Casey Schaufler wrote:
--- Joshua Brindle [EMAIL PROTECTED] wrote:
Since unprivileged programs (the origin, guard, and publication
daemons in smackguard run without privilege) can't change their
Smack labels establishing a pipe between processes with different
labels is not possible without
--- Joshua Brindle [EMAIL PROTECTED] wrote:
Casey Schaufler wrote:
--- Joshua Brindle [EMAIL PROTECTED] wrote:
Since unprivileged programs (the origin, guard, and publication
daemons in smackguard run without privilege) can't change their
Smack labels establishing a pipe between
--- Joshua Brindle [EMAIL PROTECTED] wrote:
Casey Schaufler wrote:
--- Joshua Brindle [EMAIL PROTECTED] wrote:
Casey Schaufler wrote:
--- Joshua Brindle [EMAIL PROTECTED] wrote:
Casey Schaufler wrote:
--- Joshua Brindle [EMAIL PROTECTED]
Casey Schaufler wrote:
--- Joshua Brindle [EMAIL PROTECTED] wrote:
Casey Schaufler wrote:
--- Joshua Brindle [EMAIL PROTECTED] wrote:
... On the guard
implementation I'd like to note that assured pipelines are pretty hard
to get right. Without object class and create
--- Joshua Brindle [EMAIL PROTECTED] wrote:
Casey Schaufler wrote:
--- Joshua Brindle [EMAIL PROTECTED] wrote:
Casey Schaufler wrote:
--- Joshua Brindle [EMAIL PROTECTED] wrote:
... On the guard
implementation I'd like to note that assured pipelines
Casey Schaufler wrote:
--- Joshua Brindle [EMAIL PROTECTED] wrote:
... On the guard
implementation I'd like to note that assured pipelines are pretty hard
to get right. Without object class and create granularity (at the very
least) you might find it very difficult to control backflow.
--- Joshua Brindle [EMAIL PROTECTED] wrote:
Casey Schaufler wrote:
--- Joshua Brindle [EMAIL PROTECTED] wrote:
... On the guard
implementation I'd like to note that assured pipelines are pretty hard
to get right. Without object class and create granularity (at the very
--- Joshua Brindle [EMAIL PROTECTED] wrote:
... On the guard
implementation I'd like to note that assured pipelines are pretty hard
to get right. Without object class and create granularity (at the very
least) you might find it very difficult to control backflow. Consider
that 1) many
On Thu, 19 Jul 2007, Greg KH wrote:
Why not do it here on this list? It is security related and I'm sure
that other security model implementations will be interested in it.
Labeled NFS is aimed at being cross platform, and we hope to have
non-Linux folk particpiating actively. The LSM list
On Fri, Jul 20, 2007 at 07:56:05AM -0400, James Morris wrote:
On Thu, 19 Jul 2007, Greg KH wrote:
Why not do it here on this list? It is security related and I'm sure
that other security model implementations will be interested in it.
Labeled NFS is aimed at being cross platform, and we
On Wed, 2007-07-18 at 18:15 -0700, Casey Schaufler wrote:
--- Joshua Brindle [EMAIL PROTECTED] wrote:
Casey Schaufler wrote:
...
I do have a hackish newsmack command, which I should probably include.
All it does is write the new label to /proc/self/attr/current and
exec
On Thu, 19 Jul 2007, Joshua Brindle wrote:
I also see an effort that's SELinux specific. Should be fun.
The SELinux part is going to be a profile on top of the generic part so there
shouldn't be any conflicts in the implementation.
I wonder if it'd be worth setting up a mailing list
On Thursday, July 19 2007 10:15:53 am James Morris wrote:
On Thu, 19 Jul 2007, Joshua Brindle wrote:
I also see an effort that's SELinux specific. Should be fun.
The SELinux part is going to be a profile on top of the generic part so
there shouldn't be any conflicts in the
--- James Morris [EMAIL PROTECTED] wrote:
On Thu, 19 Jul 2007, Joshua Brindle wrote:
I also see an effort that's SELinux specific. Should be fun.
The SELinux part is going to be a profile on top of the generic part so
there
shouldn't be any conflicts in the implementation.
On Thu, 2007-07-19 at 08:26 -0700, Casey Schaufler wrote:
--- Stephen Smalley [EMAIL PROTECTED] wrote:
On Wed, 2007-07-18 at 18:15 -0700, Casey Schaufler wrote:
--- Joshua Brindle [EMAIL PROTECTED] wrote:
Casey Schaufler wrote:
...
I do have a hackish newsmack
On Thu, Jul 19, 2007 at 10:15:53AM -0400, James Morris wrote:
On Thu, 19 Jul 2007, Joshua Brindle wrote:
I also see an effort that's SELinux specific. Should be fun.
