Mandatory Access Controls on RESEARCHUT

SystemTap in Debian

rrs@researchut.com (Ritesh Raj Sarraf) — Thu, 08 Jul 2010 18:08:00 -0400

The latest kernel upload (2.6.32-16) brings goodies to SystemTap in Debian. This version has added support for kprobes, on which systemtap has a major dependency, for many of its features.

Most of the systemtap instrumentation should work now and all of this will be part of the Squeeze release. Instrumenting the kernel modules still needs some work (DBTS: #555549) but can be done.

tomoyo for debian

rrs@researchut.com (Ritesh Raj Sarraf) — Tue, 11 May 2010 03:50:00 -0400

Just uploaded tomoyo-tools and is waiting in the NEW queue.

Thanks to Moritz Muehlenhoff, tomoyo kernel support should be available in Debian with kernel 2.6.32-13 and above.

What is Tomoyo ?

Description: Lightweight and easy-use Mandatory Access Control for Linux

TOMOYO Linux is Lightweight and Usable Mandatory Access Control with

- “automatic policy configuring” feature by “LEARNING mode”

- administrators friendly policy language

- no need libselinux nor userland program modifications

TOMOYO Linux consists of patches to Linux kernel and administrative

utilities, and this package contains its audit daemon and tools.

Description: Lightweight and easy-use Mandatory Access Control for Linux

TOMOYO Linux is Lightweight and Usable Mandatory Access Control with

- “automatic policy configuring” feature by “LEARNING mode”

- administrators friendly policy language

- no need libselinux nor userland program modifications .

TOMOYO Linux consists of patches to Linux kernel and administrative utilities, and this package contains its audit daemon and tools.

SELinux in Debian

rrs@researchut.com (Ritesh Raj Sarraf) — Thu, 11 Dec 2008 16:46:00 -0500

Thanks to Pierre Chifflier , Debian now has setroubleshoot packaged. The good thing about setroubleshoot is that it gives you a very user friendly message about the SELinux violations that occur on your box while you were doing something.

Now that something is very difficult to define (at least for Debian). My day job requires me to work on the RHELdistribution which has very good SELinux policy defined (Same is the case with Fedora). Here’s a list of things which Debian’s SELinux policy lacks and that RHEL/Fedora’s doesn’t

acpi -V raises a violataion
dmesg raises a violation
apt-get update raises a violation
You can’t suspend, that raises a violation
nvidia module load raises a violation (Oh!! Well. That’s binary-only.

But the same doesn’t raise a violation in Fedora)

So even though I’d love to use SELinux on Debian, I can’t. Basic tasks are seen as violation by the Debian SELinux Policy. Try out enabling SELinux in Permissive mode and install setroubleshoot. You’ll see setroubleshoot pop-up a SELinux violation every 5 seconds. Turns out that Debian’s SELinux policy is becoming just too too much secure and thus interfering with the user using the OS.