From: "Sven Vermeulen" <sven.vermeulen@siphos.be>
To: gentoo-commits@lists.gentoo.org
Subject: [gentoo-commits] proj/hardened-docs:master commit in: xml/selinux/
Date: Sat, 15 Oct 2011 17:43:12 +0000 (UTC) [thread overview]
Message-ID: <77a5cb36d533f0b6d1d34563bc59b5d523ad1c41.SwifT@gentoo> (raw)
commit: 77a5cb36d533f0b6d1d34563bc59b5d523ad1c41
Author: Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
AuthorDate: Sat Oct 15 17:42:58 2011 +0000
Commit: Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
CommitDate: Sat Oct 15 17:42:58 2011 +0000
URL: http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-docs.git;a=commit;h=77a5cb36
Finishing on policy chapter
---
xml/selinux/hb-using-policies.xml | 159 ++++++++++++++++++++++++++++++++++++-
1 files changed, 157 insertions(+), 2 deletions(-)
diff --git a/xml/selinux/hb-using-policies.xml b/xml/selinux/hb-using-policies.xml
index 44d7b1f..5d5f008 100644
--- a/xml/selinux/hb-using-policies.xml
+++ b/xml/selinux/hb-using-policies.xml
@@ -177,11 +177,166 @@ Needless to say, we do not recommend to grant this to a regular user ;-)
</section>
<section>
-<title>Building a SELinux Policy Module</title>
+<title>Full SELinux Policy Modules</title>
<subsection>
-<title>Creating an Isolated Module</title>
+<title>Checking Out an Isolated Module</title>
<body>
+<p>
+With the above in mind, we can now go one step further and investigate a full
+policy module, with both the type enforcement rules (<path>.te</path> file),
+file contexts (<path>.fc</path>) and interfaces (<path>.if</path>).
+</p>
+
+<p>
+You should know that writing a module requires you to get intimate with the
+application. It isn't a matter of just hoping for the best: as a security
+administrator, you will be responsible for defining what accesses are allowed
+and which not. If you forget one, the application might break under the users'
+hands. But if you add too much, you might grant privileges that can be abused
+later on. And it will be a lot more difficult to track and remove privileges
+later as you will be hesitating if the privilege is needed or not.
+</p>
+
+<p>
+In this section, we will not divulge in how to write one. We have an excellent
+<uri link="/proj/en/hardened/selinux-development.xml">Gentoo Hardened SELinux
+Development</uri> resource that guides you in that. However, we will look into
+such a full module to explain the other aspects of policy development.
+</p>
+
+</body>
+</subsection>
+<subsection>
+<title>Type Enforcement File</title>
+<body>
+
+<p>
+The <path>.te</path> file we wrote earlier is a <e>type enforcement file</e>.
+Its purpose is to define the access rules related to the module that you are
+building, but also - and more importantly - define new types (or even roles).
+</p>
+
+<p>
+The example below is a snippet from a module for the skype application.
+</p>
+
+<pre caption="Snippet from skype.te">
+policy_module(skype, 1.0.0)
+
+type skype_t;
+type skype_exec_t;
+application_domain(skype_t, skype_exec_t)
+
+type skype_home_t;
+userdom_user_home_content(skype_home_t)
+
+manage_dirs_pattern(skype_t, skype_home_t, skype_home_t)
+manage_files_pattern(skype_t, skype_home_t, skype_home_t)
+</pre>
+
+<p>
+In the above example, three new types are declared: <c>skype_t</c> (which will
+be used for the application), <c>skype_exec_t</c> (which is the label given to
+the application binary) and <c>skype_home_t</c> (which will be used for the
+users' <path>~/.Skype</path> location). Also, the <c>skype_t</c> domain is given
+some privileges with respect to the <c>skype_home_t</c> label (manage
+directories and files).
+</p>
+
+</body>
+</subsection>
+<subsection>
+<title>File Context File</title>
+<body>
+
+<p>
+In the <path>.fc</path> file (which stands for <e>file context file</e>) the
+module's resources (files, directories, sockets, ...) are defined. Once the
+module is loaded, these rules are added so that file system relabeling will put
+the correct context on the files.