The SELinux part is going to be a profile on top of the generic part so
there
shouldn't be any conflicts in
Casey Schaufler wrote:
--- Joshua Brindle [EMAIL PROTECTED] wrote:
Casey Schaufler wrote:
snip
Smack provides mandatory access controls based on the label attached
to a task and the label attached to the object it is attempting to
access. Smack labels are deliberately short (1-7
Casey Schaufler wrote:
Today's implementation of sshd is a hack, just enough to get
things going. Longer term I expect users to have a list of
labels they can use. sshd currently uses /etc/smack/user,
which contains lines like:
method manic
casey loony
with future support for:
--- Stephen Smalley [EMAIL PROTECTED] wrote:
On Sat, 2007-07-14 at 14:47 -0700, Casey Schaufler wrote:
Smack is the Simplified Mandatory Access Control Kernel.
...
A file always gets the Smack label of the task that created it.
Smack defines and uses these labels:
* -
--- Joshua Brindle [EMAIL PROTECTED] wrote:
Casey Schaufler wrote:
...
I do have a hackish newsmack command, which I should probably include.
All it does is write the new label to /proc/self/attr/current and
exec the desired program. That's not good enough for a production
On Monday, July 16 2007 10:59:41 pm Casey Schaufler wrote:
--- Paul Moore [EMAIL PROTECTED] wrote:
On Saturday, July 14 2007 5:47:38 pm Casey Schaufler wrote:
+#include ../../net/netlabel/netlabel_domainhash.h
+#include net/cipso_ipv4.h
+
+ {snip}
+
+static void smk_cipso_doi(void)
--- Paul Moore [EMAIL PROTECTED] wrote:
On Monday, July 16 2007 10:59:41 pm Casey Schaufler wrote:
--- Paul Moore [EMAIL PROTECTED] wrote:
On Saturday, July 14 2007 5:47:38 pm Casey Schaufler wrote:
+#include ../../net/netlabel/netlabel_domainhash.h
+#include net/cipso_ipv4.h
+
Casey Schaufler wrote:
snip
Smack provides mandatory access controls based on the label attached
to a task and the label attached to the object it is attempting to
access. Smack labels are deliberately short (1-7 characters) text
strings. Single character labels using special characters are
--- Paul Moore [EMAIL PROTECTED] wrote:
Also, any reason why you don't just use the NetLabel default domain
mapping?
Uh, only that I couldn't figure out how to go about doing so. If it
simplifies (there's that word again) things I'm all for it. I would
be happy to have my
--- Paul Moore [EMAIL PROTECTED] wrote:
On Tuesday, July 17 2007 2:51:14 pm Casey Schaufler wrote:
--- Paul Moore [EMAIL PROTECTED] wrote:
Also, any reason why you don't just use the NetLabel default domain
mapping?
Uh, only that I couldn't figure out how to go about doing
On Sat, 2007-07-14 at 14:47 -0700, Casey Schaufler wrote:
The patch exceeds the 40k size rule, coming in at about 100k.
I would be happy to send the patch to anyone who has trouble
with the project site. The patch can be found under:
http:/www.schaufler-ca.com/data/smack-0710A-patch.tar
--- Stephen Smalley [EMAIL PROTECTED] wrote:
On Sat, 2007-07-14 at 14:47 -0700, Casey Schaufler wrote:
The patch exceeds the 40k size rule, coming in at about 100k.
I would be happy to send the patch to anyone who has trouble
with the project site. The patch can be found under:
On Mon, 2007-07-16 at 07:41 -0700, Casey Schaufler wrote:
--- Stephen Smalley [EMAIL PROTECTED] wrote:
On Sat, 2007-07-14 at 14:47 -0700, Casey Schaufler wrote:
The patch exceeds the 40k size rule, coming in at about 100k.
I would be happy to send the patch to anyone who has trouble
On Saturday, July 14 2007 5:47:38 pm Casey Schaufler wrote:
Smack is the Simplified Mandatory Access Control Kernel.
One general comment I have, and this is more of a nit really, is that the kdoc
comment blocks at the top of functions are _really_ nice in my opinion. I
would encourage you to
On Mon, 2007-07-16 at 08:32 -0700, Casey Schaufler wrote:
--- Stephen Smalley [EMAIL PROTECTED] wrote:
On Mon, 2007-07-16 at 07:41 -0700, Casey Schaufler wrote:
--- Stephen Smalley [EMAIL PROTECTED] wrote:
On Sat, 2007-07-14 at 14:47 -0700, Casey Schaufler wrote:
The patch
--- Stephen Smalley [EMAIL PROTECTED] wrote:
On Mon, 2007-07-16 at 08:32 -0700, Casey Schaufler wrote:
--- Stephen Smalley [EMAIL PROTECTED] wrote:
On Mon, 2007-07-16 at 07:41 -0700, Casey Schaufler wrote:
--- Stephen Smalley [EMAIL PROTECTED] wrote:
On Sat, 2007-07-14 at
--- Paul Moore [EMAIL PROTECTED] wrote:
On Saturday, July 14 2007 5:47:38 pm Casey Schaufler wrote:
Smack is the Simplified Mandatory Access Control Kernel.
One general comment I have, and this is more of a nit really, is that the
kdoc
comment blocks at the top of functions are _really_
Smack is the Simplified Mandatory Access Control Kernel.
Smack implements mandatory access control (MAC) using labels
attached to tasks and data containers, including files, SVIPC,
and other tasks. Smack is a kernel based scheme that requires
an absolute minimum of application support and a very
33 matches
Mail list logo
