systrace + selinux + fedora core 4ish?

[Justin Conover]

http://www.systrace.org/

http://www.citi.umich.edu/u/provos/systrace/linux.html

Anybody, seen/use systrace on FC?  What are your thoughts about
using/adding it to FC?

> From reading a bit about it, looks to be a very good/useful tool and
was wondering what others thought about it?

[Colin Walters]

On Mon, 2005-01-17 at 21:03 -0600, Justin Conover wrote:
>  http://www.systrace.org/
>  
>  http://www.citi.umich.edu/u/provos/systrace/linux.html
>  
>  Anybody, seen/use systrace on FC?  What are your thoughts about
>  using/adding it to FC?
>
>  >From reading a bit about it, looks to be a very good/useful tool and
>  was wondering what others thought about it? 
My opinion is that it is essentially an inferior implementation of much
of the functionality SELinux provides.  It does have some additional
features like the dynamic privilege elevation that seem possibly useful,
but I don't think it makes sense to use systrace just for that.

For example, from the "usr_sbin_httpd" policy:
(http://www.citi.umich.edu/u/provos/systrace/usr_sbin_httpd):

native-kill: permit

As far as I can tell, this rule permits the "unprivileged" httpd to kill
any other process it wants with the same uid, and should the root
portion be compromised, any process can be killed.  The language just
doesn't allow you to express anything more fine-grained like the SELinux
TE language does.

On Mon, 17 Jan 2005 22:36:51 EST, Colin Walters said:

>  My opinion is that it is essentially an inferior implementation of
> much
>  of the functionality SELinux provides.  It does have some additional
>  features like the dynamic privilege elevation that seem possibly useful,
>  but I don't think it makes sense to use systrace just for that. 
I admit not having read the Systrace stuff yet.  Are there any features that
SELinux would benefit from implementing similar functionality?

[Stephen Smalley]

On Mon, 2005-01-17 at 22:03, Justin Conover wrote:
>  http://www.systrace.org/
>  
>  http://www.citi.umich.edu/u/provos/systrace/linux.html
>  
>  Anybody, seen/use systrace on FC?  What are your thoughts about
>  using/adding it to FC?
>  
>  >From reading a bit about it, looks to be a very good/useful tool and
>  was wondering what others thought about it? 
Providing security via system call interception and making security
decisions based on pathnames considered harmful to security; see the
Flask paper available from
http://www.nsa.gov/selinux/papers/flask-abs.cfm.  Sadly, the systrace
site acknowledges the Flask paper, but misses the point entirely...

-- 
Stephen Smalley <sds(a)epoch.ncsc.mil&gt;
National Security Agency