Re: [gentoo-hardened] SELinux policy rules principles?

[Sven Vermeulen <sven.vermeulen@siphos.be>]

On Sun, Jan 16, 2011 at 08:22:03PM +0100, David Sommerseth wrote:
> Why not have a look at what Fedora and RHEL/CentOS does in that regards? 
> They've probably already been through a lot of these decisions as well, and 
> were probably also one of the earlier adopters.

Well, most of these distributions offer a targeted SELinux policy approach
(they confine specific services/daemons, but most user activity is ran in
unconfined domains) instead of a strict SELinux policy approach (no
unconfined domains). Although they still have the same problem, it's scope
is not as large as within a strict approach.

The distributions I look at (fedora mainly) doesn't really seem to use 
one or the other. I also can't find any resource that sais to developers
how they should focus their policies. From a quick chat on #selinux I seem
to deduce that It Depends (tm). Mostly on the developer in charge. 

What I do notice is that, if a module has an allow statement which is
cosmetic (not needed) it doesn't ever get removed because there's noone
"trying" to remove statements to see if they are really cosmetic (that's a
nice conundrum - how do I then know that a rule is cosmetic ;-) 

Wkr,
	Sven Vermeulen