Re: Are the reference policy abstractions the right ones?

[James Morris <jmorris@namei.org>]

On Thu, 11 Oct 2007, Karl MacMillan wrote:

> So - I'd like to hear from some other people. Are these ideas worth
> pursuing? The proposals:
> 
> 1) remove the distinction between attributes / types.
> 2) allow nested types / attributes.
> 3) type_class / type_group
> 4) exceptions

I think moving to a general OO model at a higher level is desirable, and 
that we need to go beyond simply 'type' in #3 and look at OO classes which 
encapsulate all SELinux-related attributes (permissions, labeling rules, 
network policy, booleans etc).

People are increasingly utilizing containers/VMs/appliances to manage and 
isolate their applications, and I think that this is also a means for us 
to provide higher-level SELinux abstractions.

With comprehensive SELinux classes, we could:

- Bind security classes to various levels of system abstraction, and thus 
  bind security objects to a variety of types of encapsulating objects 
  (e.g. RPM, VM, container, tarball, standalone file);

- Modify classes via inheritance (already discussed somewhat);

- Define high-level interactions between classes via well-defined 
  interfaces;

- Compose classes into higher-level classes in a structured, analyzable 
  manner.

With the latter being an important way to allow admins to configure 
overall security at a meaningful level of granularity, matching the level 
of encapsulation which they are already using for managing applications.

The idea generally being that admins/developers not think in terms of low 
level policy constructs (although allow these to be exposed if needed), 
but rather, to think about composing security objects into e.g. a 
container, and then from a system point of view, to be able to broadly 
define how the containers interact with each other and the base system.


Thoughts?


- James
-- 
James Morris
<jmorris@namei.org>

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.