LWN: Comments on "Compartmentalized computing with CLIP OS"

Compartmentalized computing with CLIP OS

marcH — Wed, 31 Oct 2018 14:09:38 +0000

> But while "SE" lead to very low level (and possibly very difficult to use)

Not difficult at all, look: https://www.google.com/search?q=disable+selinux (over 1 million hits!)

In *some* situations disabling SElinux can make the system... more secure by removing the false sense of security provided by an obviously misconfigured solution.

Knowing where it came from, I've always wondered if anyone involved in the design actually expects SELinux to be frequently misconfigured.

Compartmentalized computing with CLIP OS

edeloget — Wed, 31 Oct 2018 00:24:03 +0000

You seem pretty right (at least for CLIP OS 4): the end user environment supports only two levels (the low level and the high level).

The infrastructure might still be more capable (don't know yet).

Compartmentalized computing with CLIP OS

Villemoes — Tue, 30 Oct 2018 10:22:08 +0000

Can't O_MAYEXEC be implemented in userspace with fstatvfs() on the opened file and checking struct statvfs::f_flag? Compared to the work already needed for each interpreter (not just adding O_MAYEXEC, but also disabling -e and executing from stdin etc.) copy-pasting a simple openat_mayexec() wrapper seems quite simple.

Compartmentalized computing with CLIP OS

ortalo — Tue, 30 Oct 2018 09:31:53 +0000

Even though the project heavily claims to offer a multilevel OS, I have the feeling that only a dual level environnment is offered, with primarily two big compartments ; pretty far from the actual MLS systems described in a Bell-LaPadula policy (e.g. with labels on objects or subjects, etc.).
Do you share that impression (esp. in CLIP OS 4)?

Compartmentalized computing with CLIP OS

ortalo — Tue, 30 Oct 2018 09:29:36 +0000

I agree it is the same kind of sound, yes. But while "SE" lead to very low level (and possibly very difficult to use) mandatory mechanisms, I have the feeling that "CLIP" may lead to very coarse grain (possibly dual conlfidentiality level-only) use cases that may only be useful in specific contexts.
Like when intelligence analysts are browsing the public (dark)web while writing governmental reports ; and the commander is paranoid about viruses revealing secret information on ministers mistresses (before they publish a book themselves).
I am not so optimistic that these mechanisms can be useful in the general case ; but I really welcome the move towards doing the development of the next version in the open.

Compartmentalized computing with CLIP OS

SEJeff — Mon, 29 Oct 2018 19:31:27 +0000

This sounds a lot like a modern version of the NSA's Flask Security Architecture (of which the result was in fact SELinux) to provide Information Assurance guarantees enforced at the Kernel level:

https://www.usenix.org/conference/8th-usenix-security-sym...