* mcs_systemhigh use @ 2010-06-10 9:15 Andy Warner 2010-06-10 11:09 ` Christopher J. PeBenito 0 siblings, 1 reply; 7+ messages in thread From: Andy Warner @ 2010-06-10 9:15 UTC (permalink / raw) To: selinux [-- Attachment #1: Type: text/plain, Size: 909 bytes --] In the policy for the Trusted RUBIX DBMS, we assign file contexts using the following (only one representative dir, 'backups', shown): ifdef(`enable_mls',` /var/lib/RUBIXdbms/backups(/.*)? gen_context(system_u:object_r:rubix_backup_t,mls_systemhigh) ') ifdef(`enable_mcs',` /var/lib/RUBIXdbms/backups(/.*)? gen_context(system_u:object_r:rubix_backup_t,mcs_systemhigh) ') When using the mls policy, I get the expected level of mls_systemhigh (s15:c0.c1023). But when using the targeted policy, I get an unexpected value for mcs_systemhigh. I would expect to get s0:c0.c1023, but get s0. I have verified this behavior on Fedora 9 and 12. Is my assumption wrong about what mcs_systemhigh should be or am I missing something? Relevant output from 'semanage fcontext -l' /var/lib/RUBIXdbms/backups(/.*)? all files system_u:object_r:rubix_backup_t:s0 Thanks, Andy [-- Attachment #2: Type: text/html, Size: 1396 bytes --] ^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: mcs_systemhigh use 2010-06-10 9:15 mcs_systemhigh use Andy Warner @ 2010-06-10 11:09 ` Christopher J. PeBenito 2010-06-10 11:12 ` Andy Warner 0 siblings, 1 reply; 7+ messages in thread From: Christopher J. PeBenito @ 2010-06-10 11:09 UTC (permalink / raw) To: Andy Warner; +Cc: selinux On Thu, 2010-06-10 at 17:15 +0800, Andy Warner wrote: > In the policy for the Trusted RUBIX DBMS, we assign file contexts > using the following (only one representative dir, 'backups', shown): > > ifdef(`enable_mls',` > /var/lib/RUBIXdbms/backups(/.*)? > gen_context(system_u:object_r:rubix_backup_t,mls_systemhigh) > ') > ifdef(`enable_mcs',` > /var/lib/RUBIXdbms/backups(/.*)? > gen_context(system_u:object_r:rubix_backup_t,mcs_systemhigh) > ') > > When using the mls policy, I get the expected level of mls_systemhigh > (s15:c0.c1023). But when using the targeted policy, I get an > unexpected value for mcs_systemhigh. I would expect to get > s0:c0.c1023, but get s0. I have verified this behavior on Fedora 9 and > 12. Is my assumption wrong about what mcs_systemhigh should be or am I > missing something? > > Relevant output from 'semanage fcontext -l' > /var/lib/RUBIXdbms/backups(/.*)? all files > system_u:object_r:rubix_backup_t:s0 Actually, you shouldn't need any of those ifdefs. The gen_context() macro is sensitive to if MLS or MCS is enabled. The first parameter is the first three fields of the context. The second parameter is the MLS label, and there is a third optional parameter to specify the MCS categories for the file (there are no examples in refpolicy). So this is sufficient: /var/lib/RUBIXdbms/backups(/.*)? gen_context(system_u:object_r:rubix_backup_t,mls_systemhigh,mcs_allcats) The thing to note is that gen_context() abstracts away the sensitivity (s0) portion of the label, so there is an mcs_allcats macro. -- Chris PeBenito Tresys Technology, LLC www.tresys.com | oss.tresys.com -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with the words "unsubscribe selinux" without quotes as the message. ^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: mcs_systemhigh use 2010-06-10 11:09 ` Christopher J. PeBenito @ 2010-06-10 11:12 ` Andy Warner 2010-06-10 11:21 ` Christopher J. PeBenito 0 siblings, 1 reply; 7+ messages in thread From: Andy Warner @ 2010-06-10 11:12 UTC (permalink / raw) To: Christopher J. PeBenito; +Cc: selinux On 6/10/2010 7:09 PM, Christopher J. PeBenito wrote: > On Thu, 2010-06-10 at 17:15 +0800, Andy Warner wrote: > >> In the policy for the Trusted RUBIX DBMS, we assign file contexts >> using the following (only one representative dir, 'backups', shown): >> >> ifdef(`enable_mls',` >> /var/lib/RUBIXdbms/backups(/.