[prev in list] [next in list] [prev in thread] [next in thread]
List: linux-security-module
Subject: Re: [PATCH] SMACK netfilter smacklabel socket match
From: etienne <etienne.basset () numericable ! fr>
Date: 2009-02-20 18:26:53
Message-ID: 499EF5ED.4080207 () numericable ! fr
[Download RAW message or body]
Casey Schaufler wrote:
> etienne wrote:
> > ...
> > > Etienne, thank you very much for the work you've done so far. Paul,
> > > thank you for your recommendations.
> > >
> > well, I'll try to explain my use case for SMACK, could you please tell me if this \
> > makes sense and if it is doable and sane with SMACK :
> > I have single-user computer that, for simplicity sake, do only web browsing with \
> > firefox; the attack vector i'm concerned with is malicious web pages, that could \
> > execute malicious code on my computer or worse erase some of my data;
> > so i express the following security policy in a tool-agnostic way :
> > 1. firefox can access internet
> >
>
> In Smack terms then you want the process label of your browser
> process to have access to hosts on the internet in general. The
> easy way to do this is for it to run with the ambient label
> (cat /smack/ambient to see it) which will be the floor label "_"
> unless you change it. Note that your browser will need to talk
> to the X11 server as well, so processes with the label of the
> browser will need write access to processes with the label of the
> X11 server, and visa versa.
OK
>
> > 2. firefox can read/write it's configuration directory in my $HOME
> >
[snip]
>
> Do you need to use /tmp, or does firefox respect $TMPDIR?
> You can set the label of /tmp to the star "*" label if worse
> comes to worst.
>
i don't really know now, i label /tmp/ /var/tmp with *
> > pretty simple. So I expect the 'tool' to express this policy in very few line; (i \
> > had a look at selinux/refpolicy, and I'm ashamed I was too lazy to \
> > test/understand further).
>
> Don't be ashamed. I wrote Smack because I was too lazy to figure
> out SELinux policy.
>
> -)
>
> I have a newsmack program, but all that it does is what your "hack"
> does.
>
OK then. If it's the only way
> > Third issue : there seems to be no way to log/audit access violations, have you \
> > plans to implement that?
>
> Hmm. Audit should be working.
>
I see some "audit" hook in the code, but i don't see a way to log _specific_ smack \
information ie "smack_subject smack_object smack_access drop" (+of course \
process name, pid, path, and any relevant info)
like selinux would do in 'avc_audit'
regards
Etienne
--
To unsubscribe from this list: send the line "unsubscribe linux-security-module" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
[prev in list] [next in list] [prev in thread] [next in thread]
Configure |
About |
News |
Add a list |
Sponsored by KoreLogic