Re: booting in enforcing mode

[Rogelio Serrano <rogelio@smsglobal.net>]

On 2004-04-11 18:23:36 +0800 Russell Coker 
<russell@coker.com.au> wrote:

> On Sun, 11 Apr 2004 03:28, Rogelio Serrano 
> <rogelio@smsglobal.net> wrote:
>> I rewrote mount, syslogd, and klogd to have the bare
>> minimum priviledges.
> 
> What did you change?
> 

Im using an lfs derived distro. it uses uClibc.

These are all my own versions of those utilities. useful only 
from boot scripts. mount is just a wrapper around the mount 
syscall. and unmount also a wrapper around the unmount syscall. 
they dont need fstab or /proc/mounts. the original versions are 
causing too much noise in the logs. i was having lot of 
difficulty customizing the policy. i was reading the source 
code to find out which permissions were needed and which were 
not. i found the original programs to be too complicated for me 
to read so I rewrote the easy to rewrite programs so i can 
focus on init, login and agetty.

im using busybox for most of the network stuff and logging. in 
enforcing mode i was having a lot of difficulty to run syslogd 
in the proper context. i was having difficulty with the busybox 
code so i ripped out the relevant parts and built my own 
syslogd from that. same for klogd. i then tested these programs 
and took out some code that caused problems.

Im developing a non standard system. so i can not use the 
setools. my only option is to use very simple programs that are 
easy to audit  and match to the policy which is a stripped down 
version of the default policy.

One area im having a lot irritation with is the hotplug 
scripts. everytime they run bash opens /proc/kmem /dev/random 
/dev/pts /dev/ptmx and countless other devices and files that 
is not even mentioned anywhere in the relevant sources. now i 
dont know which to allow and which to deny. so now im going to 
write small prgrams to replace the scripts.

over all my strategy is to replace or customise programs to 
conform to an extermely stringent policy.  seems fater that 
way.


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.