*)? >> gen_context(system_u:object_r:rubix_backup_t,mls_systemhigh) >> ') >> ifdef(`enable_mcs',` >> /var/lib/RUBIXdbms/backups(/.*)? >> gen_context(system_u:object_r:rubix_backup_t,mcs_systemhigh) >> ') >> >> When using the mls policy, I get the expected level of mls_systemhigh >> (s15:c0.c1023). But when using the targeted policy, I get an >> unexpected value for mcs_systemhigh. I would expect to get >> s0:c0.c1023, but get s0. I have verified this behavior on Fedora 9 and >> 12. Is my assumption wrong about what mcs_systemhigh should be or am I >> missing something? >> >> Relevant output from 'semanage fcontext -l' >> /var/lib/RUBIXdbms/backups(/.*)? all files >> system_u:object_r:rubix_backup_t:s0 >> > Actually, you shouldn't need any of those ifdefs. The gen_context() > macro is sensitive to if MLS or MCS is enabled. The first parameter is > the first three fields of the context. The second parameter is the MLS > label, and there is a third optional parameter to specify the MCS > categories for the file (there are no examples in refpolicy). So this > is sufficient: > > /var/lib/RUBIXdbms/backups(/.*)? gen_context(system_u:object_r:rubix_backup_t,mls_systemhigh,mcs_allcats) > > The thing to note is that gen_context() abstracts away the sensitivity > (s0) portion of the label, so there is an mcs_allcats macro. > Thanks for the reply. So, then is the mcs_systemhigh basically meaningless? -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with the words "unsubscribe selinux" without quotes as the message. ^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: mcs_systemhigh use 2010-06-10 11:12 ` Andy Warner @ 2010-06-10 11:21 ` Christopher J. PeBenito 2010-06-10 16:48 ` Andy Warner 0 siblings, 1 reply; 7+ messages in thread From: Christopher J. PeBenito @ 2010-06-10 11:21 UTC (permalink / raw) To: Andy Warner; +Cc: selinux On Thu, 2010-06-10 at 19:12 +0800, Andy Warner wrote: > On 6/10/2010 7:09 PM, Christopher J. PeBenito wrote: > > On Thu, 2010-06-10 at 17:15 +0800, Andy Warner wrote: > > > >> In the policy for the Trusted RUBIX DBMS, we assign file contexts > >> using the following (only one representative dir, 'backups', shown): > >> > >> ifdef(`enable_mls',` > >> /var/lib/RUBIXdbms/backups(/.*)? > >> gen_context(system_u:object_r:rubix_backup_t,mls_systemhigh) > >> ') > >> ifdef(`enable_mcs',` > >> /var/lib/RUBIXdbms/backups(/.*)? > >> gen_context(system_u:object_r:rubix_backup_t,mcs_systemhigh) > >> ') > >> > >> When using the mls policy, I get the expected level of mls_systemhigh > >> (s15:c0.c1023). But when using the targeted policy, I get an > >> unexpected value for mcs_systemhigh. I would expect to get > >> s0:c0.c1023, but get s0. I have verified this behavior on Fedora 9 and > >> 12. Is my assumption wrong about what mcs_systemhigh should be or am I > >> missing something? > >> > >> Relevant output from 'semanage fcontext -l' > >> /var/lib/RUBIXdbms/backups(/.*)? all files > >> system_u:object_r:rubix_backup_t:s0 > >> > > Actually, you shouldn't need any of those ifdefs. The gen_context() > > macro is sensitive to if MLS or MCS is enabled. The first parameter is > > the first three fields of the context. The second parameter is the MLS > > label, and there is a third optional parameter to specify the MCS > > categories for the file (there are no examples in refpolicy). So this > > is sufficient: > > > > /var/lib/RUBIXdbms/backups(/.