SLIDE into SELinux policy development

Complaints about SELinux often center around its overall complexity and the difficulty in developing policies for applications that run on the system. The SELinux Policy IDE (SLIDE) is an Eclipse plug-in that provides a framework for developing and testing policies that should help reduce some of these problems.

SELinux is a security framework that uses the Linux Security Module (LSM) kernel interface to implement mandatory access control (MAC) mechanism. MAC controls the capabilities that a particular process can have based on the policies installed by the administrator. Those policies govern much more than traditional UNIX-style permissions and for that reason can be difficult to generate and especially to test. Readers of this page will remember an overview that covers a bit more detail about SELinux internals.

SLIDE is an effort to ease the process of developing policies with an eye towards applications and daemons that have policy support. To do that, it uses the popular Eclipse integrated development environment (IDE) as a way to organize and control policy development. It provides all of the expected capabilities within Eclipse: syntax highlighting, auto-completion, integrated searching, etc. One of the biggest hurdles that developers face is keeping track of the various interfaces, types, roles, and modules and how they interact; SLIDE organizes and indexes them, along with their comments, and makes that available in a nice GUI.

The testing features are particularly useful; one can set up a remote machine (or local virtual machine) that can accept policy updates from SLIDE. Once the updates have been accepted, various tests can be kicked off on the remote machine and the audit log can be monitored to determine whether the policies covered all of the required resources. If not, the policy can be modified in SLIDE, pushed out to the remote machine and tested again.

SLIDE is a project of Tresys Technology, which has released it under the GPL. It does not appear to have attracted much of a development community, at least yet and the SourceForge project page has not been updated in quite some time. The documentation and trac site provided by Tresys are excellent. Perhaps the SourceForge project was an attempt to enlist community aid which did not attract the level of interest that they might have hoped for. It is a fairly esoteric subject that does not cause too many open source developers to itch. Many of those developers, perhaps, simply turn SELinux off.

As with most complex tools, SLIDE will not be terribly helpful to those who know little about SELinux policies. It has a steep learning curve even if you have a bit of that background, but for experts it is probably quite intuitive. For those reasons, it probably will not help other projects to generate policies for their software. In order to foster more applications with SELinux policies, it is likely that experts in policy development will have to join forces with these other projects to produce and maintain the policies. Using SLIDE will likely speed up that process and it is a welcome addition to a fairly sparse toolkit.