+</p>
+
+<p>
+The example below is a snippet from the skype modules' file context file.
+</p>
+
+<pre caption="Snippet from skype.fc">
+HOME_DIR/\.Skype(/.*)? gen_context(system_u:object_r:skype_home_t,s0)
+/opt/skype/skype -- gen_context(system_u:object_r:skype_exec_t,s0)
+/usr/bin/skype -- gen_context(system_u:object_r:skype_exec_t,s0)
+</pre>
+
+<p>
+The format of the file context file has the following syntax:
+</p>
+
+<ol>
+ <li>
+ The regular expression that matches the file(s) and directorie(s) affected
+ by that line
+ </li>
+ <li>
+ An optional identifier to differentiate the type of files (file, directory,
+ socket, symbolic link, ...)
+ </li>
+ <li>
+ A <c>gen_context</c> line that contains the context to assign to the file(s)
+ and directorie(s)
+ </li>
+</ol>
+
+</body>
+</subsection>
+<subsection>
+<title>Interface File</title>
+<body>
+
+<p>
+In the <path>.if</path> file (for <e>interface file</e>) interfaces are declared
+which can be used by other modules. It is through interfaces that a nicely
+defined policy can be built on top of other, existing policy modules.
+</p>
+
+<p>
+One interface could be to allow users to call and execute an application. For
+instance, the following interface can be found in the skype module.
+</p>
+
+<pre caption="Snippet from skype.if">
+interface(`skype_role',`
+ gen_require(`
+ type skype_t, skype_exec_t, skype_tmpfs_t, skype_home_t;
+ ')
+
+ role $1 types skype_t;
+
+ domtrans_pattern($2, skype_exec_t, skype_t)
+
+ allow $2 skype_t:process { ptrace signal_perms };
+
+ manage_dirs_pattern($2, skype_home_t, skype_home_t)
+ manage_files_pattern($2, skype_home_t, skype_home_t)
+ manage_lnk_files_pattern($2, skype_home_t, skype_home_t)
+
+ relabel_dirs_pattern($2, skype_home_t, skype_home_t)
+ relabel_files_pattern($2, skype_home_t, skype_home_t)
+ relabel_lnk_files_pattern($2, skype_home_t, skype_home_t)
+
+ ps_process_pattern($2, skype_t)
+')
+</pre>
+
+<p>
+Through this <c>skype_role</c>, we can then allow users to call skype, as can be
+found in the <path>unprivuser.te</path> file (which defines the user_t domain):
+</p>
+
+<pre caption="Snippet from unprivuser.te to call skype">
+optional_policy(`
+ skype_role(user_r, user_t)
+')
+</pre>
</body>
</subsection>
next reply other threads:[~2011-10-15 17:45 UTC|newest]
Thread overview: 95+ messages / expand[flat|nested] mbox.gz Atom feed top
2011-10-15 17:43 Sven Vermeulen [this message]
-- strict thread matches above, loose matches on Subject: below --
2012-05-07 20:20 [gentoo-commits] proj/hardened-docs:master commit in: xml/selinux/ Sven Vermeulen
2012-05-07 20:07 Sven Vermeulen
2012-05-05 18:56 Sven Vermeulen
2012-04-29 14:22 Sven Vermeulen
2012-04-10 18:22 Sven Vermeulen
2012-04-10 18:22 Sven Vermeulen
2012-04-10 18:22 Sven Vermeulen
2012-04-05 16:24 Sven Vermeulen
2012-03-01 20:09 Sven Vermeulen
2012-01-29 12:42 Sven Vermeulen
2012-01-21 13:20 Sven Vermeulen
2011-12-17 10:52 Sven Vermeulen