*)? gen_context(system_u:object_r:rubix_backup_t,mls_systemhigh,mcs_allcats) > > > > The thing to note is that gen_context() abstracts away the sensitivity > > (s0) portion of the label, so there is an mcs_allcats macro. > > > > Thanks for the reply. So, then is the mcs_systemhigh basically meaningless? Its useful for range transitions, eg: range_transition foo_t bar_t s0-mcs_systemhigh; Perhaps we should consider changing the gen_context() macro to accept mcs_systemhigh instead of mcs_allcats, for consistency. -- Chris PeBenito Tresys Technology, LLC www.tresys.com | oss.tresys.com -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with the words "unsubscribe selinux" without quotes as the message. ^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: mcs_systemhigh use 2010-06-10 11:21 ` Christopher J. PeBenito @ 2010-06-10 16:48 ` Andy Warner 2010-06-10 17:50 ` Christopher J. PeBenito 0 siblings, 1 reply; 7+ messages in thread From: Andy Warner @ 2010-06-10 16:48 UTC (permalink / raw) To: Christopher J. PeBenito; +Cc: selinux On 6/10/2010 7:21 PM, Christopher J. PeBenito wrote: > On Thu, 2010-06-10 at 19:12 +0800, Andy Warner wrote: > >> On 6/10/2010 7:09 PM, Christopher J. PeBenito wrote: >> >>> On Thu, 2010-06-10 at 17:15 +0800, Andy Warner wrote: >>> >>> >>>> In the policy for the Trusted RUBIX DBMS, we assign file contexts >>>> using the following (only one representative dir, 'backups', shown): >>>> >>>> ifdef(`enable_mls',` >>>> /var/lib/RUBIXdbms/backups(/.*)? >>>> gen_context(system_u:object_r:rubix_backup_t,mls_systemhigh) >>>> ') >>>> ifdef(`enable_mcs',` >>>> /var/lib/RUBIXdbms/backups(/.*)? >>>> gen_context(system_u:object_r:rubix_backup_t,mcs_systemhigh) >>>> ') >>>> >>>> When using the mls policy, I get the expected level of mls_systemhigh >>>> (s15:c0.c1023). But when using the targeted policy, I get an >>>> unexpected value for mcs_systemhigh. I would expect to get >>>> s0:c0.c1023, but get s0. I have verified this behavior on Fedora 9 and >>>> 12. Is my assumption wrong about what mcs_systemhigh should be or am I >>>> missing something? >>>> >>>> Relevant output from 'semanage fcontext -l' >>>> /var/lib/RUBIXdbms/backups(/.*)? all files >>>> system_u:object_r:rubix_backup_t:s0 >>>> >>>> >>> Actually, you shouldn't need any of those ifdefs. The gen_context() >>> macro is sensitive to if MLS or MCS is enabled. The first parameter is >>> the first three fields of the context. The second parameter is the MLS >>> label, and there is a third optional parameter to specify the MCS >>> categories for the file (there are no examples in refpolicy). So this >>> is sufficient: >>> >>> /var/lib/RUBIXdbms/backups(/.*)? gen_context(system_u:object_r:rubix_backup_t,mls_systemhigh,mcs_allcats) >>> >>> The thing to note is that gen_context() abstracts away the sensitivity >>> (s0) portion of the label, so there is an mcs_allcats macro. >>> >>> >> Thanks for the reply. So, then is the mcs_systemhigh basically meaningless? >> > Its useful for range transitions, eg: > > range_transition foo_t bar_t s0-mcs_systemhigh; > In this case, whill mcs_systemhigh evaluate to s0 or s0:c0.c1023? We use the following to allow a transition to system high, expecting for mcs that to be s0:c0.c1023. Should we expect that behavior or should we use mcs_allcats here as well? ifdef(`enable_mls',` range_transition $1 $2:process mls_systemhigh; ') ifdef(`enable_mcs',` range_transition $1 $2:process mcs_systemhigh; ') > Perhaps we should consider changing the gen_context() macro to accept > mcs_systemhigh instead of mcs_allcats, for consistency. > At first glance it would sure seem mcs_systemhigh and mcs_allcats would (should?) evaluate to the same thing. -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with the words "unsubscribe selinux" without quotes as the message. ^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: mcs_systemhigh use 2010-06-10 16:48 ` Andy Warner @ 2010-06-10 17:50 ` Christopher J. PeBenito 2010-06-10 17:58 ` Andy Warner 0 siblings, 1 reply; 7+ messages in thread From: Christopher J. PeBenito @ 2010-06-10 17:50 UTC (permalink / raw) To: Andy Warner; +Cc: selinux On Fri, 2010-06-11 at 00:48 +0800, Andy Warner wrote: > > On 6/10/2010 7:21 PM, Christopher J. PeBenito wrote: > > On Thu, 2010-06-10 at 19:12 +0800, Andy Warner wrote: > > > >> On 6/10/2010 7:09 PM, Christopher J. PeBenito wrote: > >> > >>> On Thu, 2010-06-10 at 17:15 +0800, Andy Warner wrote: > >>> > >>> > >>>> In the policy for the Trusted RUBIX DBMS, we assign file contexts > >>>> using the following (only one representative dir, 'backups', shown): > >>>> > >>>> ifdef(`enable_mls',` > >>>> /var/lib/RUBIXdbms/backups(/.*)? > >>>> gen_context(system_u:object_r:rubix_backup_t,mls_systemhigh) > >>>> ') > >>>> ifdef(`enable_mcs',` > >>>> /var/lib/RUBIXdbms/backups(/.*)? > >>>> gen_context(system_u:object_r:rubix_backup_t,mcs_systemhigh) > >>>> ') > >>>> > >>>> When using the mls policy, I get the expected level of mls_systemhigh > >>>> (s15:c0.c1023). But when using the targeted policy, I get an > >>>> unexpected value for mcs_systemhigh. I would expect to get > >>>> s0:c0.c1023, but get s0. I have verified this behavior on Fedora 9 and > >>>> 12. Is my assumption wrong about what mcs_systemhigh should be or am I > >>>> missing something? > >>>> > >>>> Relevant output from 'semanage fcontext -l' > >>>> /var/lib/RUBIXdbms/backups(/.*)? all files > >>>> system_u:object_r:rubix_backup_t:s0 > >>>> > >>>> > >>> Actually, you shouldn't need any of those ifdefs. The gen_context() > >>> macro is sensitive to if MLS or MCS is enabled. The first parameter is > >>> the first three fields of the context. The second parameter is the MLS > >>> label, and there is a third optional parameter to specify the MCS > >>> categories for the file (there are no examples in refpolicy). So this > >>> is sufficient: > >>> > >>> /var/lib/RUBIXdbms/backups(/.*)? gen_context(system_u:object_r:rubix_backup_t,mls_systemhigh,mcs_allcats) > >>> > >>> The thing to note is that gen_context() abstracts away the sensitivity > >>> (s0) portion of the label, so there is an mcs_allcats macro. > >>> > >>> > >> Thanks for the reply. So, then is the mcs_systemhigh basically meaningless? > >> > > Its useful for range transitions, eg: > > > > range_transition foo_t bar_t s0-mcs_systemhigh; > > > In this case, whill mcs_systemhigh evaluate to s0 or s0:c0.c1023? The latter. > We use the following to allow a transition to system high, expecting for > mcs that to be s0:c0.c1023. Should we expect that behavior or should we > use mcs_allcats here as well? > > ifdef(`enable_mls',` > range_transition $1 $2:process mls_systemhigh; > ') > ifdef(`enable_mcs',` > range_transition $1 $2:process mcs_systemhigh; > ') These are valid. > > Perhaps we should consider changing the gen_context() macro to accept > > mcs_systemhigh instead of mcs_allcats, for consistency. > > > At first glance it would sure seem mcs_systemhigh and mcs_allcats would > (should?) evaluate to the same thing. They don't. mcs_systemhigh = s0:c0.c1024 mcs_allcats = c0.c1024 Which is why I'm saying we should probably get rid of mcs_allcats and fix gen_context() to not add in the "s0:" for MCS. Then we wouldn't have this confusion. -- Chris PeBenito Tresys Technology, LLC www.tresys.com | oss.tresys.com -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with the words "unsubscribe selinux" without quotes as the message. ^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: mcs_systemhigh use 2010-06-10 17:50 ` Christopher J. PeBenito @ 2010-06-10 17:58 ` Andy Warner 0 siblings, 0 replies; 7+ messages in thread From: Andy Warner @ 2010-06-10 17:58 UTC (permalink / raw) To: Christopher J. PeBenito; +Cc: selinux On 6/11/2010 1:50 AM, Christopher J. PeBenito wrote: > On Fri, 2010-06-11 at 00:48 +0800, Andy Warner wrote: > >> On 6/10/2010 7:21 PM, Christopher J. PeBenito wrote: >> >>> On Thu, 2010-06-10 at 19:12 +0800, Andy Warner wrote: >>> >>> >>>> On 6/10/2010 7:09 PM, Christopher J. PeBenito wrote: >>>> >>>> >>>>> On Thu, 2010-06-10 at 17:15 +0800, Andy Warner wrote: >>>>> >>>>> >>>>> >>>>>> In the policy for the Trusted RUBIX DBMS, we assign file contexts >>>>>> using the following (only one representative dir, 'backups', shown): >>>>>> >>>>>> ifdef(`enable_mls',` >>>>>> /var/lib/RUBIXdbms/backups(/.