* [refpolicy] Testing in the Reference Policy
@ 2016-08-22 17:52 Naftuli Tzvi Kay
2016-08-22 17:58 ` Dominick Grift
` (3 more replies)
0 siblings, 4 replies; 14+ messages in thread
From: Naftuli Tzvi Kay @ 2016-08-22 17:52 UTC (permalink / raw)
To: refpolicy
I'm currently working on a reference policy addition to restrict access for
a given application. Up until now, I've been testing my application on a
Fedora 24 Vagrant VM, compiling a non-base module and loading it into the
kernel, running, testing, auditing, etc.
What I found is that I ended up using a lot of RedHat specific downstream
macros, which aren't supported here upstream.
Is there a recommended way of testing reference policy code? How can I
alter my Fedora Vagrant VM setup to cover the use case I'm after? Should I
just compile the reference policy in my VM, relabel the filesystem, and
then reboot and load the reference policy into the kernel?
My host OS is running Ubuntu 14.04, so it's not very useful for debugging
SELinux things; I once tried getting SELinux running on my desktop
<https://rfkrocktk.github.io/2015/12/selinux-on-ubuntu>, but X wouldn't
start, etc. and I imagine the policy is pretty out of date.
How can I create an environment in which I can test my policy against the
program I'm aiming to constrain? (Syncthing)
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://oss.tresys.com/pipermail/refpolicy/attachments/20160822/467268ed/attachment.html
^ permalink raw reply [flat|nested] 14+ messages in thread
* [refpolicy] Testing in the Reference Policy
2016-08-22 17:52 [refpolicy] Testing in the Reference Policy Naftuli Tzvi Kay
@ 2016-08-22 17:58 ` Dominick Grift
2016-08-22 19:33 ` Dominick Grift
` (2 subsequent siblings)
3 siblings, 0 replies; 14+ messages in thread
From: Dominick Grift @ 2016-08-22 17:58 UTC (permalink / raw)
To: refpolicy
On 08/22/2016 07:52 PM, Naftuli Tzvi Kay via refpolicy wrote:
> I'm currently working on a reference policy addition to restrict access for
> a given application. Up until now, I've been testing my application on a
> Fedora 24 Vagrant VM, compiling a non-base module and loading it into the
> kernel, running, testing, auditing, etc.
>
> What I found is that I ended up using a lot of RedHat specific downstream
> macros, which aren't supported here upstream.
>
> Is there a recommended way of testing reference policy code? How can I
> alter my Fedora Vagrant VM setup to cover the use case I'm after? Should I
> just compile the reference policy in my VM, relabel the filesystem, and
> then reboot and load the reference policy into the kernel?
>
> My host OS is running Ubuntu 14.04, so it's not very useful for debugging
> SELinux things; I once tried getting SELinux running on my desktop
> <https://rfkrocktk.github.io/2015/12/selinux-on-ubuntu>, but X wouldn't
> start, etc. and I imagine the policy is pretty out of date.
>
> How can I create an environment in which I can test my policy against the
> program I'm aiming to constrain? (Syncthing)
It does not have to be enforcing for testing purposes. So I suppose you
could just load refpolicy on f24, relabel the file system, and set it to
permissive.
You just have to ensure that your shell returns the right context with
id -Z (which should be pretty easy). Then you can start developing your
policy for your user application in permissive mode.
>
>
>
> _______________________________________________
> refpolicy mailing list
> refpolicy at oss.tresys.com
> http://oss.tresys.com/mailman/listinfo/refpolicy
>
--
Key fingerprint = 5F4D 3CDB D3F8 3652 FBD8 02D5 3B6C 5F1D 2C7B 6B02
https://sks-keyservers.net/pks/lookup?op=get&search=0x3B6C5F1D2C7B6B02
Dominick Grift
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 648 bytes
Desc: OpenPGP digital signature
Url : http://oss.tresys.com/pipermail/refpolicy/attachments/20160822/a32aaa3d/attachment.bin
^ permalink raw reply [flat|nested] 14+ messages in thread
* [refpolicy] Testing in the Reference Policy
2016-08-22 17:52 [refpolicy] Testing in the Reference Policy Naftuli Tzvi Kay
2016-08-22 17:58 ` Dominick Grift
@ 2016-08-22 19:33 ` Dominick Grift
2016-08-23 5:16 ` Jason Zaman
2016-08-23 9:36 ` Dominick Grift
3 siblings, 0 replies; 14+ messages in thread
From: Dominick Grift @ 2016-08-22 19:33 UTC (permalink / raw)
To: refpolicy
On 08/22/2016 07:52 PM, Naftuli Tzvi Kay via refpolicy wrote:
> I'm currently working on a reference policy addition to restrict access for
> a given application. Up until now, I've been testing my application on a
> Fedora 24 Vagrant VM, compiling a non-base module and loading it into the
> kernel, running, testing, auditing, etc.