2011-12-11 14:39 Sven Vermeulen
2011-12-11 14:36 Sven Vermeulen
2011-12-10 14:00 Sven Vermeulen
2011-11-22 20:08 Sven Vermeulen
2011-11-11 19:59 Sven Vermeulen
2011-10-27 19:18 José María Alonso
2011-10-26 22:05 José María Alonso
2011-10-23 13:01 Sven Vermeulen
2011-10-19 12:55 Sven Vermeulen
2011-10-15 18:24 Sven Vermeulen
2011-10-15 17:12 Sven Vermeulen
2011-10-15 15:54 Sven Vermeulen
2011-10-15 15:18 Sven Vermeulen
2011-10-15 13:04 Sven Vermeulen
2011-10-15 13:04 Sven Vermeulen
2011-09-30 17:36 Sven Vermeulen
2011-09-18 13:49 Sven Vermeulen
2011-09-11 9:51 Sven Vermeulen
2011-09-04 19:22 Sven Vermeulen
2011-08-16 16:58 José María Alonso
2011-08-12 21:00 Sven Vermeulen
2011-07-22 16:03 Sven Vermeulen
2011-07-21 19:11 Sven Vermeulen
2011-07-13 21:39 Sven Vermeulen
2011-07-09 18:56 Sven Vermeulen
2011-06-09 18:54 José María Alonso
2011-06-09 17:49 Sven Vermeulen
2011-06-09 17:40 Francisco Blas Izquierdo Riera
2011-06-09 17:24 Sven Vermeulen
2011-06-07 19:38 Sven Vermeulen
2011-06-07 19:26 Sven Vermeulen
2011-06-02 19:50 Sven Vermeulen
2011-06-02 11:57 Sven Vermeulen
2011-06-02 11:55 Sven Vermeulen
2011-06-02 11:03 Sven Vermeulen
2011-06-02 11:03 Sven Vermeulen
2011-05-31 20:22 Sven Vermeulen
2011-05-31 20:16 Sven Vermeulen
2011-05-31 20:16 Sven Vermeulen
2011-05-24 20:39 Sven Vermeulen
2011-05-24 19:56 Sven Vermeulen
2011-05-20 19:32 Sven Vermeulen
2011-05-14 12:51 Sven Vermeulen
2011-05-13 19:43 Sven Vermeulen
2011-05-03 20:47 Sven Vermeulen
2011-05-03 20:12 Sven Vermeulen
2011-04-22 21:43 Sven Vermeulen
2011-04-22 19:30 Sven Vermeulen
2011-04-22 19:28 Sven Vermeulen
2011-04-22 19:05 Sven Vermeulen
2011-04-22 19:05 Sven Vermeulen
2011-04-22 10:32 Sven Vermeulen
2011-04-22 10:32 Sven Vermeulen
2011-04-16 9:06 Sven Vermeulen
2011-04-15 19:10 Sven Vermeulen
2011-04-15 17:52 Sven Vermeulen
2011-04-15 17:52 Sven Vermeulen
2011-04-10 7:49 Sven Vermeulen
2011-04-01 17:45 Sven Vermeulen
2011-03-09 16:54 Sven Vermeulen
2011-03-02 20:48 Sven Vermeulen
2011-03-02 20:38 Sven Vermeulen
2011-03-02 20:38 Sven Vermeulen
2011-03-02 20:13 Sven Vermeulen
2011-03-02 20:13 Sven Vermeulen
2011-03-02 20:13 Sven Vermeulen
2011-03-02 15:53 Sven Vermeulen
2011-02-24 21:19 Sven Vermeulen
2011-02-20 13:26 Sven Vermeulen
2011-02-19 17:00 Francisco Blas Izquierdo Riera
2011-02-19 3:21 Francisco Blas Izquierdo Riera
2011-02-19 3:12 Francisco Blas Izquierdo Riera
2011-02-13 18:20 Sven Vermeulen
2011-02-12 23:44 Sven Vermeulen
2011-02-12 23:44 Sven Vermeulen
2011-02-12 20:50 Sven Vermeulen
2011-02-12 20:49 Sven Vermeulen
2011-02-12 20:47 Sven Vermeulen
2011-02-12 20:47 Sven Vermeulen
2011-02-12 20:47 Sven Vermeulen
2011-02-12 17:33 Sven Vermeulen
2011-02-06 19:53 Sven Vermeulen
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=77a5cb36d533f0b6d1d34563bc59b5d523ad1c41.SwifT@gentoo \
--to=sven.vermeulen@siphos.be \
--cc=gentoo-commits@lists.gentoo.org \
--cc=gentoo-dev@lists.gentoo.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox