Announcement: setools version 1.1

Announcement: setools version 1.1

[Karl MacMillan]

Tresys setools version 1.1 is now available. Source, rpms, and a patch
for the latest NSA release are available from our website:

http://www.tresys.com/selinux/

Additionally, the SELinux cvs repository on sourceforge has been
updated. This release includes many enhancements and additions
including:

- A new application called seaudit for policy debugging. Seaudit allows
you to view audit messages from SELinux, search and sort those messages,
and query a policy for rules related to those messages. This is the
initial release of this tool and we are considering additional
functionality for a future release, including realtime monitoring of
audit messages.

- New command line tools called seinfo and sesearch. Seinfo is a command
line tool for looking at an SE Linux policy and viewing various
component elements and statistics. Sesearch is a command line tool to
search the TE rules.

- Enhanced transitive information flow analysis in Apol. The transitive
information flow analysis in apol has been significantly enhanced to
allow the filtering of object classes, object class permissions, and
intermediate types in queries, finding additional information flows
between types, and a removal of potential false positives.

- Analysis queries in Apol can now be saved for use later. This is
particularly useful for the complex transitive information flow queries.

- Significant enhancement to the internal structure of the libraries. In
particular, dependencies with X11 are now removed from all of the
command line tools. This will allow for the installation of a limited
set of the tools on servers without X11.

- A large number of minor enhancements and bug fixes.

-- 
Karl MacMillan
Tresys Technology
kmacmillan@tresys.com
http://www.tresys.com
(410) 290-1411 x134


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: Announcement: setools version 1.1

[John D. Ramsdell]

Karl MacMillan <kmacmillan@tresys.com> writes:

> - Enhanced transitive information flow analysis in Apol. The transitive
> information flow analysis in apol has been significantly enhanced to
> allow the filtering of object classes, object class permissions, and
> intermediate types in queries, finding additional information flows
> between types, and a removal of potential false positives.

How does this version of the information flow analysis address Steve's
observation that it is a bug in the policy if someone is trying to
separate based on the class (vs. using separate types)?

John

Stephen Smalley <sds@epoch.ncsc.mil> writes:

> On Thu, 2003-12-11 at 15:46, Karl MacMillan wrote:
> > Interesting. This seems like a special case to me - "implicit
> > relationship" seems to mean that the information is flowing to that proc
> > file outside of the control of the policy. Just to make certain that I
> > understand, am I correct that information can only flow to proc files in
> > this example? In other words, if there was a plain text file labeled b_t
> > no information could flow through it from c_t to a_t without another
> > rule:
> > 
> > allow b_t b_t : file write;
> 
> Correct.
> 
> > Are there any implicit relationships like this?
> 
> Offhand, no, although I may be forgetting something.  Sockets
> and System V IPC objects do inherit the type of the creating
> process by default, but there are explicit allow rules authorizing the
> creation and subsequent access.  devpts nodes are dynamically created by
> the kernel in response to access to /dev/ptmx, so you never see an
> explicit allow rule for the creation, but they do require explicit allow
> rules for accessing them.
> 
> > I agree that this isn't a likely situation (we have yet to see this
> > false positive in a real policy), but one of the goals of automated
> > tools is to detect poorly written policies. However, both of these
> > strategies help prevent a false positive where it can appear that
> > information flows between 2 objects without a subject, which is a likely
> > situation.
> 
> I'd view it as a bug in the policy if someone is trying to separate
> based on the class (vs. using separate types).
> 
> -- 
> Stephen Smalley <sds@epoch.ncsc.mil>
> National Security Agency

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: Announcement: setools version 1.1

[Karl MacMillan]

On Mon, 2003-12-22 at 09:43, John D. Ramsdell wrote:
> Karl MacMillan <kmacmillan@tresys.com> writes:
> 
> > - Enhanced transitive information flow analysis in Apol. The transitive
> > information flow analysis in apol has been significantly enhanced to
> > allow the filtering of object classes, object class permissions, and
> > intermediate types in queries, finding additional information flows
> > between types, and a removal of potential false positives.
> 
> How does this version of the information flow analysis address Steve's
> observation that it is a bug in the policy if someone is trying to
> separate based on the class (vs. using separate types)?
> 

Our tool accurately reflects the semantics of the policy. If someone
uses those semantics in a way that is considered a "bug" by the analyst
(or Steve) our tool will help find those bugs. That is, in fact, the
goal of our tools.

Karl

> John
> 
> Stephen Smalley <sds@epoch.ncsc.mil> writes:
> 
> > On Thu, 2003-12-11 at 15:46, Karl MacMillan wrote:
> > > Interesting. This seems like a special case to me - "implicit
> > > relationship" seems to mean that the information is flowing to that proc
> > > file outside of the control of the policy. Just to make certain that I
> > > understand, am I correct that information can only flow to proc files in
> > > this example? In other words, if there was a plain text file labeled b_t
> > > no information could flow through it from c_t to a_t without another
> > > rule:
> > > 
> > > allow b_t b_t : file write;
> > 
> > Correct.
> > 
> > > Are there any implicit relationships like this?
> > 
> > Offhand, no, although I may be forgetting something.  Sockets
> > and System V IPC objects do inherit the type of the creating
> > process by default, but there are explicit allow rules authorizing the
> > creation and subsequent access.  devpts nodes are dynamically created by
> > the kernel in response to access to /dev/ptmx, so you never see an
> > explicit allow rule for the creation, but they do require explicit allow
> > rules for accessing them.
> > 
> > > I agree that this isn't a likely situation (we have yet to see this
> > > false positive in a real policy), but one of the goals of automated
> > > tools is to detect poorly written policies. However, both of these
> > > strategies help prevent a false positive where it can appear that
> > > information flows between 2 objects without a subject, which is a likely
> > > situation.
> > 
> > I'd view it as a bug in the policy if someone is trying to separate
> > based on the class (vs. using separate types).
> > 
> > -- 
> > Stephen Smalley <sds@epoch.ncsc.mil>
> > National Security Agency
> 
> --
> This message was distributed to subscribers of the selinux mailing list.
> If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
> the words "unsubscribe selinux" without quotes as the message.
-- 
Karl MacMillan
Tresys Technology
kmacmillan@tresys.com
http://www.tresys.com
(410) 290-1411 x134


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.