Setools Package: Tools for Understanding SELinux...

Setools Package: Tools for Understanding SELinux Policies

2005 SELinux Symposium

Frank Mayer <mayerf@tresys.com>Tresys Technologyhttp://www.tresys.com

The Origins

Challenge of Evaluating TE Policies Basic cross-reference was practically impossible“What are the types with Domain attribute?”Needed to support security certification

Starting writing a little tool on the side in 2001First released “apolicy” v0.1 in October 2001Basic command line tool Was a powerful analysis aide

policy stats types & attributesdump rules (grep) search rules (by type)

Evolved into “Setools” package

Current Setools Overview

Package of software tools for SELinux policiesUnderstanding and analyzing policiesOver 10 distinct tools and four librariesOver 20 releases to date

Current v2.0, released February 2005~75K SLOC (~45K C plus TCL/others)

Version 0.1: 2.4K SLOCFreely available, GPL license (www.tresys.com/selinux)

Strong analysis and debug toolsDriven by need and innovationAlso policy management/editing

Setools Package ContentsApol: comprehensive policy analysisSediff: semantic policy difference analysisSeaudit: audit analyzer/monitor

Seaudit-report: audit report formatterSecmd sub-package: command line tools

Replcon & findcon: search/edit file contextIndexcon & searchcon: index and search file system contextSeinfo & sesearch: command line policy analysis

Seuser & wrappers: policy management (users)Sepcut: policy editor/configuration (deprecated)Libraries:

Libapol: analysis and policy storeLibseaudit: audit analysisLibsefs: file context indexing and analysisLibseuser: user management

Libapol architecture: analysis core

source parser• pre v11-current

binary parser• v15-current

policy store• integer indexed• in-memory• extremely fast

search & query• rapid policy selection

automated analyses• complex “canned”

analysis• captured experience

info flowanalysisengine

info flow

assert

re-label

typerelate

semantic diff• semantic comparison

of two policies• binary & source• differing versions

selinux policies

policy tools

Setools Architecture

liapol-tcl

sourcepolicy

binarypolicy

apol(tcl/tk)

seuserx(GUI)

seuser(cmd)

seaudit(gtk)sediff

info flow

assert

re-label

typerelate

info flow

assert

info flow

assert

re-labelre-

labeltyperelatetyperelate

libapollibsefslibseaudit

libseuser

Seaudit: policy analysis

Seaudit: audit monitoring

Sediff: semantic policy compare

New tool released in version 2.0Long-time goal of differencing two policies

Simple diffs don’t workNeed semantic comparison

Resolve effective permissionDealing with duplicate rules, attributes, etc.

New library extension and GUIShows semantic differences Can handle binary and/or source policiesCan compare different policy versions

Sediff: semantic policy compare

Sediff: difference summary

Sediff: attribute differences

Sediff: type enforcement differences

Apol: Policy analysis tool

Grandfather and largest of all SetoolsExtensive analysis and debug toolFrom basic to highly innovative capabilities

Search & correlate policy elementsPowerful rule search and select capabilitiesCorrelation with on-disk file labelsComplex, automated analyses domain transition analysis relabel analysisinformation flow (several) type relationship

Apol: Major Feature Tabs

Apol: Policy Components

Apol: Policy Components (types)

Apol: Policy Rules

Apol: Policy Rules (TE Rules)

Apol: Policy Analyses

Apol: Policy Analyses (types relate)

Setools: Future and PlansComplete and expand libapol

Policy store and parsingConstraints, security context, & MLSBinary module parser

Further use of file contexts in analysesComplete existing and invent new analyses

Batched information flow (security modeling)Greater knowledge capture and extensibility

Continue to apply to real-world problemsGreater support for certification and testingMore direct use for debug and managementPolicy quality checkerCompletion of sediffEtc.

Setools Overview

QUESTIONS??

Setools Package: Tools for Understanding SELinux...

Documents

Bsef2012 session4 tourism_jakeli

Red Hat Enterprise Linux 7 SELinux User's and Administrator ......1.1. Benefits of running SELinux 1.2. Examples 1.3. SELinux Architecture 1.4. SELinux Modes 1.5. What Is New in Red

SELinux basics

Selinux - Basics

Session4 revised

ADS Session4

Meaning of permissions in SELinux(Ver 1) - SELinux Policy Editor

Session4 part1

The SELinux Notebook - Free Computer Booksfreecomputerbooks.com/books/The_SELinux_Noteboo… · · 2014-10-04THE SELINUX NOTEBOOK.....15 1.1 INTRODUCTION ... 2.16.2 General SELinux

Secure Virtualization Using SELinux - Fedoradwalsh/SELinux/Presentations/svirt.pdf · Enter SELinux.. SELinux is all about labeling Processes get labels Virtual machines are processes!!!

Bsef2012 session4 tourism_druzenko

Session4 KM

Sc session4

Policy Analysis and Generation Work at MITREselinuxsymposium.org/2005/presentations/session4/4-3-herzog.pdf · SELinux Symposium, March 2-4 2005 // Supported by the National Security

Session4 solidworks2012 gioi_thieu_cac_tinh_nang_moi_uu_viet

Implementing Selinux

Managing SELinux in SUSE Linux Enterprise Server 12 sp 1€¦ · run selinux-ready; it will tell you what you need to do to enable SELinux •Add security=selinux selinux=1 to the

Transformingtechnologies session4

LAPP/SELinux - A secure web application stack powered by SELinux

Mm session4