.com>wrote:

> Shaz wrote:
>
>> Dear list,
>>
>> I was studying some earlier work on RBAC and came across Kuhn98 [1], which
>> says that RBAC can be implemented if some interface function is used to map
>> privilege sets of RBAC with MCS. James Moris blog article on MCS [2] states
>> that MCS is just dicretionary like DAC if hierarchies like of MLS levels are
>> not used. It might be because of the implementation of current LSPP on Linux
>> distros. So my question is that can RBAC be used with SELinux if the mapping
>> function is provided?
>>
>> Some further literature or existing work being pointed out will be
>> appreciated.
>>
>> Thank you.
>>
>> [1]
>> http://csrc.nist.gov/groups/SNS/rbac/documents/design_implementation/kuhn-98.pdf
>> [2] http://james-morris.livejournal.com/5583.html
>>
>> --
>> Shaz
>>
>>  Im guessing the mapping function is "newrole" right!
> if then yeah you should be able too i.g.
> newrole -r  *_r -- -c /usr/bin/* (or wherever/whatever your
> wanting to use in that role).
> might get complicated with the sensitivity
> levels and categories(that is if you really tweak them).


Is this consistent with NIST RBAC standard to a greater extent? Never use
roles in SELinux because thought it was just grouping of users.


>
>
> Justin P. Mattock
>
>


-- 
Shaz

[-- Attachment #2: Type: text/html, Size: 2276 bytes --]

Re: RBAC with SELinux MCS

[Justin P. Mattock]

Shaz wrote:
>
>
> On Wed, Jul 1, 2009 at 12:01 PM, Justin P. Mattock 
> <justinmattock@gmail.com <mailto:justinmattock@gmail.com>> wrote:
>
>     Shaz wrote:
>
>         Dear list,
>
>         I was studying some earlier work on RBAC and came across
>         Kuhn98 [1], which says that RBAC can be implemented if some
>         interface function is used to map privilege sets of RBAC with
>         MCS. James Moris blog article on MCS [2] states that MCS is
>         just dicretionary like DAC if hierarchies like of MLS levels
>         are not used. It might be because of the implementation of
>         current LSPP on Linux distros. So my question is that can RBAC
>         be used with SELinux if the mapping function is provided?
>
>         Some further literature or existing work being pointed out
>         will be appreciated.
>
>         Thank you.
>
>         [1]
>         http://csrc.nist.gov/groups/SNS/rbac/documents/design_implementation/kuhn-98.pdf
>         [2] http://james-morris.livejournal.com/5583.html
>
>         -- 
>         Shaz
>
>     Im guessing the mapping function is "newrole" right!
>     if then yeah you should be able too i.g.
>     newrole -r  *_r -- -c /usr/bin/* (or wherever/whatever your
>     wanting to use in that role).
>     might get complicated with the sensitivity
>     levels and categories(that is if you really tweak them).
>
>
> Is this consistent with NIST RBAC standard to a greater extent? Never 
> use roles in SELinux because thought it was just grouping of users.
>
>
>
>     Justin P. Mattock
>
>
>
>
> -- 
> Shaz
>
It should be of standard to NIST(if not then they should fix that)
I don't see it as grouping users(but could be wrong),
I see it as a way of confining the situation i.g.
if  you run an application in certain role, it's confined to
that role and only the privileges that role provides.

Justin P. Mattock




--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: RBAC with SELinux MCS

[Shaz]

[-- Attachment #1: Type: text/plain, Size: 2297 bytes --]

On Wed, Jul 1, 2009 at 12:40 PM, Justin P. Mattock
<justinmattock@gmail.com>wrote:

> Shaz wrote:
>
>
>>
>> On Wed, Jul 1, 2009 at 12:01 PM, Justin P. Mattock <
>> justinmattock@gmail.com <mailto:justinmattock@gmail.com>> wrote:
>>
>>    Shaz wrote:
>>
>>        Dear list,
>>
>>        I was studying some earlier work on RBAC and came across
>>        Kuhn98 [1], which says that RBAC can be implemented if some
>>        interface function is used to map privilege sets of RBAC with
>>        MCS. James Moris blog article on MCS [2] states that MCS is
>>        just dicretionary like DAC if hierarchies like of MLS levels
>>        are not used. It might be because of the implementation of
>>        current LSPP on Linux distros. So my question is that can RBAC
>>        be used with SELinux if the mapping function is provided?
>>
>>        Some further literature or existing work being pointed out
>>        will be appreciated.
>>
>>        Thank you.
>>
>>        [1]
>>
>> http://csrc.nist.gov/groups/SNS/rbac/documents/design_implementation/kuhn-98.pdf
>>        [2] http://james-morris.livejournal.com/5583.html
>>
>>        --        Shaz
>>
>>    Im guessing the mapping function is "newrole" right!
>>    if then yeah you should be able too i.g.
>>    newrole -r  *_r -- -c /usr/bin/* (or wherever/whatever your
>>    wanting to use in that role).
>>    might get complicated with the sensitivity
>>    levels and categories(that is if you really tweak them).
>>
>>
>> Is this consistent with NIST RBAC standard to a greater extent? Never use
>> roles in SELinux because thought it was just grouping of users.
>>
>>
>>
>>    Justin P. Mattock
>>
>>
>>
>>
>> --
>> Shaz
>>
>>  It should be of standard to NIST(if not then they should fix that)
> I don't see it as grouping users(but could be wrong),
> I see it as a way of confining the situation i.g.
> if  you run an application in certain role, it's confined to
> that role and only the privileges that role provides.


