| |||||||||||||
The isolate utilityThe isolate utilityPosted Jan 7, 2010 21:15 UTC (Thu) by dpquigl (subscriber, #52852)In reply to: The isolate utility by trasz Parent article: The isolate utility
Also another thing worth noting is none of the MAC modules in BSD are considered "production ready". I was looking at using the MLS module to showcase label translation in Labeled NFS and when I spoke with Robert Watson (MAC Framework/SEBSD developer) he said that the MLS implementation isn't very full featured and it is there as an example for vendors to take and extend into a more full featured implementation. Also not until FreeBSD 8.0 was the MAC framework enabled in their kernel by default. It was present in the source tree but from what I understand you needed to rebuild your kernel to enable it (mainly due to overhead concerns).
(Log in to post comments)
The isolate utility Posted Jan 7, 2010 21:34 UTC (Thu) by dpquigl (subscriber, #52852) [Link]
I should probably rephrase this. The MLS and Biba modules weren't adequate for use without further enhancements. I didn't realize there were so many BSD MAC modules so some of them are probably production ready.
The isolate utility Posted Jan 8, 2010 0:02 UTC (Fri) by drag (subscriber, #31333) [Link]
I guess it's like Linux were you have the pluggable security module
framework were Selinux is just one of many possible frameworks.
It'll be interesting to see what evolves out of this approach.
The isolate utility Posted Jan 8, 2010 0:43 UTC (Fri) by dpquigl (subscriber, #52852) [Link]
They model is different than the LSM. Historically the LSM framework has been anti stacking and for some pretty good reasons. The BSD framework has every model as a separate module that can be loaded in. They have quite a few modules for a variety of functions. They have one MLS module, two integrity modules, a module to place programs in selective jail like separations called partitions, a module to protect ports, some modules for disabling network access and "firewalling" the file system. The soundness of some of the models are up for debate but they are there none the less.
The isolate utility Posted Jan 18, 2010 11:29 UTC (Mon) by trasz (guest, #45786) [Link]
When was that, exactly? Among several things that happened in FreeBSD last year was inclusion of MAC in the default kernel and removing the "experimental" status.
|
|||||||||||||