RE: --EXTERNAL--Welcome to the "selinux" mailing list

[Parker, Michael D.]

What are you all doing/have done to boot strap your knowledge about SELinux?

***** ***** *****
Michael D. Parker
General Atomics - EMS
[e-mail]<mailto:[e-mail]>  <<<<< NOTE:
Remember to include my middle initial >>>>>
[phone] / Office 86-1319
16969 Mesamint Street / San Diego / CA / 92127

************************************************************************
CONFIDENTIALITY NOTICE: This communication is intended to be confidential to the
person(s) to whom it is addressed.  If you are not the intended recipient or the agent of
the
intended recipient or if you are unable to deliver this communication to the intended
recipient, you must not read, use or disseminate this information.  If you have received
this communication in error,please advise the sender immediately by telephone and delete
this messageand any attachments without retaining a copy.
*************************************************************************

--EXTERNAL--Welcome to the "selinux" mailing list

[Marko Rauhamaa]

"Parker, Michael D." <Michael.D.Parker(a)ga.com&gt;:

>  What are you all doing/have done to boot strap your knowledge about
>  SELinux? 
It's been a painful process and disillusionment.

SELinux means two distinct things:

(1) A fundamental mechanism. Most introductory material explains this
    part, and you think it must make sense.

(2) The specific application of SELinux by the Linux distros. This is a
    vast collection of prebuilt policies and attributes.


The "SELinux" you need to deal with as an administrator or a software
developer is mostly (2). The SELinux Proper (1) is as far removed from
(2) as semiconductor chemistry is from Java programming. Unfortunately,
(2) is also so complicated you shouldn't even think of coming up with a
policy on your own. Rather, you should take the distro's policy
collection as a given. The distro's administration guide lists the
available policies plus the handful of configuration parameters (aka
"booleans") that give you limited degrees of freedom.


I don't think SELinux is badly designed or implemented. I think the core
problem is that the SELinux approach to Mandatory Access Control cannot
work.

Say I want to install a piece of software that doesn't come with my
distro. Take Guix, for example. The prebuilt policies don't know
anything about it. So, as an admin, what am I to do? What directories
and files does Guix need to touch? What kinds of "transitions" do I need
to allow? What kinds of labels do I need to introduce to my system? What
kinds of tools do I need to use to integrate a Guix policy to the
prebuilt policies?

The sad answer often offered to these questions is, don't. Simply
monitor Guix running and see the complaints in the system audit log
files. Then use a special silencer tool to make SELinux shut up about
those observed complaints. After a while you hope you have charted all
of the liberties Guix needs to do its work and you make your ad-hoc
"policy" mandatory.


Marko

--EXTERNAL--Welcome to the "selinux" mailing list

[Parker, Michael D.]

My reading of your comments are that you have found the process of SELinux overly painful
to learn on a admin/developer level and more so than it needs to be.  As a result, most
people disable this additional software protection in order to make their system continue
operations without excessive having to take the time to fully understand this facility.

Unfortunately, I am in a situation where it is necessary to make this functionality work
for a development project that I am involved with.

Having to become an expert in short order is looking to be a little challenge.    I'm
up for it.  Will definitely prove useful once I understand it.

What I am (and most other admins) looking for is people to ask questions as the various
documentation out there has some differences based on when it was written.

***** ***** *****
Michael D. Parker
General Atomics - EMS
Michael.d.parker(a)ga.com  <<<<< NOTE: Remember to include my middle initial
>>>>>
[phone] / Office 86-1319
16969 Mesamint Street / San Diego / CA / 92127

************************************************************************
CONFIDENTIALITY NOTICE: This communication is intended to be confidential to the 
person(s) to whom it is addressed.  If you are not the intended recipient or the agent of
the 
intended recipient or if you are unable to deliver this communication to the intended 
recipient, you must not read, use or disseminate this information.  If you have received 
this communication in error,please advise the sender immediately by telephone and delete 
this messageand any attachments without retaining a copy.
*************************************************************************



-----Original Message-----
From: Marko Rauhamaa [mailto:[e-mail]] 
Sent: Monday, August 01, 2016 3:58 PM
To: Parker, Michael D. <Michael.D.Parker(a)ga.com&gt;
Cc: selinux(a)lists.fedoraproject.org
Subject: Re: --EXTERNAL--Welcome to the "selinux" mailing list

"Parker, Michael D." <Michael.D.Parker(a)ga.com&gt;:

>  What are you all doing/have done to boot strap your knowledge about 
>  SELinux? 
It's been a painful process and disillusionment.

SELinux means two distinct things:

(1) A fundamental mechanism. Most introductory material explains this
    part, and you think it must make sense.

(2) The specific application of SELinux by the Linux distros. This is a
    vast collection of prebuilt policies and attributes.


The "SELinux" you need to deal with as an administrator or a software developer
is mostly (2). The SELinux Proper (1) is as far removed from
(2) as semiconductor chemistry is from Java programming. Unfortunately,
(2) is also so complicated you shouldn't even think of coming up with a policy on your
own. Rather, you should take the distro's policy collection as a given. The
distro's administration guide lists the available policies plus the handful of
configuration parameters (aka
"booleans") that give you limited degrees of freedom.


I don't think SELinux is badly designed or implemented. I think the core problem is
that the SELinux approach to Mandatory Access Control cannot work.

Say I want to install a piece of software that doesn't come with my distro. Take Guix,
for example. The prebuilt policies don't know anything about it. So, as an admin, what
am I to do? What directories and files does Guix need to touch? What kinds of
"transitions" do I need to allow? What kinds of labels do I need to introduce to
my system? What kinds of tools do I need to use to integrate a Guix policy to the prebuilt
policies?

