Re: [MeeGo-dev] Security architecture

2010-07-01 Thread Yves-Alexis Perez
On 10/06/2010 14:17, Janne Karhunen wrote: On Thu, Jun 10, 2010 at 12:37 AM, Greg KH gre...@suse.de wrote: MeeGo security architecture will be base on Maemo6 (Harmattan) model and codebase. More details about that: http://fosdem.org/2010/schedule/events/maemo Nokia is open sourcing the

Re: [MeeGo-dev] Security architecture

2010-06-16 Thread Mats BERGSTROM
Reshetova Subject: Re: [MeeGo-dev] Security architecture On Thu, Jun 10, 2010 at 12:37 AM, Greg KH gre...@suse.de wrote: MeeGo security architecture will be base on Maemo6 (Harmattan) model and codebase. More details about that: http://fosdem.org/2010/schedule/events/maemo Nokia is open sourcing

Re: [MeeGo-dev] Security architecture

2010-06-16 Thread Janne Karhunen
On Wed, Jun 16, 2010 at 5:09 PM, Mats BERGSTROM mats.m.bergst...@stericsson.com wrote: Hi,        I totally appreciate your battle not being a stranger to them myself :* However, are you able to guesstimate an ETA? Come over to OLS and/or Security summit. This will be presented properly in

Re: [MeeGo-dev] Security architecture

2010-06-10 Thread Tomas Frydrych
Hi, On 09/06/10 22:38, Thiago Macieira wrote: FYI, a number of patches were posted to the D-Bus mailing list a couple of days ago. As expected, the mailing list's reaction was use PolKit... I wonder, why was it expected ? Looking through the dbus archive, the mailing list reaction to the

Re: [MeeGo-dev] Security architecture

2010-06-10 Thread Thiago Macieira
Em Quinta-feira 10 Junho 2010, às 12:59:13, Tomas Frydrych escreveu: As expected, the mailing list's reaction was use PolKit... I wonder, why was it expected ? Well, it was expected to me. A few months ago, I was contacted about some questions on modifying D-Bus, which looked like a

Re: [MeeGo-dev] Security architecture

2010-06-10 Thread Janne Karhunen
On Thu, Jun 10, 2010 at 12:37 AM, Greg KH gre...@suse.de wrote: MeeGo security architecture will be base on Maemo6 (Harmattan) model and codebase. More details about that: http://fosdem.org/2010/schedule/events/maemo Nokia is open sourcing the security componets starting now. now?  Cool,

Re: [MeeGo-dev] Security architecture

2010-06-10 Thread Shaz
On Thu, Jun 10, 2010 at 5:24 PM, Shaz shazal...@gmail.com wrote: On Thu, Jun 10, 2010 at 5:17 PM, Janne Karhunen janne.karhu...@gmail.comwrote: On Thu, Jun 10, 2010 at 12:37 AM, Greg KH gre...@suse.de wrote: MeeGo security architecture will be base on Maemo6 (Harmattan) model and

Re: [MeeGo-dev] Security architecture

2010-06-10 Thread Janne Karhunen
On Thu, Jun 10, 2010 at 3:24 PM, Shaz shazal...@gmail.com wrote: Effective bits in access control are quite simple and similar to SMACK. Check the linux-security-module discussion for starters. The 'real' difference between smack and this is that we support multiple task labels and the fact

Re: [MeeGo-dev] Security architecture

2010-06-10 Thread Janne Karhunen
On Thu, Jun 10, 2010 at 12:38 AM, Thiago Macieira thi...@kde.org wrote: FYI, a number of patches were posted to the D-Bus mailing list a couple of days ago. As expected, the mailing list's reaction was use PolKit... Duh, that was just Pekka going solo and nothing more serious than that..