Those privileges depend on the kind of object defined by the "class" and
enforced by the object manager. I think its making sense to my stupid mind
now :) I will appreciate if someone can clear out if this is consistent with
the NIST standards.

Thanks Justin.


>
>
> Justin P. Mattock
>
>
>
>


-- 
Shaz

[-- Attachment #2: Type: text/html, Size: 3495 bytes --]

Re: RBAC with SELinux MCS

[Justin P. Mattock]

Shaz wrote:
>
>
> On Wed, Jul 1, 2009 at 12:40 PM, Justin P. Mattock 
> <justinmattock@gmail.com <mailto:justinmattock@gmail.com>> wrote:
>
>     Shaz wrote:
>
>
>
>         On Wed, Jul 1, 2009 at 12:01 PM, Justin P. Mattock
>         <justinmattock@gmail.com <mailto:justinmattock@gmail.com>
>         <mailto:justinmattock@gmail.com
>         <mailto:justinmattock@gmail.com>>> wrote:
>
>            Shaz wrote:
>
>                Dear list,
>
>                I was studying some earlier work on RBAC and came across
>                Kuhn98 [1], which says that RBAC can be implemented if some
>                interface function is used to map privilege sets of
>         RBAC with
>                MCS. James Moris blog article on MCS [2] states that MCS is
>                just dicretionary like DAC if hierarchies like of MLS
>         levels
>                are not used. It might be because of the implementation of
>                current LSPP on Linux distros. So my question is that
>         can RBAC
>                be used with SELinux if the mapping function is provided?
>
>                Some further literature or existing work being pointed out
>                will be appreciated.
>
>                Thank you.
>
>                [1]
>         http://csrc.nist.gov/groups/SNS/rbac/documents/design_implementation/kuhn-98.pdf
>                [2] http://james-morris.livejournal.com/5583.html
>
>                --        Shaz
>
>            Im guessing the mapping function is "newrole" right!
>            if then yeah you should be able too i.g.
>            newrole -r  *_r -- -c /usr/bin/* (or wherever/whatever your
>            wanting to use in that role).
>            might get complicated with the sensitivity
>            levels and categories(that is if you really tweak them).
>
>
>         Is this consistent with NIST RBAC standard to a greater
>         extent? Never use roles in SELinux because thought it was just
>         grouping of users.
>
>
>
>            Justin P. Mattock
>
>
>
>
>         -- 
>         Shaz
>
>     It should be of standard to NIST(if not then they should fix that)
>     I don't see it as grouping users(but could be wrong),
>     I see it as a way of confining the situation i.g.
>     if  you run an application in certain role, it's confined to
>     that role and only the privileges that role provides.
>
>
> Those privileges depend on the kind of object defined by the "class" 
> and enforced by the object manager. I think its making sense to my 
> stupid mind now :) I will appreciate if someone can clear out if this 
> is consistent with the NIST standards.
>
That's fine
I'll add a CC to someone who has better knowledge than I with SELinux,

> Thanks Justin.
>
>
>
>     Justin P. Mattock
>
>
>
>
>
>
> -- 
> Shaz
>
Stephen if you can, and have the time could you help this person out 
with this question:
Is this consistent with NIST RBAC standard to a greater extent? Never 
use roles in SELinux because thought it was just grouping of users.

Justin P. Mattock


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: RBAC with SELinux MCS

[Stephen Smalley]

On Wed, 2009-07-01 at 11:15 +0600, Shaz wrote:
> Dear list,
> 
> I was studying some earlier work on RBAC and came across Kuhn98 [1],
> which says that RBAC can be implemented if some interface function is
> used to map privilege sets of RBAC with MCS. James Moris blog article
> on MCS [2] states that MCS is just dicretionary like DAC if
> hierarchies like of MLS levels are not used. It might be because of
> the implementation of current LSPP on Linux distros. So my question is
> that can RBAC be used with SELinux if the mapping function is
> provided?
> 
> Some further literature or existing work being pointed out will be
> appreciated.
> 
> Thank you.
> 
> [1]
> http://csrc.nist.gov/groups/SNS/rbac/documents/design_implementation/kuhn-98.pdf
> [2] http://james-morris.livejournal.com/5583.html

SELinux implements its own RBAC model, described here:
http://www.nsa.gov/research/_files/selinux/papers/policy2/x86.shtml

By coupling RBAC with TE (which is a mandatory scheme), we can directly
bind roles to processes and enforce RBAC restrictions at the operating
system level.  We also address some of the limitations of traditional
RBAC through TE.

RBAC and MCS don't have anything to do with each other.

-- 
Stephen Smalley
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.