.pp files

[Salvo Giuffrida]

What is the function of the .pp files in 
/etc/selinux/targeted/modules/active/modules?
I read a book from O'Reilly (SELinux - NSA's Open Source Security Enhanced 
Linux) and there's no mention of their function...
Thanks a lot

_________________________________________________________________
Ricerche online più semplici e veloci con MSN Toolbar! 
http://toolbar.msn.it/

[Paul Howarth]

Salvo Giuffrida wrote:
>  What is the function of the .pp files in 
>  /etc/selinux/targeted/modules/active/modules?
>  I read a book from O'Reilly (SELinux - NSA's Open Source Security 
>  Enhanced Linux) and there's no mention of their function...
>  Thanks a lot 
The .pp files are the compiled policy module packages that are loaded 
using semodule into the running policy.

Paul.

[Rahul Sundaram]

Salvo Giuffrida wrote:
>  What is the function of the .pp files in 
>  /etc/selinux/targeted/modules/active/modules?
>  I read a book from O'Reilly (SELinux - NSA's Open Source Security 
>  Enhanced Linux) and there's no mention of their function...
>  Thanks a lot
>   
That book is very outdated now. More updated information is available 
from http://fedoraproject.org/wiki/SELinux. The "pp" extension stands 
for policy package files which implement loadable policy modules.

http://fedoraproject.org/wiki/SELinux/FC5Features

Rahul

[Salvo Giuffrida]

So, what's now the role of the policy.number file in /etc/..../policy? Can 
one still use the "old way" of modifying the source, and recompile into a 
big binary file?
Another thing, please: What's the "Object manager"?
Thanks


> From: Rahul <sundaram(a)fedoraproject.org&gt;
> To: Salvo Giuffrida <giuffsalvo(a)hotmail.it&gt;
> CC: fedora-selinux-list(a)redhat.com
> Subject: Re: .pp files
> Date: Tue, 19 Sep 2006 22:35:44 +0530
>
> Salvo Giuffrida wrote:
> >What is the function of the .pp files in 
> >/etc/selinux/targeted/modules/active/modules?
> >I read a book from O'Reilly (SELinux - NSA's Open Source Security Enhanced 
> >Linux) and there's no mention of their function...
> >Thanks a lot
> >
>
> That book is very outdated now. More updated information is available from 
> http://fedoraproject.org/wiki/SELinux. The "pp" extension stands for policy 
> package files which implement loadable policy modules.
>
> http://fedoraproject.org/wiki/SELinux/FC5Features
>
> Rahul 
_________________________________________________________________
Condivi foto, pensieri ed altro ancora creando il tuo Blog su Windows Live 
Spaces ! http://discoverspaces.live.com/?loc=it-IT

[Stephen Smalley]

On Tue, 2006-09-19 at 19:36 +0200, Salvo Giuffrida wrote:
>  So, what's now the role of the policy.number file in
> /etc/..../policy? Can 
>  one still use the "old way" of modifying the source, and recompile into a 
>  big binary file? 
The policy modules are linked together and expanded into a kernel binary
policy image, which is then installed to that file for loading into the
kernel.

You don't absolutely have to use modular/managed policy, but doing so
has definite benefits, and both users and package scriptlets are
increasingly taking advantage of semodule and semanage for managing
policy in a modular way and customizing certain policy settings, and the
dependencies on it are only going to increase in the future as further
management infrastructure is created.

BTW, while the O'Reilly book predates the modular policy support
(possibly they'll issue an updated edition sometime, I don't know),
there is a newer SELinux book that includes discussion of policy modules
by people involved in their development, see:
http://selinuxnews.org/wp/index.php/2006/08/09/new-selinux-book-published/
http://mentalrootkit.org/?p=10

>  Another thing, please: What's the "Object manager"?
That's a term used in the Flask security architecture, which SELinux
implements.  See:
http://www.nsa.gov/selinux/papers/flask-abs.cfm

-- 
Stephen Smalley
National Security Agency

[Salvo Giuffrida]

Thanks a lot for the answer. I have another question, please: Where can I 
find the list of all the object classes (file, dir, netif, etc...), and the 
operations associated to each one of them?
Thanks a lot

> From: Stephen Smalley <sds(a)tycho.nsa.gov&gt;
> To: Salvo Giuffrida <giuffsalvo(a)hotmail.it&gt;
> CC: sundaram(a)fedoraproject.org, fedora-selinux-list(a)redhat.com
> Subject: Re: .pp files
> Date: Wed, 20 Sep 2006 15:04:29 -0400
>
> On Tue, 2006-09-19 at 19:36 +0200, Salvo Giuffrida wrote:
>  > So, what's now the role of the policy.number file in /etc/..../policy? 
> Can
>  > one still use the "old way" of modifying the source, and recompile into 
> a
>  > big binary file?
>
> The policy modules are linked together and expanded into a kernel binary
> policy image, which is then installed to that file for loading into the
> kernel.
>
> You don't absolutely have to use modular/managed policy, but doing so
> has definite benefits, and both users and package scriptlets are
> increasingly taking advantage of semodule and semanage for managing
> policy in a modular way and customizing certain policy settings, and the
> dependencies on it are only going to increase in the future as further
> management infrastructure is created.
>
> BTW, while the O'Reilly book predates the modular policy support
> (possibly they'll issue an updated edition sometime, I don't know),
> there is a newer SELinux book that includes discussion of policy modules
> by people involved in their development, see:
> http://selinuxnews.org/wp/index.php/2006/08/09/new-selinux-book-published/
> http://mentalrootkit.org/?p=10
>
>  > Another thing, please: What's the "Object manager"?
>
> That's a term used in the Flask security architecture, which SELinux
> implements.  See:
> http://www.nsa.gov/selinux/papers/flask-abs.cfm
>
> --
> Stephen Smalley
> National Security Agency
>  
_________________________________________________________________
Personalizza MSN Messenger con sfondi e fotografie! 
http://www.ilovemessenger.msn.it/

[Stephen Smalley]

On Thu, 2006-09-21 at 00:51 +0200, Salvo Danilo Giuffrida wrote:
>  Thanks a lot for the answer. I have another question, please: Where
> can I 
>  find the list of all the object classes (file, dir, netif, etc...), and the 
>  operations associated to each one of them? 
The authors of the SELinux by Example book maintain a list on their site
(and include a listing in an appendix of that book), over at:
http://www.tresys.com/selinux/obj_perms_help

Naturally, all such documentation will always be behind the latest
changes - the only "authoritative" list is contained in the policy/flask
files in the policy source tree, which provide the definitions to the
policy and are also used to generate the headers used by the kernel and
libselinux.

-- 
Stephen Smalley
National Security Agency