* I am working to further shrink the size of policy in Fedora 17.
@ 2011-10-07 18:24 Daniel J Walsh
2011-10-12 13:40 ` Christopher J. PeBenito
0 siblings, 1 reply; 8+ messages in thread
From: Daniel J Walsh @ 2011-10-07 18:24 UTC (permalink / raw)
To: SELinux
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Right now, every domain that transitions to another domain gets the
following rule written.
dontaudit SOURCE TARGET : process { noatsecure siginh rlimitinh } ;
In Fedora 17 policy right now we have 2152 rules, out of Dontaudit:
9415
sesearch --dontaudit -p noatsecure | wc -l
2152
We could rewrite this with one rule.
dontaudit domain domain:process { noatsecure siginh rlimitinh } ;
Of course this is more lenient then what we have now, although since
it is dontaudit rules, not sure it matters.
Comments?
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
iEYEARECAAYFAk6PQ80ACgkQrlYvE4MpobMn5ACeJMpRnEYe5nvpyWjhKbqpANw4
kB8AnA0ORPBkKS6Ww0AWzedMAnD+Teth
=Q6g9
-----END PGP SIGNATURE-----
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: I am working to further shrink the size of policy in Fedora 17.
2011-10-07 18:24 I am working to further shrink the size of policy in Fedora 17 Daniel J Walsh
@ 2011-10-12 13:40 ` Christopher J. PeBenito
2011-10-12 14:15 ` Daniel J Walsh
0 siblings, 1 reply; 8+ messages in thread
From: Christopher J. PeBenito @ 2011-10-12 13:40 UTC (permalink / raw)
To: Daniel J Walsh; +Cc: SELinux
On 10/07/11 14:24, Daniel J Walsh wrote:
> Right now, every domain that transitions to another domain gets the
> following rule written.
>
> dontaudit SOURCE TARGET : process { noatsecure siginh rlimitinh } ;
>
> In Fedora 17 policy right now we have 2152 rules, out of Dontaudit:
> 9415
>
>
> sesearch --dontaudit -p noatsecure | wc -l
> 2152
>
> We could rewrite this with one rule.
>
> dontaudit domain domain:process { noatsecure siginh rlimitinh } ;
>
> Of course this is more lenient then what we have now, although since
> it is dontaudit rules, not sure it matters.
>
> Comments?
I'm on the fence. On one hand, I hate to overspecify the policy, but on the other hand, these perms can only be hit on a domain transition. How much does this save?
--
Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: I am working to further shrink the size of policy in Fedora 17.
2011-10-12 13:40 ` Christopher J. PeBenito
@ 2011-10-12 14:15 ` Daniel J Walsh
2011-10-12 17:37 ` Christopher J. PeBenito
0 siblings, 1 reply; 8+ messages in thread
From: Daniel J Walsh @ 2011-10-12 14:15 UTC (permalink / raw)
To: Christopher J. PeBenito; +Cc: SELinux
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 10/12/2011 09:40 AM, Christopher J. PeBenito wrote:
> On 10/07/11 14:24, Daniel J Walsh wrote:
>> Right now, every domain that transitions to another domain gets
>> the following rule written.
>>
>> dontaudit SOURCE TARGET : process { noatsecure siginh rlimitinh }
>> ;
>>
>> In Fedora 17 policy right now we have 2152 rules, out of
>> Dontaudit: 9415
>>
>>
>> sesearch --dontaudit -p noatsecure | wc -l 2152
>>
>> We could rewrite this with one rule.
>>
>> dontaudit domain domain:process { noatsecure siginh rlimitinh }
>> ;
>>
>> Of course this is more lenient then what we have now, although
>> since it is dontaudit rules, not sure it matters.
>>
>> Comments?
>
> I'm on the fence. On one hand, I hate to overspecify the policy,
> but on the other hand, these perms can only be hit on a domain
> transition. How much does this save?
>
2000/90000
2% of the size of policy.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
iEYEARECAAYFAk6VoOYACgkQrlYvE4MpobP1owCfTdsEIG7MMy4PyOt05FfeANYx
U6UAmgKEgYIoER1S9qa7Ev3hxPH/73H4
=+vp+
-----END PGP SIGNATURE-----
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: I am working to further shrink the size of policy in Fedora 17.
2011-10-12 14:15 ` Daniel J Walsh
@ 2011-10-12 17:37 ` Christopher J. PeBenito
2011-10-12 18:10 ` Daniel J Walsh
0 siblings, 1 reply; 8+ messages in thread
From: Christopher J. PeBenito @ 2011-10-12 17:37 UTC (permalink / raw)
To: Daniel J Walsh; +Cc: SELinux
On 10/12/11 10:15, Daniel J Walsh wrote:
> On 10/12/2011 09:40 AM, Christopher J. PeBenito wrote:
>> On 10/07/11 14:24, Daniel J Walsh wrote:
>>> Right now, every domain that transitions to another domain gets
>>> the following rule written.
