Hello.
Mark wrote:
> Even though I have already let go of my desire to get everything up and
> running in 10 minutes, so to speak, I would like to be taught about
> which choices I can make so that I learn which choices make sense. In my
> particular use case it's for a server running a collection of standard
> Internet daemons like an MTA, a webserver and a DNS server.
OK. You want to know when to do (or not to do) domain transitions, right?
Simple (and hopefully reasonable) approach for protection purpose will be
(a) apply initialize_domain directive to each init script and each daemon
program
and
(b) apply keep_domain directive to each init script
.
In this way, total number of domains will be kept small while applying
fine-grained restriction.
/usr/lib/tomoyo/init_policy tries to follow the approach listed above.
But since the database built into init_policy is outdated (this database was
made in the era of Red Hat Linux 9 and Debian 3.1, and desktop applications
were not taken into account), you would need to manually adjust keep_domain
entries and initialize_domain entries (especially for daemons and desktop
applications like web browsers).
For postfix as an example, you can specify
initialize_domain /path/to/init/script/for/postfix
keep_domain /path/to/init/script/for/postfix
initialize_domain /path/to/main/program/of/postfix
, and you can optionally specify
keep_domain /path/to/main/program/of/postfix
if you are not interested in splitting subprograms executed from main program.
You can use /usr/sbin/tomoyo-pstree to see whether daemon programs are running
in the domain you intended.
Well, TOMOYO is also an analysis tool. For those who want to study how Linux
systems work, all initialize_domain entries and keep_domain entries can be
removed. While I had no experience in administrating Linux systems, I improved
the skill of administrating Linux systems to the level of passing LPIC 303 exam
via developing and using TOMOYO. ;-)
_______________________________________________
tomoyo-users-en mailing list
[email protected]
http://lists.sourceforge.jp/mailman/listinfo/tomoyo-users-en
