d166c8024d
People keep asking me for permissive mode, and I keep saying "no". Permissive mode is wrong for more reasons than I can enumerate, but the compelling one is that it's once on, never off. Nonetheless, there is an argument to be made for running a process with lots of permissions, logging which are required, and then locking the process down. There wasn't a way to do that with Smack, but this provides it. The notion is that you start out by giving the process an appropriate Smack label, such as "ATBirds". You create rules with a wide range of access and the "b" mode. On Tizen it might be: ATBirds System rwxalb ATBirds User rwxalb ATBirds _ rwxalb User ATBirds wb System ATBirds wb Accesses that fail will generate audit records. Accesses that succeed because of rules marked with a "b" generate log messages identifying the rule, the program and as much object information as is convenient. When the system is properly configured and the programs brought in line with the labeling scheme the "b" mode can be removed from the rules. When the system is ready for production the facility can be configured out. This provides the developer the convenience of permissive mode without creating a system that looks like it is enforcing a policy while it is not. Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
31 lines
1.1 KiB
Plaintext
31 lines
1.1 KiB
Plaintext
config SECURITY_SMACK
|
|
bool "Simplified Mandatory Access Control Kernel Support"
|
|
depends on NET
|
|
depends on INET
|
|
depends on SECURITY
|
|
select NETLABEL
|
|
select SECURITY_NETWORK
|
|
default n
|
|
help
|
|
This selects the Simplified Mandatory Access Control Kernel.
|
|
Smack is useful for sensitivity, integrity, and a variety
|
|
of other mandatory security schemes.
|
|
If you are unsure how to answer this question, answer N.
|
|
|
|
config SECURITY_SMACK_BRINGUP
|
|
bool "Reporting on access granted by Smack rules"
|
|
depends on SECURITY_SMACK
|
|
default n
|
|
help
|
|
Enable the bring-up ("b") access mode in Smack rules.
|
|
When access is granted by a rule with the "b" mode a
|
|
message about the access requested is generated. The
|
|
intention is that a process can be granted a wide set
|
|
of access initially with the bringup mode set on the
|
|
rules. The developer can use the information to
|
|
identify which rules are necessary and what accesses
|
|
may be inappropriate. The developer can reduce the
|
|
access rule set once the behavior is well understood.
|
|
This is a superior mechanism to the oft abused
|
|
"permissive" mode of other systems.
|