The sad answer often offered to these questions is, don't. Simply monitor Guix running
and see the complaints in the system audit log files. Then use a special silencer tool to
make SELinux shut up about those observed complaints. After a while you hope you have
charted all of the liberties Guix needs to do its work and you make your ad-hoc
"policy" mandatory.


Marko

--EXTERNAL--Welcome to the "selinux" mailing list

[Manuel Wolfshant]

On 08/02/2016 01:20 AM, Parker, Michael D. wrote:
>  What are you all doing/have done to boot strap your knowledge about 
>  SELinux?
>  
As a starter I strongly recommend the Selinux Coloring Book ( 
https://github.com/mairin/selinux-coloring-book ) . You can then 
continue with the presentation from 
https://www.youtube.com/watch?v=bQqX3RWn0Yw

Once you feel familiar enough, good reads are the selinux related links 
from https://docs.fedoraproject.org/en-US/Fedora/ , for instance 
https://docs.fedoraproject.org/en-US/Fedora/24/html/SELinux_Users_and_Adm...

( and/or the earlier guides, there are several starting from Fedora 13)

And last but not least, do not feel shy to ask in #selinux ( freenode ) 
or even over here... even if, just like me, your first iteration of a 
policy is laughable. No one was born with intrinsic knowledge, we all 
learned and are still learning. And the selinux knowledgeable people 
from these two avenues are among the best teachers I've met in 30 years 
of practice


wolfy, adopter of selinux in 2005 and still using it

--EXTERNAL--Welcome to the "selinux" mailing list

[Maria Iano]

The approach I used some years ago was to start by reading the NSA docs as best I could,
though I did not take them in even close to fully, but I’m still glad I didn’t skip that
step. They seem to be here now, I’m out of date at this point
https://www.nsa.gov/what-we-do/research/selinux/documentation/

Next I read the some redhat and centos docs for practical steps to get the targeted policy
running on my systems - they are a relief at that point! It has boiled down for me to
fixing file context rules first and only adding new policy rules when there was a need and
it made sense. There have been times when I generated policy blindly with the tool
audit2allow just to get something running as being better than nothing. But experience has
shown me that it is worth the time when I have it to figure out which of those were needed
and which I was better off blocking. SELinux has been my friend in terms of saving me from
buggy software as well. Let me know if you’d like some links.

Also this is cool:
http://people.redhat.com/duffy/selinux/selinux-coloring-book_A4-Stapled.pdf

Maria

>  On Aug 1, 2016, at 6:20 PM, Parker, Michael D.
> <Michael.D.Parker(a)ga.com&gt; wrote:
>  
>  What are you all doing/have done to boot strap your knowledge about SELinux?
>   
>  ***** ***** *****
>  Michael D. Parker
>  General Atomics - EMS
>  Michael.d.parker(a)ga.com  <<<<< NOTE: Remember to include my middle initial
> >>>>>
>  [phone] / Office 86-1319
>  16969 Mesamint Street / San Diego / CA / 92127
>   
>  ************************************************************************
>  CONFIDENTIALITY NOTICE: This communication is intended to be confidential to the
>  person(s) to whom it is addressed.  If you are not the intended recipient or the agent of
> the
>  intended recipient or if you are unable to deliver this communication to the intended
>  recipient, you must not read, use or disseminate this information.  If you have received
>  this communication in error,please advise the sender immediately by telephone and delete
>  this messageand any attachments without retaining a copy.
>  *************************************************************************
>   
>  --
>  selinux mailing list
>  selinux(a)lists.fedoraproject.org
>  https://lists.fedoraproject.org/admin/lists/[e-mail]

[selinux] RE: --EXTERNAL--Welcome to the "selinux" mailing list

[Robin Lee Powell]

On Mon, Aug 01, 2016 at 10:20:32PM +0000, Parker, Michael D. wrote:
>  What are you all doing/have done to boot strap your knowledge about
> SELinux? 
I was reasonably happy with https://www.amazon.com/dp/B00FEFRG4O/ ,
although what I actually did was disabled unconfined on my system
and asked a lot of questions trying to put it back together.  :)

[selinux] RE: --EXTERNAL--Welcome to the "selinux" mailing list

[Philip Seeley]

I found Sven's cookbook a good first step for when you go beyond sys admin
and into policy writing:

https://www.packtpub.com/networking-and-servers/selinux-cookbook

Taking the time to understand how the referece policy is structured will
really help, as you will always be using its interfaces in your policies:

https://github.com/TresysTechnology/refpolicy/wiki

There's no real substitute for getting in there and confining your first
service though.

Cheers

Phil



From:	Robin Lee Powell <rlpowell(a)digitalkingdom.org&gt;
To:	"Parker, Michael D." <Michael.D.Parker(a)ga.com&gt;
Cc:	&quot;selinux(a)lists.fedoraproject.org&quot;
            <selinux(a)lists.fedoraproject.org&gt;
Date:	02/08/2016 17:22
Subject:	Re: [selinux] RE: --EXTERNAL--Welcome to the "selinux" mailing
            list





On Mon, Aug 01, 2016 at 10:20:32PM +0000, Parker, Michael D. wrote:
>  What are you all doing/have done to boot strap your knowledge about
SELinux?

I was reasonably happy with https://www.amazon.com/dp/B00FEFRG4O/ ,
although what I actually did was disabled unconfined on my system
and asked a lot of questions trying to put it back together.  :)
--
selinux mailing list
selinux(a)lists.fedoraproject.org
https://lists.fedoraproject.org/admin/lists/[e-mail]