Re: polgen and strace

[ramsdell@mitre.org (John D. Ramsdell)]

Manoj Srivastava <manoj.srivastava@stdc.com> writes:

>         While poking around in polgen (in preparation for packaging
>  it for Debian), I noticed that it has the full set of sources for
>  strace!

The strace that is part of polgen has been changed so that when one
specifies the -X option, it adds security context information to its
output.  This added output is essential to the analysis that follows.

Polgen 0.8 has a version of strace based on version 4.5.6.  Late last
week, I noticed Polgen's strace died a horrible death when tracing
Java programs.  I found out that the standard 4.5.6 release has the
same problem, but the version that comes with FC3 works.

I have a new version of SE Linux enhanced strace based on version
4.5.8 in my CVS repository, and this version allows us to analyze Java
programs.  Let me simply say, there is a lot going on in a Java VM!
People interested in policies that implement the principle of least
privileges have a lot to do.  A new polgen release that includes this
improvement is coming soon.

> 	Would polgen work with a vanilla strace? Are there plans for
> pushing strace changes upstream?

Polgen would not work with vanilla strace.  We have offered the
changes to the strace maintainers, but have not received a word one
way or the other as to their interest in supporting the -X option.  

> 	I might be able to get strace patched, though, if the patches
> were not too intrusive., but I was not able to find a canonical
> location for strace patches.

I can make up the patch, but I'm not sure it would help.

By the way, the polgen program strace2tsv transforms strace output
into tab separated values.  It should be useful to anyone analyzing
strace output with another program.  It works with vanilla strace too.
Polgen has a manual page for this program.

What does one do to package polgen for Debian?  Is there something I
can add to the polgen sources that would facilitate this process.  I
don't know much about Debian packaging, so hand holding is in order.

John

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.