Skip to contentSkip to conversation

What's the point of refpolicy-minimum?

meta-selinux Joe MacDonald 3 participants 5 messages Jan 10, 2017 – Jan 16, 2017

lore
Share & tools
lore

Joe MacDonald

author
#0 lore raw

Wenzong / Shrikant,

I thought I knew the answer to the above question, and maybe my understanding is still correct, but I think I need to ask it now anyway.

I don't use refpolicy-minimum for anything, so when I did the updates to refpolicy*_git I didn't even glance at refpolicy-minimum_git. Wenzong's change to refpolicy-minimum_2.20161023 (in the same thread as the uprev of the recipe) piqued my curiosity, so I had a look. Of course, refpolicy-minimum_git.bb also needs to be updated (or thrown out), but now that I'm looking at the recipe I see what seems like conflicting statements in the recipe:

recipes-security/refpolicy/refpolicy-minimum_2.20161023.bb:

     1 include refpolicy-targeted_${PV}.bb
     2 
     3 SUMMARY = "SELinux minimum policy"
     4 DESCRIPTION = "\
     5 This is a minimum reference policy with just core policy modules, and \
     6 could be used as a base for customizing targeted policy. \
     7 Pretty much everything runs as initrc_t or unconfined_t so all of the \
     8 domains are unconfined. \
     9 "

and:

recipes-security/refpolicy/refpolicy-targeted_2.20161023.bb:

     1 SUMMARY = "SELinux targeted policy"
     2 DESCRIPTION = "\
     3 This is the targeted variant of the SELinux reference policy.  Most service \
     4 domains are locked down. Users and admins will login in with unconfined_t \
     5 domain, so they have the same access to the system as if SELinux was not \
     6 enabled. \
     7 "

So now I'm trying to understand what the point of refpolicy-minimum really is here. Those of you who are using it, what are you using it for and what do you expect would be the correct behaviour of a system running that policy?

At the very least, I'm going to remove the 'include [...].bb' from both 'minimum' recipes, as that's completely incorrect, but when I do that I want to know what anyone using this recipe wants to see from it, so whatever the 'include' gets replaced with is doing the right thing (which isn't necessarily what it's doing today).

Signature · 2 lines
-Joe MacDonald.
:wq
#1 lore raw

Hi Joe,

Quoted 14 lines · Joe MacDonald

Wenzong / Shrikant,

I thought I knew the answer to the above question, and maybe my understanding is still correct, but I think I need to ask it now anyway.

I don't use refpolicy-minimum for anything, so when I did the updates to refpolicy*_git I didn't even glance at refpolicy-minimum_git. Wenzong's change to refpolicy-minimum_2.20161023 (in the same thread as the uprev of the recipe) piqued my curiosity, so I had a look. Of course, refpolicy-minimum_git.bb also needs to be updated (or thrown out), but now that I'm looking at the recipe I see what seems like conflicting statements in the recipe:

Quoted 7 lines
   recipes-security/refpolicy/refpolicy-minimum_2.20161023.bb:

     1 include refpolicy-targeted_${PV}.bb
     2
     3 SUMMARY = "SELinux minimum policy"
     4 DESCRIPTION = "\
     5 This is a minimum reference policy with just core policy modules,

and \

Quoted 2 lines

6 could be used as a base for customizing targeted policy. \
7 Pretty much everything runs as initrc_t or unconfined_t so all of

the \

Quoted 10 lines
     8 domains are unconfined. \
     9 "

and:

recipes-security/refpolicy/refpolicy-targeted_2.20161023.bb:

1 SUMMARY = "SELinux targeted policy"
2 DESCRIPTION = "\
3 This is the targeted variant of the SELinux reference policy.

Most service \

Quoted 1 line

4 domains are locked down. Users and admins will login in with

unconfined_t \

Quoted 1 line

5 domain, so they have the same access to the system as if SELinux

was not \

Quoted 7 lines
     6 enabled. \
     7 "

So now I'm trying to understand what the point of refpolicy-minimum really is here. Those of you who are using it, what are you using it for and what do you expect would be the correct behaviour of a system running that policy?

recently used refpolicy-minimum, as it provides protection/security for minimum modules
and reaming things with unconfined, the minimum coverage(modules) of policy easy to start on
& cross check the prepared infrastructure against the expected selinux behavior.

