February 7, 2007
This article was contributed by Jake Edge.
Complaints about SELinux often center
around its overall complexity and the difficulty in developing policies
for applications that run on the system. The
SELinux Policy IDE
(SLIDE) is an Eclipse plug-in that provides a framework for developing and
testing policies that should help reduce some of these problems.
SELinux is a security framework
that uses the Linux Security Module (LSM) kernel interface to implement
mandatory access control (MAC) mechanism. MAC controls the capabilities that a
particular process can have based on the policies installed by the
administrator. Those policies govern much more than traditional
UNIX-style permissions and for that reason can be difficult to
generate and especially to test. Readers of this page will remember an
overview that covers
a bit more detail about SELinux internals.
SLIDE is an effort to ease the process of developing policies with an
eye towards applications and daemons that have policy support.
To do that, it uses the popular Eclipse integrated development
environment (IDE) as a way to organize and control policy development.
It provides all of the expected capabilities within Eclipse: syntax
highlighting, auto-completion, integrated searching, etc. One of the
biggest hurdles that developers face is keeping track of the various
interfaces, types, roles, and modules and how they interact; SLIDE
organizes and indexes them, along with their comments, and makes that
available in a nice GUI.
The testing features are particularly useful; one can set up a remote
machine (or local virtual machine) that can accept policy updates from
SLIDE. Once the updates have been accepted, various tests can be kicked
off on the remote machine and the audit log can be monitored to determine
whether the policies covered all of the required resources. If not, the
policy can be modified in SLIDE, pushed out to the remote machine and tested
again.
SLIDE is a project of Tresys Technology,
which has released it under the GPL. It does not appear to have attracted
much of a development community, at least yet and the SourceForge project
page has not
been updated in quite some time. The
documentation
and trac site provided by Tresys are excellent. Perhaps the SourceForge
project was an attempt to enlist community aid which did not attract the
level of interest that they might have hoped for. It is a fairly esoteric
subject that does not cause too many open source developers to itch. Many
of those developers, perhaps, simply turn SELinux off.
As with most complex tools, SLIDE will not be terribly helpful to those who
know little about SELinux policies. It has a steep learning curve even if
you have a bit of that background, but for experts it is probably quite
intuitive. For those reasons, it probably will not help other projects
to generate policies for their software. In order to foster more
applications with SELinux policies, it is likely that experts in policy
development will have to join forces with these other projects to produce
and maintain the policies. Using SLIDE will likely speed up that process and
it is a welcome addition to a fairly sparse toolkit.
Comments (4 posted)
