| |||||||||||||
The isolate utilityThe isolate utilityPosted Jan 7, 2010 10:58 UTC (Thu) by trasz (guest, #45786)In reply to: The isolate utility by drag Parent article: The isolate utility
It's worth noting that everything you mentioned - various kinds of MAC policies - are already available in FreeBSD; the main difference compared to SELinux is that the FreeBSD implementation is modular, simple to understand and to maintain. That's the reason that porting SELinux to FreeBSD is stalled, I guess.
(Log in to post comments)
The isolate utility Posted Jan 7, 2010 15:13 UTC (Thu) by drag (subscriber, #31333) [Link]
The only mention of MAC stuff in FreeBSD's documentation is this
'TrustedBSD' stuff
http://www.freebsd.org/doc/en/books/arch-handbook/mac.html
Which is the port of Flask/SELinux from Linux to Darwin to FreeBSD.
What am I missing here?
----------------
Also the above people mis characterized SELinux as being the 'one true
Redhat and Fedora, of course, still focus on SeLinux, of course. Probably
The isolate utility Posted Jan 7, 2010 21:21 UTC (Thu) by martinko (guest, #62862) [Link]
MAC is no Flask/SELinux -- please read better!
http://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook...
Also you may want to educate yourself what really TrustedBSD is and about it's affiliation with FreebBSD.
;-)
The isolate utility Posted Jan 18, 2010 11:26 UTC (Mon) by trasz (guest, #45786) [Link]
FreeBSD MAC, implemented as part of TrustedBSD and ported to Darwin/MacOS X,, is not a port of SELinux - it's a MAC framework and a set of modules implementing policies. Port of SELinux would be just another policy module.
The isolate utility Posted Jan 7, 2010 21:10 UTC (Thu) by dpquigl (subscriber, #52852) [Link]
SELinux was already ported to BSD in the form of SE-BSD which is where the MAC framework that BSD currently enjoys came from. The issue with having the SE-BSD code in the core BSD code is because of licensing issues. Some of the code needed from SELinux for SEBSD is GPL licensed which prevents it from being incorporated into the areas of FreeBSD where it is needed. I haven't looked into this very much but when considering reviving the SEBSD code for use with a BSD Labeled NFS prototype I was told the stumbling block for getting SEBSD integrated into the BSD core was to do with the license on the code.
The isolate utility Posted Jan 18, 2010 11:31 UTC (Mon) by trasz (guest, #45786) [Link]
Again, not true. Port of SELinux would be just another policy enforcement module. Existing policies work fine without it - and they have an advantage of being simple to understand.
The isolate utility Posted Jan 7, 2010 21:15 UTC (Thu) by dpquigl (subscriber, #52852) [Link]
Also another thing worth noting is none of the MAC modules in BSD are considered "production ready". I was looking at using the MLS module to showcase label translation in Labeled NFS and when I spoke with Robert Watson (MAC Framework/SEBSD developer) he said that the MLS implementation isn't very full featured and it is there as an example for vendors to take and extend into a more full featured implementation. Also not until FreeBSD 8.0 was the MAC framework enabled in their kernel by default. It was present in the source tree but from what I understand you needed to rebuild your kernel to enable it (mainly due to overhead concerns).
The isolate utility Posted Jan 7, 2010 21:34 UTC (Thu) by dpquigl (subscriber, #52852) [Link]
I should probably rephrase this. The MLS and Biba modules weren't adequate for use without further enhancements. I didn't realize there were so many BSD MAC modules so some of them are probably production ready.
The isolate utility Posted Jan 8, 2010 0:02 UTC (Fri) by drag (subscriber, #31333) [Link]
I guess it's like Linux were you have the pluggable security module
framework were Selinux is just one of many possible frameworks.
It'll be interesting to see what evolves out of this approach.
The isolate utility Posted Jan 8, 2010 0:43 UTC (Fri) by dpquigl (subscriber, #52852) [Link]
They model is different than the LSM. Historically the LSM framework has been anti stacking and for some pretty good reasons. The BSD framework has every model as a separate module that can be loaded in. They have quite a few modules for a variety of functions. They have one MLS module, two integrity modules, a module to place programs in selective jail like separations called partitions, a module to protect ports, some modules for disabling network access and "firewalling" the file system. The soundness of some of the models are up for debate but they are there none the less.
The isolate utility Posted Jan 18, 2010 11:29 UTC (Mon) by trasz (guest, #45786) [Link]
When was that, exactly? Among several things that happened in FreeBSD last year was inclusion of MAC in the default kernel and removing the "experimental" status.
|
|||||||||||||