Also it is easy to patch for systemd compared to other policies. Till refpolicy v20151208 release
we have refpolicy-minimum working with systemd as init manager. regarding the latest release need to check.

But moving ahead similar policy with minimum modules can be used..

Quoted 6 lines

At the very least, I'm going to remove the 'include [...].bb' from both 'minimum' recipes, as that's completely incorrect, but when I do that I want to know what anyone using this recipe wants to see from it, so whatever the 'include' gets replaced with is doing the right thing (which isn't necessarily what it's doing today).

agree..

Quoted 11 lines

--
-Joe MacDonald.
:wq

--
_______________________________________________
yocto mailing list
[email protected]
https://lists.yoctoproject.org/listinfo/yocto

Thanks
Shrikant

#2 lore raw
In reply to Joe MacDonald
Quoted 37 lines · Joe MacDonald

Wenzong / Shrikant,

I thought I knew the answer to the above question, and maybe my understanding is still correct, but I think I need to ask it now anyway.

I don't use refpolicy-minimum for anything, so when I did the updates to refpolicy*_git I didn't even glance at refpolicy-minimum_git. Wenzong's change to refpolicy-minimum_2.20161023 (in the same thread as the uprev of the recipe) piqued my curiosity, so I had a look. Of course, refpolicy-minimum_git.bb also needs to be updated (or thrown out), but now that I'm looking at the recipe I see what seems like conflicting statements in the recipe:

   recipes-security/refpolicy/refpolicy-minimum_2.20161023.bb:

     1 include refpolicy-targeted_${PV}.bb
     2
     3 SUMMARY = "SELinux minimum policy"
     4 DESCRIPTION = "\
     5 This is a minimum reference policy with just core policy modules, and \
     6 could be used as a base for customizing targeted policy. \
     7 Pretty much everything runs as initrc_t or unconfined_t so all of the \
     8 domains are unconfined. \
     9 "

and:

   recipes-security/refpolicy/refpolicy-targeted_2.20161023.bb:

     1 SUMMARY = "SELinux targeted policy"
     2 DESCRIPTION = "\
     3 This is the targeted variant of the SELinux reference policy.  Most service \
     4 domains are locked down. Users and admins will login in with unconfined_t \
     5 domain, so they have the same access to the system as if SELinux was not \
     6 enabled. \
     7 "
Quoted 5 lines

So now I'm trying to understand what the point of refpolicy-minimum really is here. Those of you who are using it, what are you using it for and what do you expect would be the correct behaviour of a system running that policy?

I don't have much experience on using the refpolicy-minimum as well.

But from the original logs it should be "minimum targeted policy".

commit 65675f02e33f5da31ec5dbac7a45849f4952569b

Author: Wenzong Fan <[email protected]>
Date:   Mon Mar 24 21:07:50 2014 -0400

refpolicy: add minimum targeted policy

This is a minimum targeted policy with just core policy modules, and could be used as a base for customizing targeted policy. Pretty much everything runs as initrc_t or unconfined_t so all of the domains are unconfined.

Signed-off-by Wenzong Fan <[email protected]>
Signed-off-by Joe MacDonald <[email protected]>
Quoted 5 lines

At the very least, I'm going to remove the 'include [...].bb' from both 'minimum' recipes, as that's completely incorrect, but when I do that I want to know what anyone using this recipe wants to see from it, so whatever the 'include' gets replaced with is doing the right thing (which isn't necessarily what it's doing today).

I won't object to make the changes, if you think there should be a different minimum policy with targeted.

Thanks
Wenzong

Quoted 1 line
author
#3 lore raw

Hi guys,

Quoted 63 lines · [Re: [meta-selinux] What's the point of refpolicy-minimum?] On 17.01.12 (Thu…
Quoted 37 lines · Joe MacDonald

Wenzong / Shrikant,

I thought I knew the answer to the above question, and maybe my understanding is still correct, but I think I need to ask it now anyway.

