Re: Frustrated with capabilities..

James Morris
2008-08-29T10:48:21Z

On Fri, 29 Aug 2008, Markku Savela wrote:

> File capabilities (nor selinux) won't work, because the "helper
> applications" need to be executed with different capabilities and
> permissions, depending on the "manifests" of the downloaded
> "code". Obviously, serious permissions are granted only to properly
> verified "code" (signed).
>
> [Any ideas how selinux would help to enforce a permission which is
> dynamically defined by installing application?]

You could implement a specialized userpsace application launcher, which
parses the manifest, determines a security context for the application,
performs any requiste object labeling, then launches the application it in
that context. The kernel policy could enforce which particular contexts
the launcher was authorized to use, and which applications could be
launched in this way, then confine the launched applications.

>
> I'm using "code" in quotes, because in my mind, it can include HTML,
> word documents, spreadsheets, images. Data formats are getting so
> complex, that they start to look more like interpreted code, than plain
> passive data.
>
> File capabilities (and setuid/setgid bits, selinux attributes) have
> another problem: they only work properly on internal disk. No sane
> person would allow them to be effective from removable media or NFS.

There is a project underway to extend SELinux (and MAC labeling in
general) over NFS: http://selinuxproject.org/page/Labeled_NFS

- James
--
James Morris
<jmorris@namei.org>