>>>
>>> dontaudit SOURCE TARGET : process { noatsecure siginh rlimitinh }
>>> ;
>>>
>>> In Fedora 17 policy right now we have 2152 rules, out of
>>> Dontaudit: 9415
>>>
>>>
>>> sesearch --dontaudit -p noatsecure | wc -l 2152
>>>
>>> We could rewrite this with one rule.
>>>
>>> dontaudit domain domain:process { noatsecure siginh rlimitinh }
>>> ;
>>>
>>> Of course this is more lenient then what we have now, although
>>> since it is dontaudit rules, not sure it matters.
>>>
>>> Comments?
>
>> I'm on the fence. On one hand, I hate to overspecify the policy,
>> but on the other hand, these perms can only be hit on a domain
>> transition. How much does this save?
>
>
> 2000/90000
>
> 2% of the size of policy.
Based on my test of all Refpolicy modules compiled in, the size went from 4687381 to 4667101, a 20kB difference. If someone was trying to squeeze everything out for an embedded system policy, I could see this change, but otherwise, it doesn't seem very compelling.
--
Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: I am working to further shrink the size of policy in Fedora 17.
2011-10-12 17:37 ` Christopher J. PeBenito
@ 2011-10-12 18:10 ` Daniel J Walsh
2011-10-12 18:45 ` Christopher J. PeBenito
0 siblings, 1 reply; 8+ messages in thread
From: Daniel J Walsh @ 2011-10-12 18:10 UTC (permalink / raw)
To: Christopher J. PeBenito; +Cc: SELinux
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 10/12/2011 01:37 PM, Christopher J. PeBenito wrote:
> On 10/12/11 10:15, Daniel J Walsh wrote:
>> On 10/12/2011 09:40 AM, Christopher J. PeBenito wrote:
>>> On 10/07/11 14:24, Daniel J Walsh wrote:
>>>> Right now, every domain that transitions to another domain
>>>> gets the following rule written.
>>>>
>>>> dontaudit SOURCE TARGET : process { noatsecure siginh
>>>> rlimitinh } ;
>>>>
>>>> In Fedora 17 policy right now we have 2152 rules, out of
>>>> Dontaudit: 9415
>>>>
>>>>
>>>> sesearch --dontaudit -p noatsecure | wc -l 2152
>>>>
>>>> We could rewrite this with one rule.
>>>>
>>>> dontaudit domain domain:process { noatsecure siginh rlimitinh
>>>> } ;
>>>>
>>>> Of course this is more lenient then what we have now,
>>>> although since it is dontaudit rules, not sure it matters.
>>>>
>>>> Comments?
>>
>>> I'm on the fence. On one hand, I hate to overspecify the
>>> policy, but on the other hand, these perms can only be hit on a
>>> domain transition. How much does this save?
>>
>>
>> 2000/90000
>>
>> 2% of the size of policy.
>
> Based on my test of all Refpolicy modules compiled in, the size
> went from 4687381 to 4667101, a 20kB difference. If someone was
> trying to squeeze everything out for an embedded system policy, I
> could see this change, but otherwise, it doesn't seem very
> compelling.
>
That is because you have not already shrunk your policy to the degree
that Fedora has. F17 is down to this.
seinfo
Statistics for policy file: /etc/selinux/targeted/policy/policy.26
Policy Version & Type: v.26 (binary, mls)
Classes: 82 Permissions: 241
Sensitivities: 1 Categories: 1024
Types: 3546 Attributes: 291
Users: 9 Roles: 13
Booleans: 203 Cond. Expr.: 240
Allow: 83205 Neverallow: 0
Auditallow: 10 Dontaudit: 6079
Type_trans: 8632 Type_change: 116
Type_member: 36 Role allow: 23
Role_trans: 287 Range_trans: 3068
Constraints: 81 Validatetrans: 0
Initial SIDs: 27 Fs_use: 22
Genfscon: 85 Portcon: 429
Netifcon: 0 Nodecon: 0
Permissives: 33 Polcap: 2
With I would figure many more domains confined.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
iEYEARECAAYFAk6V2AUACgkQrlYvE4MpobOj+ACffF2NDUP/RDI1ccuWGi1/NxYn
oVIAn1G3o2LkWpKpihU+kBt9GAH1idev
=K573
-----END PGP SIGNATURE-----
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: I am working to further shrink the size of policy in Fedora 17.
