lkml.org 
[lkml]   [2009]   [Feb]   [20]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: [PATCH] SMACK netfilter smacklabel socket match
    Casey Schaufler wrote:
    > etienne wrote:
    >> ...
    >>> Etienne, thank you very much for the work you've done so far. Paul,
    >>> thank you for your recommendations.
    >>>
    >> well, I'll try to explain my use case for SMACK, could you please tell me if this makes sense and if it is doable and sane with SMACK :
    >>
    >> I have single-user computer that, for simplicity sake, do only web browsing with firefox;
    >> the attack vector i'm concerned with is malicious web pages, that could execute malicious code on my computer or worse erase some of my data;
    >>
    >> so i express the following security policy in a tool-agnostic way :
    >> 1. firefox can access internet
    >>
    >
    > In Smack terms then you want the process label of your browser
    > process to have access to hosts on the internet in general. The
    > easy way to do this is for it to run with the ambient label
    > (cat /smack/ambient to see it) which will be the floor label "_"
    > unless you change it. Note that your browser will need to talk
    > to the X11 server as well, so processes with the label of the
    > browser will need write access to processes with the label of the
    > X11 server, and visa versa.

    OK
    >
    >> 2. firefox can read/write it's configuration directory in my $HOME
    >>
    [snip]
    >
    > Do you need to use /tmp, or does firefox respect $TMPDIR?
    > You can set the label of /tmp to the star "*" label if worse
    > comes to worst.
    >
    i don't really know now, i label /tmp/ /var/tmp with *


    >> pretty simple. So I expect the 'tool' to express this policy in very few line; (i had a look at selinux/refpolicy, and I'm ashamed I was too lazy to test/understand further).
    >
    > Don't be ashamed. I wrote Smack because I was too lazy to figure
    > out SELinux policy.
    >
    :-)

    >
    > I have a newsmack program, but all that it does is what your "hack"
    > does.
    >
    OK then. If it's the only way

    >> Third issue : there seems to be no way to log/audit access violations, have you plans to implement that?
    >>
    >
    > Hmm. Audit should be working.
    >
    I see some "audit" hook in the code, but i don't see a way to log _specific_ smack information ie
    "smack_subject smack_object smack_access drop" (+of course process name, pid, path, and any relevant info)

    like selinux would do in 'avc_audit'


    regards
    Etienne


    \
     
     \ /
      Last update: 2009-02-20 19:29    [W:2.423 / U:0.032 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site