I don't use refpolicy-minimum for anything, so when I did the updates to refpolicy*_git I didn't even glance at refpolicy-minimum_git. Wenzong's change to refpolicy-minimum_2.20161023 (in the same thread as the uprev of the recipe) piqued my curiosity, so I had a look. Of course, refpolicy-minimum_git.bb also needs to be updated (or thrown out), but now that I'm looking at the recipe I see what seems like conflicting statements in the recipe:

recipes-security/refpolicy/refpolicy-minimum_2.20161023.bb:

    1 include refpolicy-targeted_${PV}.bb
    2
    3 SUMMARY = "SELinux minimum policy"
    4 DESCRIPTION = "\
    5 This is a minimum reference policy with just core policy modules, and \
    6 could be used as a base for customizing targeted policy. \
    7 Pretty much everything runs as initrc_t or unconfined_t so all of the \
    8 domains are unconfined. \
    9 "

and:

recipes-security/refpolicy/refpolicy-targeted_2.20161023.bb:

    1 SUMMARY = "SELinux targeted policy"
    2 DESCRIPTION = "\
    3 This is the targeted variant of the SELinux reference policy.  Most service \
    4 domains are locked down. Users and admins will login in with unconfined_t \
    5 domain, so they have the same access to the system as if SELinux was not \
    6 enabled. \
    7 "
Quoted 5 lines

So now I'm trying to understand what the point of refpolicy-minimum really is here. Those of you who are using it, what are you using it for and what do you expect would be the correct behaviour of a system running that policy?

I don't have much experience on using the refpolicy-minimum as well.

But from the original logs it should be "minimum targeted policy".

commit 65675f02e33f5da31ec5dbac7a45849f4952569b

Author: Wenzong Fan <[email protected]>
Date:   Mon Mar 24 21:07:50 2014 -0400

refpolicy: add minimum targeted policy

This is a minimum targeted policy with just core policy modules, and could be used as a base for customizing targeted policy. Pretty much everything runs as initrc_t or unconfined_t so all of the domains are unconfined.

Signed-off-by Wenzong Fan <[email protected]>
Signed-off-by Joe MacDonald <[email protected]>
Quoted 8 lines
Quoted 5 lines

At the very least, I'm going to remove the 'include [...].bb' from both 'minimum' recipes, as that's completely incorrect, but when I do that I want to know what anyone using this recipe wants to see from it, so whatever the 'include' gets replaced with is doing the right thing (which isn't necessarily what it's doing today).

I won't object to make the changes, if you think there should be a different minimum policy with targeted.

I'm not proposing an alternative, I'm just saying that the statements in the descriptions of the recipes seem to conflict. (And do note that the git log you quoted is precisely the text in DESCRIPTION for refpolicy-minimum.

What I'm confused by is this in minimum:

Quoted 2 lines

Pretty much everything runs as initrc_t or unconfined_t so all of the domains are unconfined.

and this in targeted:

Quoted 1 line
Quoted 1 line

Most service domains are locked down.

So I guess my question is what is the desired behaviour out of this recipe? If nobody knows and it's not being used, I'm leaning toward a 'git rm'-based solution. :-)

It sounds, though, like Shrikant is using it, so it's of some use, I guess. Shrikant, on the systems you've used the minimum policy, what does the policy look like on your running system? In the current world refpolicy-minimum inherits POLICY_TYPE and POLICY_MLS_SENS from refpolicy-targeted, is that good / bad / irrelevant to what you're doing with it? If I just rework minimum to remove the include and bring in the minimal number of changes to get the policy to load again, is that good enough for your purposes? Do you want to volunteer to test my changes for me before I commit them? :-)

Signature · 2 lines
-Joe MacDonald.
:wq
#4 lore raw

Hi Joe,

Quoted 4 lines · Joe MacDonald

Hi guys,

[Re: [meta-selinux] What's the point of refpolicy-minimum?] On 17.01.12

Quoted 6 lines · (Thu 12:57) wenzong fan wrote:
Quoted 6 lines · Joe MacDonald
Quoted 4 lines

Wenzong / Shrikant,

I thought I knew the answer to the above question, and maybe my understanding is still correct, but I think I need to ask it now

anyway.

Quoted 2 lines
Quoted 2 lines
Quoted 2 lines

I don't use refpolicy-minimum for anything, so when I did the updates

to

Quoted 1 line
Quoted 1 line
Quoted 1 line

refpolicy*_git I didn't even glance at refpolicy-minimum_git.