>
> What I found is that I ended up using a lot of RedHat specific downstream
> macros, which aren't supported here upstream.
>
> Is there a recommended way of testing reference policy code? How can I
> alter my Fedora Vagrant VM setup to cover the use case I'm after? Should I
> just compile the reference policy in my VM, relabel the filesystem, and
> then reboot and load the reference policy into the kernel?
>
> My host OS is running Ubuntu 14.04, so it's not very useful for debugging
> SELinux things; I once tried getting SELinux running on my desktop
> <https://rfkrocktk.github.io/2015/12/selinux-on-ubuntu>, but X wouldn't
> start, etc. and I imagine the policy is pretty out of date.
>
> How can I create an environment in which I can test my policy against the
> program I'm aiming to constrain? (Syncthing)
>
syncthing does not need X. So you can install a text-based system. f24
minimal server install maybe.
then you can just install refpolicy (make sure though to build with
init_systemd (i forgot that)
Also make sure you set selinux to permissive mode
then you can just start developing your policy.
Your query prompted me to try it out myself and record it. Most of the
video is me struggling with updating my qemu script and eventually i
realized i forgot to set init_systemd in the makefile, but its too late
for me to redo it tonight (tired). but its roughly the procedure.
https://youtu.be/9vgdHb2eXjg (its currently still processing)
Maybe tomorrow ill have another look (try it again and this time make
sure init_systemd is enabled ...
Anyhow this example does have some good information in between all the noise
>
>
> _______________________________________________
> refpolicy mailing list
> refpolicy at oss.tresys.com
> http://oss.tresys.com/mailman/listinfo/refpolicy
>
--
Key fingerprint = 5F4D 3CDB D3F8 3652 FBD8 02D5 3B6C 5F1D 2C7B 6B02
https://sks-keyservers.net/pks/lookup?op=get&search=0x3B6C5F1D2C7B6B02
Dominick Grift
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 648 bytes
Desc: OpenPGP digital signature
Url : http://oss.tresys.com/pipermail/refpolicy/attachments/20160822/8d46a23d/attachment.bin
^ permalink raw reply [flat|nested] 14+ messages in thread
* [refpolicy] Testing in the Reference Policy
2016-08-22 17:52 [refpolicy] Testing in the Reference Policy Naftuli Tzvi Kay
2016-08-22 17:58 ` Dominick Grift
2016-08-22 19:33 ` Dominick Grift
@ 2016-08-23 5:16 ` Jason Zaman
2016-08-23 9:36 ` Dominick Grift
3 siblings, 0 replies; 14+ messages in thread
From: Jason Zaman @ 2016-08-23 5:16 UTC (permalink / raw)
To: refpolicy
On 23 Aug 2016 01:53, "Naftuli Tzvi Kay via refpolicy" <
refpolicy@oss.tresys.com> wrote:
>
> I'm currently working on a reference policy addition to restrict access
for a given application. Up until now, I've been testing my application on
a Fedora 24 Vagrant VM, compiling a non-base module and loading it into the
kernel, running, testing, auditing, etc.
>
> What I found is that I ended up using a lot of RedHat specific downstream
macros, which aren't supported here upstream.
>
> Is there a recommended way of testing reference policy code? How can I
alter my Fedora Vagrant VM setup to cover the use case I'm after? Should I
just compile the reference policy in my VM, relabel the filesystem, and
then reboot and load the reference policy into the kernel?