*)? >>>>>> gen_context(system_u:object_r:rubix_backup_t,mls_systemhigh) >>>>>> ') >>>>>> ifdef(`enable_mcs',` >>>>>> /var/lib/RUBIXdbms/backups(/.*)? >>>>>> gen_context(system_u:object_r:rubix_backup_t,mcs_systemhigh) >>>>>> ') >>>>>> >>>>>> When using the mls policy, I get the expected level of mls_systemhigh >>>>>> (s15:c0.c1023). But when using the targeted policy, I get an >>>>>> unexpected value for mcs_systemhigh. I would expect to get >>>>>> s0:c0.c1023, but get s0. I have verified this behavior on Fedora 9 and >>>>>> 12. Is my assumption wrong about what mcs_systemhigh should be or am I >>>>>> missing something? >>>>>> >>>>>> Relevant output from 'semanage fcontext -l' >>>>>> /var/lib/RUBIXdbms/backups(/.*)? all files >>>>>> system_u:object_r:rubix_backup_t:s0 >>>>>> >>>>>> >>>>>> >>>>> Actually, you shouldn't need any of those ifdefs. The gen_context() >>>>> macro is sensitive to if MLS or MCS is enabled. The first parameter is >>>>> the first three fields of the context. The second parameter is the MLS >>>>> label, and there is a third optional parameter to specify the MCS >>>>> categories for the file (there are no examples in refpolicy). So this >>>>> is sufficient: >>>>> >>>>> /var/lib/RUBIXdbms/backups(/.*)? gen_context(system_u:object_r:rubix_backup_t,mls_systemhigh,mcs_allcats) >>>>> >>>>> The thing to note is that gen_context() abstracts away the sensitivity >>>>> (s0) portion of the label, so there is an mcs_allcats macro. >>>>> >>>>> >>>>> >>>> Thanks for the reply. So, then is the mcs_systemhigh basically meaningless? >>>> >>>> >>> Its useful for range transitions, eg: >>> >>> range_transition foo_t bar_t s0-mcs_systemhigh; >>> >>> >> In this case, whill mcs_systemhigh evaluate to s0 or s0:c0.c1023? >> > The latter. > > >> We use the following to allow a transition to system high, expecting for >> mcs that to be s0:c0.c1023. Should we expect that behavior or should we >> use mcs_allcats here as well? >> >> ifdef(`enable_mls',` >> range_transition $1 $2:process mls_systemhigh; >> ') >> ifdef(`enable_mcs',` >> range_transition $1 $2:process mcs_systemhigh; >> ') >> > These are valid. > > >>> Perhaps we should consider changing the gen_context() macro to accept >>> mcs_systemhigh instead of mcs_allcats, for consistency. >>> >>> >> At first glance it would sure seem mcs_systemhigh and mcs_allcats would >> (should?) evaluate to the same thing. >> > They don't. > > mcs_systemhigh = s0:c0.c1024 > mcs_allcats = c0.c1024 > > Which is why I'm saying we should probably get rid of mcs_allcats and > fix gen_context() to not add in the "s0:" for MCS. Then we wouldn't > have this confusion. > Ok, I get it now, and agree with you. Thanks for your help. -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with the words "unsubscribe selinux" without quotes as the message. ^ permalink raw reply [flat|nested] 7+ messages in thread
end of thread, other threads:[~2010-06-10 17:58 UTC | newest] Thread overview: 7+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2010-06-10 9:15 mcs_systemhigh use Andy Warner 2010-06-10 11:09 ` Christopher J. PeBenito 2010-06-10 11:12 ` Andy Warner 2010-06-10 11:21 ` Christopher J. PeBenito 2010-06-10 16:48 ` Andy Warner 2010-06-10 17:50 ` Christopher J. PeBenito 2010-06-10 17:58 ` Andy Warner
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.