2011-10-12 18:10 ` Daniel J Walsh
@ 2011-10-12 18:45 ` Christopher J. PeBenito
2011-10-12 18:50 ` Daniel J Walsh
2011-10-12 19:06 ` Daniel J Walsh
0 siblings, 2 replies; 8+ messages in thread
From: Christopher J. PeBenito @ 2011-10-12 18:45 UTC (permalink / raw)
To: Daniel J Walsh; +Cc: SELinux
On 10/12/11 14:10, Daniel J Walsh wrote:
> On 10/12/2011 01:37 PM, Christopher J. PeBenito wrote:
>> On 10/12/11 10:15, Daniel J Walsh wrote:
>>> On 10/12/2011 09:40 AM, Christopher J. PeBenito wrote:
>>>> On 10/07/11 14:24, Daniel J Walsh wrote:
>>>>> Right now, every domain that transitions to another domain
>>>>> gets the following rule written.
>>>>>
>>>>> dontaudit SOURCE TARGET : process { noatsecure siginh
>>>>> rlimitinh } ;
>>>>>
>>>>> In Fedora 17 policy right now we have 2152 rules, out of
>>>>> Dontaudit: 9415
>>>>>
>>>>>
>>>>> sesearch --dontaudit -p noatsecure | wc -l 2152
>>>>>
>>>>> We could rewrite this with one rule.
>>>>>
>>>>> dontaudit domain domain:process { noatsecure siginh rlimitinh
>>>>> } ;
>>>>>
>>>>> Of course this is more lenient then what we have now,
>>>>> although since it is dontaudit rules, not sure it matters.
>>>>>
>>>>> Comments?
>>>
>>>> I'm on the fence. On one hand, I hate to overspecify the
>>>> policy, but on the other hand, these perms can only be hit on a
>>>> domain transition. How much does this save?
>>>
>>>
>>> 2000/90000
>>>
>>> 2% of the size of policy.
>
>> Based on my test of all Refpolicy modules compiled in, the size
>> went from 4687381 to 4667101, a 20kB difference. If someone was
>> trying to squeeze everything out for an embedded system policy, I
>> could see this change, but otherwise, it doesn't seem very
>> compelling.
>
> That is because you have not already shrunk your policy to the degree
> that Fedora has. F17 is down to this.
[...]
> Allow: 83205 Neverallow: 0
> Auditallow: 10 Dontaudit: 6079
I don't understand. The change in Refpolicy was 1690 dontaudit rules. If thats a 20kB change in Refpolicy, the 2151 rule change in the Fedora policy would probably be ~25kB. What is the current size of the Fedora policy (policy.26 on disk)?
--
Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: I am working to further shrink the size of policy in Fedora 17.
2011-10-12 18:45 ` Christopher J. PeBenito
@ 2011-10-12 18:50 ` Daniel J Walsh
2011-10-12 19:06 ` Daniel J Walsh
1 sibling, 0 replies; 8+ messages in thread
From: Daniel J Walsh @ 2011-10-12 18:50 UTC (permalink / raw)
To: Christopher J. PeBenito; +Cc: SELinux
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 10/12/2011 02:45 PM, Christopher J. PeBenito wrote:
> On 10/12/11 14:10, Daniel J Walsh wrote:
>> On 10/12/2011 01:37 PM, Christopher J. PeBenito wrote:
>>> On 10/12/11 10:15, Daniel J Walsh wrote:
>>>> On 10/12/2011 09:40 AM, Christopher J. PeBenito wrote:
>>>>> On 10/07/11 14:24, Daniel J Walsh wrote:
>>>>>> Right now, every domain that transitions to another
>>>>>> domain gets the following rule written.
>>>>>>
>>>>>> dontaudit SOURCE TARGET : process { noatsecure siginh
>>>>>> rlimitinh } ;
>>>>>>
>>>>>> In Fedora 17 policy right now we have 2152 rules, out of
>>>>>> Dontaudit: 9415
>>>>>>
>>>>>>
>>>>>> sesearch --dontaudit -p noatsecure | wc -l 2152
>>>>>>
>>>>>> We could rewrite this with one rule.
>>>>>>
>>>>>> dontaudit domain domain:process { noatsecure siginh
>>>>>> rlimitinh } ;
>>>>>>
>>>>>> Of course this is more lenient then what we have now,
>>>>>> although since it is dontaudit rules, not sure it
>>>>>> matters.
>>>>>>
>>>>>> Comments?
>>>>
>>>>> I'm on the fence. On one hand, I hate to overspecify the
>>>>> policy, but on the other hand, these perms can only be hit
>>>>> on a domain transition. How much does this save?
>>>>
>>>>
>>>> 2000/90000
>>>>
>>>> 2% of the size of policy.
>>
>>> Based on my test of all Refpolicy modules compiled in, the
>>> size went from 4687381 to 4667101, a 20kB difference. If
>>> someone was trying to squeeze everything out for an embedded
>>> system policy, I could see this change, but otherwise, it
>>> doesn't seem very compelling.
>>
>> That is because you have not already shrunk your policy to the
>> degree that Fedora has. F17 is down to this.