>
> My host OS is running Ubuntu 14.04, so it's not very useful for debugging
SELinux things; I once tried getting SELinux running on my desktop, but X
wouldn't start, etc. and I imagine the policy is pretty out of date.
>
> How can I create an environment in which I can test my policy against the
program I'm aiming to constrain? (Syncthing)
On my phone so not gonna be a long answer. For CI testing Travis is setup
for both refpol and the gentoo repo.
If you want a more full test you can take the gentoo hardened SELinux
stage3 tarballs and start that in a VM. Look under experimental on the
distfiles mirrors or ping me on IRC for more up to date ones. Releng is
going to be generating official weekly SELinux stage3's real-soon-now.
gentoo policy is quite a bit closer to refpol and targeted, strict, MCS
work for X and xfce. I don't use KDE or gnome so not 100? sure on their
status. MLS works mostly for console only, not tried X.
The xdg_config_* interfaces are also in gentoo and are the ones that I will
upstream soon if you wanted to target that directly.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://oss.tresys.com/pipermail/refpolicy/attachments/20160823/3f7a9b63/attachment.html
^ permalink raw reply [flat|nested] 14+ messages in thread
* [refpolicy] Testing in the Reference Policy
2016-08-22 17:52 [refpolicy] Testing in the Reference Policy Naftuli Tzvi Kay
` (2 preceding siblings ...)
2016-08-23 5:16 ` Jason Zaman
@ 2016-08-23 9:36 ` Dominick Grift
2016-08-24 3:35 ` Naftuli Tzvi Kay
3 siblings, 1 reply; 14+ messages in thread
From: Dominick Grift @ 2016-08-23 9:36 UTC (permalink / raw)
To: refpolicy
On 08/22/2016 07:52 PM, Naftuli Tzvi Kay via refpolicy wrote:
> I'm currently working on a reference policy addition to restrict access for
> a given application. Up until now, I've been testing my application on a
> Fedora 24 Vagrant VM, compiling a non-base module and loading it into the
> kernel, running, testing, auditing, etc.
>
> What I found is that I ended up using a lot of RedHat specific downstream
> macros, which aren't supported here upstream.
>
> Is there a recommended way of testing reference policy code? How can I
> alter my Fedora Vagrant VM setup to cover the use case I'm after? Should I
> just compile the reference policy in my VM, relabel the filesystem, and
> then reboot and load the reference policy into the kernel?
>
> My host OS is running Ubuntu 14.04, so it's not very useful for debugging
> SELinux things; I once tried getting SELinux running on my desktop
> <https://rfkrocktk.github.io/2015/12/selinux-on-ubuntu>, but X wouldn't
> start, etc. and I imagine the policy is pretty out of date.
>
> How can I create an environment in which I can test my policy against the
> program I'm aiming to constrain? (Syncthing)
>
>
I spent the morning recording the full procedure of developing for
refpolicy on fedora.
I start with installing refpolicy, enabling it. then it write a simple
module on top of the installation. This is what one would do when one
wants to write a module atop of refpolicy.
I encourage you to not give up and take this final step. You are very
close, and your module so far is pretty good.
Learning how to do what is in the video is the final piece in the puzzle
i think.
The video might be long but its comprehensive (the video might still be
processing on youtube but it will become available shortly:
https://www.youtube.com/watch?v=XIyxW4qT0UM
If you have any questions, then please do not hesitate to ask
>
> _______________________________________________
> refpolicy mailing list
> refpolicy at oss.tresys.com
> http://oss.tresys.com/mailman/listinfo/refpolicy
>
--
Key fingerprint = 5F4D 3CDB D3F8 3652 FBD8 02D5 3B6C 5F1D 2C7B 6B02
https://sks-keyservers.net/pks/lookup?op=get&search=0x3B6C5F1D2C7B6B02
Dominick Grift
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 648 bytes
Desc: OpenPGP digital signature
Url : http://oss.tresys.com/pipermail/refpolicy/attachments/20160823/17af48b3/attachment-0001.bin
^ permalink raw reply [flat|nested] 14+ messages in thread
* [refpolicy] Testing in the Reference Policy
2016-08-23 9:36 ` Dominick Grift
@ 2016-08-24 3:35 ` Naftuli Tzvi Kay
2016-08-24 22:12 ` Chris PeBenito
0 siblings, 1 reply; 14+ messages in thread
From: Naftuli Tzvi Kay @ 2016-08-24 3:35 UTC (permalink / raw)
To: refpolicy
Don't worry, I'm not giving up :) It might just take a while before I have
something working.