Re: [MeeGo-dev] Security architecture

2010-06-10 Thread Shaz
On Thu, Jun 10, 2010 at 5:41 PM, Janne Karhunen janne.karhu...@gmail.comwrote: On Thu, Jun 10, 2010 at 3:24 PM, Shaz shazal...@gmail.com wrote: Effective bits in access control are quite simple and similar to SMACK. Check the linux-security-module discussion for starters. The 'real'

Re: [MeeGo-dev] Security architecture

2010-06-10 Thread Janne Karhunen
On Thu, Jun 10, 2010 at 4:33 PM, Shaz shazal...@gmail.com wrote: Effective bits in access control are quite simple and similar to SMACK. Check the linux-security-module discussion for starters. The 'real' difference between smack and this is that we support multiple task labels and the

Re: [MeeGo-dev] Security architecture

2010-06-10 Thread Shaz
Task can hold tokens named 'Calendar' and 'Phonebook' for accessing these interfaces. Or, we can drop this even lower by saying Calendar::function and everything else is not granted for. This is where dbus comes in ... right? And now I am loosing what LSM and rbac does here :) Do you

Re: [MeeGo-dev] Security architecture

2010-06-10 Thread Janne Karhunen
On Thu, Jun 10, 2010 at 4:55 PM, Shaz shazal...@gmail.com wrote: Task can hold tokens named 'Calendar' and 'Phonebook' for accessing these interfaces. Or, we can drop this even lower by saying Calendar::function and everything else is not granted for. This is where dbus comes in ... right?

Re: [MeeGo-dev] Security architecture

2010-06-10 Thread Shaz
On Thu, Jun 10, 2010 at 8:07 PM, Janne Karhunen janne.karhu...@gmail.comwrote: On Thu, Jun 10, 2010 at 4:55 PM, Shaz shazal...@gmail.com wrote: Task can hold tokens named 'Calendar' and 'Phonebook' for accessing these interfaces. Or, we can drop this even lower by saying

Re: [MeeGo-dev] Security architecture

2010-06-10 Thread Shaz
On Thu, Jun 10, 2010 at 11:20 PM, Elena Reshetova elena.reshet...@gmail.com wrote: Hi, Let me try to answer some questions. How can we fit this in TCG MPWG and OMTP TR0/1 specs? I prefer to speak about the needed properties/features, rather than about particular specs unless there is a

Re: [MeeGo-dev] Security architecture

2010-06-10 Thread Ware, Ryan R
On 6/10/10 12:04 PM, Shaz shazal...@gmail.com wrote: On Thu, Jun 10, 2010 at 11:59 PM, Janne Karhunen janne.karhu...@gmail.com wrote: On Thu, Jun 10, 2010 at 9:39 PM, Shaz shazal...@gmail.com wrote: Do you have in mind a particular use case and risks you wish to protect against? I can take

Re: [MeeGo-dev] Security architecture

2010-06-10 Thread Ware, Ryan R
We also need to take into account that this solution needs to work on non-ARM hardware. ;-) Ryan On 6/10/10 9:56 AM, Shaz shazal...@gmail.com wrote: Secondly, I do agree that EVM is not very suitable for trustzone but what is more suitable? In my opinion a single file protected by

Re: [MeeGo-dev] Security architecture

2010-06-10 Thread Shaz
On Thu, Jun 10, 2010 at 11:56 PM, Ware, Ryan R ryan.r.w...@intel.comwrote: We also need to take into account that this solution needs to work on non-ARM hardware. ;-) Non ARM is much more easy because we will be dealing with TPM chip and TXT. Does atom based boards come with TPM. If yes I

[MeeGo-dev] Security architecture

2010-06-09 Thread Shaz
Dear all, I work on security engineering of client side and I am interested to know what the developments are at meego community. It would be a pleasure if I can contribute. I was told to contact Ryan who leads the security team but I have no idea how to ping him therefore addressing the

Re: [MeeGo-dev] Security architecture

2010-06-09 Thread Poussa Sakari
On 06/09/10 22:11, ext Shaz wrote: Dear all, I work on security engineering of client side and I am interested to know what the developments are at meego community. It would be a pleasure if I can contribute. I was told to contact Ryan who leads the security team but I have no idea how to ping

Re: [MeeGo-dev] Security architecture

2010-06-09 Thread Thiago Macieira
Em Quarta-feira 9. Junho 2010, às 22.55.32, Poussa Sakari escreveu: Nokia is open sourcing the security componets starting now. It includes kernel modules, userspace libs, D-Bus patches, API documentation, etc. The plan is to start integrating that to MeeGo during summer time. This of course

Re: [MeeGo-dev] Security architecture

2010-06-09 Thread Greg KH
On Wed, Jun 09, 2010 at 11:55:32PM +0300, Poussa Sakari wrote: On 06/09/10 22:11, ext Shaz wrote: Dear all, I work on security engineering of client side and I am interested to know what the developments are at meego community. It would be a pleasure if I can contribute. I was told to