[lkml]   [2008]   [Oct]   [6]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    SubjectRe: SMACK netfilter smacklabel socket match
    Tilman Baumann wrote:
    > Casey Schaufler wrote:
    >> Tilman Baumann wrote:
    >>> Casey Schaufler wrote:
    >>> If I set /smack/nltype to 'unlabeled' I have effectively shut off
    >>> the network.
    >>> I guess I'm missing some essential point here.
    >>> Sorry to bother you with such trivialities.
    >> Not to worry. The essential point is that with MAC you can't just lock
    >> the doors, you have to lock the windows as well. What I mean by that is
    >> that traditional access controls apply to files, but not network
    >> communications. Network communications became popular in part because
    >> they were allowed to leave any restrictions up to the applications
    >> and their protocols. MAC requirements are pickier than that. The good
    >> news is that with a scheme like CIPSO you can easily enforce the
    >> policy. The bad news is that network services in general assume that
    >> there is no policy being enforced on them.
    > This might work well in trusted networks.
    > But Internet is untrusted and needs to work too. At least in the most
    > real world scenarios. :)

    Yes. I'm pretty close to convinced that it needs to be included as
    part of the single-label host solution. Not that it can possibly be
    excused in any real secure environment mind you.

    >>> If i set /smack/nltype to 'unlabled' i don't even get SYN packets
    >>> out. (operation not permitted)
    >> That's probably a bug, but I think the "fix" is to disable the
    >> ability to
    >> set the nltype to anything other than CIPSO at least for the time being.
    > Well, there is a case statement in smack_lsm.c that checks for the
    > nltype (smack_net_nltype) and omits net labeling if cipso is not set.
    > This seems to be a very sensible thing to do. I strongly advice for a
    > way to omit netlabel based access control.

    Yes, I hear you.

    > As soon as you leave controlled and trusted networks, netlabels seem
    > in my eyes like a maybe even critical information leak.
    > btw. I tried return 0; in smk_access(), but it did not make networking
    > work again with nltype set to unlabled. So I guess the problem is not
    > some access check.
    > If you have any idea how i can avoid any cipso labels on the network
    > but use smack for local access control?
    > I don't try to secure information channels. Our system is a general
    > purpose server, it would defeat the purpose of our system to lock it
    > up since our clients are never going to use cipso.
    > I'm pretty sure the cipso labels are the problem. Since I can easily
    > access resources in the local network. But things break when I access
    > over Internet.
    > And I can not even expect this to work in any network where the system
    > will be deployed.

     \ /
      Last update: 2008-10-07 04:45    [W:0.023 / U:134.820 seconds]
    ©2003-2017 Jasper Spaans. hosted at Digital OceanAdvertise on this site