Would the reference policy ever be interested in having a Vagrant VM setup
for testing policy rules and everything? I'd be happy to contribute that
back upstream.
Thanks,
- Naftuli Tzvi
On Tue, Aug 23, 2016 at 2:36 AM, Dominick Grift <dac.override@gmail.com>
wrote:
> On 08/22/2016 07:52 PM, Naftuli Tzvi Kay via refpolicy wrote:
> > I'm currently working on a reference policy addition to restrict access
> for
> > a given application. Up until now, I've been testing my application on a
> > Fedora 24 Vagrant VM, compiling a non-base module and loading it into the
> > kernel, running, testing, auditing, etc.
> >
> > What I found is that I ended up using a lot of RedHat specific downstream
> > macros, which aren't supported here upstream.
> >
> > Is there a recommended way of testing reference policy code? How can I
> > alter my Fedora Vagrant VM setup to cover the use case I'm after? Should
> I
> > just compile the reference policy in my VM, relabel the filesystem, and
> > then reboot and load the reference policy into the kernel?
> >
> > My host OS is running Ubuntu 14.04, so it's not very useful for debugging
> > SELinux things; I once tried getting SELinux running on my desktop
> > <https://rfkrocktk.github.io/2015/12/selinux-on-ubuntu>, but X wouldn't
> > start, etc. and I imagine the policy is pretty out of date.
> >
> > How can I create an environment in which I can test my policy against the
> > program I'm aiming to constrain? (Syncthing)
> >
> >
>
> I spent the morning recording the full procedure of developing for
> refpolicy on fedora.
>
> I start with installing refpolicy, enabling it. then it write a simple
> module on top of the installation. This is what one would do when one
> wants to write a module atop of refpolicy.
>
> I encourage you to not give up and take this final step. You are very
> close, and your module so far is pretty good.
>
> Learning how to do what is in the video is the final piece in the puzzle
> i think.
>
> The video might be long but its comprehensive (the video might still be
> processing on youtube but it will become available shortly:
>
> https://www.youtube.com/watch?v=XIyxW4qT0UM
>
> If you have any questions, then please do not hesitate to ask
>
> >
> > _______________________________________________
> > refpolicy mailing list
> > refpolicy at oss.tresys.com
> > http://oss.tresys.com/mailman/listinfo/refpolicy
> >
>
>
> --
> Key fingerprint = 5F4D 3CDB D3F8 3652 FBD8 02D5 3B6C 5F1D 2C7B 6B02
> https://sks-keyservers.net/pks/lookup?op=get&search=0x3B6C5F1D2C7B6B02
> Dominick Grift
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://oss.tresys.com/pipermail/refpolicy/attachments/20160823/f2005e52/attachment.html
^ permalink raw reply [flat|nested] 14+ messages in thread
* [refpolicy] Testing in the Reference Policy
2016-08-24 3:35 ` Naftuli Tzvi Kay
@ 2016-08-24 22:12 ` Chris PeBenito
2016-08-24 22:14 ` Naftuli Tzvi Kay
0 siblings, 1 reply; 14+ messages in thread
From: Chris PeBenito @ 2016-08-24 22:12 UTC (permalink / raw)
To: refpolicy
On 08/23/16 23:35, Naftuli Tzvi Kay via refpolicy wrote:
> Don't worry, I'm not giving up :) It might just take a while before I
> have something working.
>
> Would the reference policy ever be interested in having a Vagrant VM
> setup for testing policy rules and everything? I'd be happy to
> contribute that back upstream.
What kind of testing did you have in mind? Just a compile/link test or
something more? If it's just compile/link then the CI tests are sufficient.
