Back on list, please don't go private unless there is a good reason
[EMAIL PROTECTED] wrote:
Can you estimate, when will the transition to the new reference policy be completed?
its done now, check the selinux docs
Can you give a hint on some SELinux tools providing the same functionality as grlearn in Grsecurity? What are the other tools for creating SELinux rules?
audit2allow can now build loadable policy modules, there are also some tools that redhat has that haven't been put in portage (blame PeBenito) like policygentool in the selinux-policy-devel rpms. There are also things like SLIDE (http://oss.tresys.com/projects/slide) that are being worked on.
I'm currently using Grsecurity (/w RBAC), but I'm inspecting the possibilities of SELinux. It's good to see, that its policy is thoroughly planned, and it would be good to have a tool, which would help in creating new rules and warning the user about ignoring any security goals.
the best thing is to look at the denials and decide which ones are important and which can be ignored, this shouldn't be hard depending on your applications, etc.
In Grsecurity a user should authenticate itself as an admin to become a real root. The grsec passwords are stored at a separate place and in a different manner. If an attacker would somehow guess the root password, (s)he should crack the password system of grsecurity also. Which would be quite hard, since root has limited rights. However in SELinux - if my interpretation is correct - one should provide the same password while authenticating himself to gain full access.
there is no such thing as "real root" in selinux, if root has no privileged roles logging on as root won't do any good. Obviously the admin always needs the possibility of getting sysadm_r and possibly disabling SELinux, this can be controlled with a policy boolean though, setsebool secure_mode_policyload=1 will disable setting permissive, loading policies or otherwise changing the running policy in any way.
Don't you think, that the idea of two separate authentication systems is better, than storing all passwords in the same manner?
nope.
Regards, Dwokfur
-- [email protected] mailing list