Wenzong's

Quoted 6 lines
Quoted 6 lines
Quoted 6 lines

change to refpolicy-minimum_2.20161023 (in the same thread as the uprev of the recipe) piqued my curiosity, so I had a look. Of course, refpolicy-minimum_git.bb also needs to be updated (or thrown out), but now that I'm looking at the recipe I see what seems like conflicting statements in the recipe:

Quoted 7 lines
Quoted 7 lines
Quoted 7 lines

recipes-security/refpolicy/refpolicy-minimum_2.20161023.bb:

    1 include refpolicy-targeted_${PV}.bb
    2
    3 SUMMARY = "SELinux minimum policy"
    4 DESCRIPTION = "\
    5 This is a minimum reference policy with just core policy

modules, and \

Quoted 2 lines
Quoted 2 lines
Quoted 2 lines

6 could be used as a base for customizing targeted policy. \
7 Pretty much everything runs as initrc_t or unconfined_t so all

of the \

Quoted 10 lines
Quoted 10 lines
Quoted 10 lines
    8 domains are unconfined. \
    9 "

and:

recipes-security/refpolicy/refpolicy-targeted_2.20161023.bb:

1 SUMMARY = "SELinux targeted policy"
2 DESCRIPTION = "\
3 This is the targeted variant of the SELinux reference policy.

Most service \

Quoted 1 line
Quoted 1 line
Quoted 1 line

4 domains are locked down. Users and admins will login in with

unconfined_t \

Quoted 1 line
Quoted 1 line
Quoted 1 line

5 domain, so they have the same access to the system as if

SELinux was not \

Quoted 17 lines
Quoted 17 lines
Quoted 8 lines
    6 enabled. \
    7 "

So now I'm trying to understand what the point of refpolicy-minimum really is here. Those of you who are using it, what are you using it for and what do you expect would be the correct behaviour of a system running that policy?

I don't have much experience on using the refpolicy-minimum as well.

But from the original logs it should be "minimum targeted policy".

commit 65675f02e33f5da31ec5dbac7a45849f4952569b

Author: Wenzong Fan <[email protected]>
Date:   Mon Mar 24 21:07:50 2014 -0400
Quoted 5 lines
Quoted 5 lines

refpolicy: add minimum targeted policy

This is a minimum targeted policy with just core policy modules, and could be used as a base for customizing targeted policy. Pretty much everything runs as initrc_t or unconfined_t so all of

the

Quoted 6 lines
Quoted 6 lines

domains are unconfined.

Signed-off-by Wenzong Fan <[email protected]>
Signed-off-by Joe MacDonald <[email protected]>
Quoted 7 lines
Quoted 7 lines
Quoted 5 lines

At the very least, I'm going to remove the 'include [...].bb' from both 'minimum' recipes, as that's completely incorrect, but when I do that I want to know what anyone using this recipe wants to see from it, so whatever the 'include' gets replaced with is doing the right thing (which isn't necessarily what it's doing today).

I won't object to make the changes, if you think there should be a

different

Quoted 10 lines
Quoted 1 line

minimum policy with targeted.

I'm not proposing an alternative, I'm just saying that the statements in the descriptions of the recipes seem to conflict. (And do note that the git log you quoted is precisely the text in DESCRIPTION for refpolicy-minimum.

What I'm confused by is this in minimum:

Quoted 1 line

Pretty much everything runs as initrc_t or unconfined_t so all of

the

Quoted 10 lines
Quoted 1 line

domains are unconfined.

and this in targeted:

Quoted 1 line
Quoted 1 line

Most service domains are locked down.

So I guess my question is what is the desired behaviour out of this recipe? If nobody knows and it's not being used, I'm leaning toward a 'git rm'-based solution. :-)

Quoted 9 lines

It sounds, though, like Shrikant is using it, so it's of some use, I guess. Shrikant, on the systems you've used the minimum policy, what does the policy look like on your running system? In the current world refpolicy-minimum inherits POLICY_TYPE and POLICY_MLS_SENS from refpolicy-targeted, is that good / bad / irrelevant to what you're doing with it? If I just rework minimum to remove the include and bring in the minimal number of changes to get the policy to load again, is that good enough for your purposes? Do you want to volunteer to test my changes for me before I commit them? :-)

Sure, the rework for minimum to remove the include and minimal no. of changes to get the policy loading,
seems good to server the expectations from it.
Happy to volunteer to validate the changes, please advise the location to fork the in-progress changes. :)

Quoted 11 lines

--
-Joe MacDonald.
:wq

--
_______________________________________________
yocto mailing list
[email protected]
https://lists.yoctoproject.org/listinfo/yocto

Thanks
Shrikant