lkml.org 
[lkml]   [2008]   [Oct]   [6]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: SMACK netfilter smacklabel socket match
Casey Schaufler wrote:
> Tilman Baumann wrote:
>> Casey Schaufler wrote:
>> If I set /smack/nltype to 'unlabeled' I have effectively shut off the
>> network.
>> I guess I'm missing some essential point here.
>> Sorry to bother you with such trivialities.
>
> Not to worry. The essential point is that with MAC you can't just lock
> the doors, you have to lock the windows as well. What I mean by that is
> that traditional access controls apply to files, but not network
> communications. Network communications became popular in part because
> they were allowed to leave any restrictions up to the applications
> and their protocols. MAC requirements are pickier than that. The good
> news is that with a scheme like CIPSO you can easily enforce the
> policy. The bad news is that network services in general assume that
> there is no policy being enforced on them.

This might work well in trusted networks.
But Internet is untrusted and needs to work too. At least in the most
real world scenarios. :)

>> If i set /smack/nltype to 'unlabled' i don't even get SYN packets out.
>> (operation not permitted)
>
> That's probably a bug, but I think the "fix" is to disable the ability to
> set the nltype to anything other than CIPSO at least for the time being.

Well, there is a case statement in smack_lsm.c that checks for the
nltype (smack_net_nltype) and omits net labeling if cipso is not set.
This seems to be a very sensible thing to do. I strongly advice for a
way to omit netlabel based access control.
As soon as you leave controlled and trusted networks, netlabels seem in
my eyes like a maybe even critical information leak.

btw. I tried return 0; in smk_access(), but it did not make networking
work again with nltype set to unlabled. So I guess the problem is not
some access check.

If you have any idea how i can avoid any cipso labels on the network but
use smack for local access control?
I don't try to secure information channels. Our system is a general
purpose server, it would defeat the purpose of our system to lock it up
since our clients are never going to use cipso.

I'm pretty sure the cipso labels are the problem. Since I can easily
access resources in the local network. But things break when I access
over Internet.
And I can not even expect this to work in any network where the system
will be deployed.

--
Tilman Baumann
Software Developer
Collax GmbH . Boetzinger Strasse 60 . 79111 Freiburg . Germany

p: +49 (0) 89-990157-0
f: +49 (0) 89-990157-11

Geschaeftsfuehrer: William K. Hite / Boris Nalbach
AG Muenchen HRB 158898, Ust.-IdNr: DE 814464942


\
 
 \ /
  Last update: 2008-10-06 14:59    [W:0.113 / U:0.004 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site