> [...]
>> Allow: 83205 Neverallow: 0 Auditallow:
>> 10 Dontaudit: 6079
>
> I don't understand. The change in Refpolicy was 1690 dontaudit
> rules. If thats a 20kB change in Refpolicy, the 2151 rule change
> in the Fedora policy would probably be ~25kB. What is the current
> size of the Fedora policy (policy.26 on disk)?
>
I just updated people.redhat.com and the libra.te policy
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
iEYEARECAAYFAk6V4V4ACgkQrlYvE4MpobPMtACfRwh0qPmXDPc2+HXFO0bW3Hdx
aRIAoOnt5iqmrEZ0gAr/s+Vqlh2I0PbG
=ZkPq
-----END PGP SIGNATURE-----
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: I am working to further shrink the size of policy in Fedora 17.
2011-10-12 18:45 ` Christopher J. PeBenito
2011-10-12 18:50 ` Daniel J Walsh
@ 2011-10-12 19:06 ` Daniel J Walsh
1 sibling, 0 replies; 8+ messages in thread
From: Daniel J Walsh @ 2011-10-12 19:06 UTC (permalink / raw)
To: Christopher J. PeBenito; +Cc: SELinux
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 10/12/2011 02:45 PM, Christopher J. PeBenito wrote:
> On 10/12/11 14:10, Daniel J Walsh wrote:
>> On 10/12/2011 01:37 PM, Christopher J. PeBenito wrote:
>>> On 10/12/11 10:15, Daniel J Walsh wrote:
>>>> On 10/12/2011 09:40 AM, Christopher J. PeBenito wrote:
>>>>> On 10/07/11 14:24, Daniel J Walsh wrote:
>>>>>> Right now, every domain that transitions to another
>>>>>> domain gets the following rule written.
>>>>>>
>>>>>> dontaudit SOURCE TARGET : process { noatsecure siginh
>>>>>> rlimitinh } ;
>>>>>>
>>>>>> In Fedora 17 policy right now we have 2152 rules, out of
>>>>>> Dontaudit: 9415
>>>>>>
>>>>>>
>>>>>> sesearch --dontaudit -p noatsecure | wc -l 2152
>>>>>>
>>>>>> We could rewrite this with one rule.
>>>>>>
>>>>>> dontaudit domain domain:process { noatsecure siginh
>>>>>> rlimitinh } ;
>>>>>>
>>>>>> Of course this is more lenient then what we have now,
>>>>>> although since it is dontaudit rules, not sure it
>>>>>> matters.
>>>>>>
>>>>>> Comments?
>>>>
>>>>> I'm on the fence. On one hand, I hate to overspecify the
>>>>> policy, but on the other hand, these perms can only be hit
>>>>> on a domain transition. How much does this save?
>>>>
>>>>
>>>> 2000/90000
>>>>
>>>> 2% of the size of policy.
>>
>>> Based on my test of all Refpolicy modules compiled in, the
>>> size went from 4687381 to 4667101, a 20kB difference. If
>>> someone was trying to squeeze everything out for an embedded
>>> system policy, I could see this change, but otherwise, it
>>> doesn't seem very compelling.
>>
>> That is because you have not already shrunk your policy to the
>> degree that Fedora has. F17 is down to this.
> [...]
>> Allow: 83205 Neverallow: 0 Auditallow:
>> 10 Dontaudit: 6079
>
> I don't understand. The change in Refpolicy was 1690 dontaudit
> rules. If thats a 20kB change in Refpolicy, the 2151 rule change
> in the Fedora policy would probably be ~25kB. What is the current
> size of the Fedora policy (policy.26 on disk)?
>
ls -l /etc/selinux/targeted/policy/policy.26
- -rw-r--r--. 1 root root 1993514 Oct 11 11:14
/etc/selinux/targeted/policy/policy.26
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
iEYEARECAAYFAk6V5SgACgkQrlYvE4MpobMPbwCgpskAh3I/i7UX2dLUCk6y6tsY
uI4An1cbF0C9rPG3M0P4dKus/Mi1zGE3
=WTYs
-----END PGP SIGNATURE-----
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 8+ messages in thread
end of thread, other threads:[~2011-10-12 19:06 UTC | newest]
Thread overview: 8+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2011-10-07 18:24 I am working to further shrink the size of policy in Fedora 17 Daniel J Walsh
2011-10-12 13:40 ` Christopher J. PeBenito
2011-10-12 14:15 ` Daniel J Walsh
2011-10-12 17:37 ` Christopher J. PeBenito
2011-10-12 18:10 ` Daniel J Walsh
2011-10-12 18:45 ` Christopher J. PeBenito
2011-10-12 18:50 ` Daniel J Walsh
2011-10-12 19:06 ` Daniel J Walsh
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.