From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from jazzswing.ncsc.mil (jazzswing.ncsc.mil [144.51.68.65]) by tycho.ncsc.mil (8.12.8/8.12.8) with ESMTP id i3BDaRRb003981 for ; Sun, 11 Apr 2004 09:36:27 -0400 (EDT) Received: from jazzswing.ncsc.mil (localhost [127.0.0.1]) by jazzswing.ncsc.mil with ESMTP id i3BDYAUZ017641 for ; Sun, 11 Apr 2004 13:34:10 GMT Received: from omta10.mta.everyone.net (sitemail2.everyone.net [216.200.145.36]) by jazzswing.ncsc.mil with ESMTP id i3BDYAmT017638 for ; Sun, 11 Apr 2004 13:34:10 GMT Date: Sun, 11 Apr 2004 21:35:51 +0800 Subject: Re: booting in enforcing mode Message-ID: <7fd841b7e6c6f8d9ef80c9a1e2f9eb62@debian> MIME-Version: 1.0 (Generated by Pantomime 1.1.2) From: Rogelio Serrano To: russell@coker.com.au Cc: selinux@tycho.nsa.gov In-Reply-To: <200404112023.36970.russell@coker.com.au> Content-Type: text/plain; charset="us-ascii"; format="flowed" Sender: owner-selinux@tycho.nsa.gov List-Id: selinux@tycho.nsa.gov On 2004-04-11 18:23:36 +0800 Russell Coker wrote: > On Sun, 11 Apr 2004 03:28, Rogelio Serrano > wrote: >> I rewrote mount, syslogd, and klogd to have the bare >> minimum priviledges. > > What did you change? > Im using an lfs derived distro. it uses uClibc. These are all my own versions of those utilities. useful only from boot scripts. mount is just a wrapper around the mount syscall. and unmount also a wrapper around the unmount syscall. they dont need fstab or /proc/mounts. the original versions are causing too much noise in the logs. i was having lot of difficulty customizing the policy. i was reading the source code to find out which permissions were needed and which were not. i found the original programs to be too complicated for me to read so I rewrote the easy to rewrite programs so i can focus on init, login and agetty. im using busybox for most of the network stuff and logging. in enforcing mode i was having a lot of difficulty to run syslogd in the proper context. i was having difficulty with the busybox code so i ripped out the relevant parts and built my own syslogd from that. same for klogd. i then tested these programs and took out some code that caused problems. Im developing a non standard system. so i can not use the setools. my only option is to use very simple programs that are easy to audit and match to the policy which is a stripped down version of the default policy. One area im having a lot irritation with is the hotplug scripts. everytime they run bash opens /proc/kmem /dev/random /dev/pts /dev/ptmx and countless other devices and files that is not even mentioned anywhere in the relevant sources. now i dont know which to allow and which to deny. so now im going to write small prgrams to replace the scripts. over all my strategy is to replace or customise programs to conform to an extermely stringent policy. seems fater that way. -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with the words "unsubscribe selinux" without quotes as the message.