> On Tue, Aug 23, 2016 at 2:36 AM, Dominick Grift <dac.override@gmail.com
> <mailto:dac.override@gmail.com>> wrote:
>
> On 08/22/2016 07:52 PM, Naftuli Tzvi Kay via refpolicy wrote:
> > I'm currently working on a reference policy addition to restrict access for
> > a given application. Up until now, I've been testing my application on a
> > Fedora 24 Vagrant VM, compiling a non-base module and loading it into the
> > kernel, running, testing, auditing, etc.
> >
> > What I found is that I ended up using a lot of RedHat specific downstream
> > macros, which aren't supported here upstream.
> >
> > Is there a recommended way of testing reference policy code? How can I
> > alter my Fedora Vagrant VM setup to cover the use case I'm after? Should I
> > just compile the reference policy in my VM, relabel the filesystem, and
> > then reboot and load the reference policy into the kernel?
> >
> > My host OS is running Ubuntu 14.04, so it's not very useful for debugging
> > SELinux things; I once tried getting SELinux running on my desktop
> > <https://rfkrocktk.github.io/2015/12/selinux-on-ubuntu
> <https://rfkrocktk.github.io/2015/12/selinux-on-ubuntu>>, but X wouldn't
> > start, etc. and I imagine the policy is pretty out of date.
> >
> > How can I create an environment in which I can test my policy against the
> > program I'm aiming to constrain? (Syncthing)
> >
> >
>
> I spent the morning recording the full procedure of developing for
> refpolicy on fedora.
>
> I start with installing refpolicy, enabling it. then it write a simple
> module on top of the installation. This is what one would do when one
> wants to write a module atop of refpolicy.
>
> I encourage you to not give up and take this final step. You are very
> close, and your module so far is pretty good.
>
> Learning how to do what is in the video is the final piece in the puzzle
> i think.
>
> The video might be long but its comprehensive (the video might still be
> processing on youtube but it will become available shortly:
>
> https://www.youtube.com/watch?v=XIyxW4qT0UM
> <https://www.youtube.com/watch?v=XIyxW4qT0UM>
>
> If you have any questions, then please do not hesitate to ask
>
> >
> > _______________________________________________
> > refpolicy mailing list
> > refpolicy at oss.tresys.com <mailto:refpolicy@oss.tresys.com>
> > http://oss.tresys.com/mailman/listinfo/refpolicy
> <http://oss.tresys.com/mailman/listinfo/refpolicy>
> >
>
>
> --
> Key fingerprint = 5F4D 3CDB D3F8 3652 FBD8 02D5 3B6C 5F1D 2C7B 6B02
> https://sks-keyservers.net/pks/lookup?op=get&search=0x3B6C5F1D2C7B6B02
> <https://sks-keyservers.net/pks/lookup?op=get&search=0x3B6C5F1D2C7B6B02>
> Dominick Grift
>
>
>
>
> _______________________________________________
> refpolicy mailing list
> refpolicy at oss.tresys.com
> http://oss.tresys.com/mailman/listinfo/refpolicy
>
--
Chris PeBenito
^ permalink raw reply [flat|nested] 14+ messages in thread
* [refpolicy] Testing in the Reference Policy
2016-08-24 22:12 ` Chris PeBenito
@ 2016-08-24 22:14 ` Naftuli Tzvi Kay
2016-08-25 22:39 ` Chris PeBenito
0 siblings, 1 reply; 14+ messages in thread
From: Naftuli Tzvi Kay @ 2016-08-24 22:14 UTC (permalink / raw)
To: refpolicy
I was thinking of making a Vagrant environment where users can test their
applications on a system running the currently checked out master of
refpolicy. This will make it easier for me to update my policy for
Syncthing for instance.
In short, an environment to:
1. compile the reference policy
2. install it in the running kernel
3. install applications and do integration tests of the policy against
actual running binaries when developing new policies for applications
Thanks,
- Naftuli Tzvi
On Wed, Aug 24, 2016 at 3:12 PM, Chris PeBenito <pebenito@ieee.org> wrote:
> On 08/23/16 23:35, Naftuli Tzvi Kay via refpolicy wrote:
>
>> Don't worry, I'm not giving up :) It might just take a while before I
>> have something working.
>>
>> Would the reference policy ever be interested in having a Vagrant VM
>> setup for testing policy rules and everything? I'd be happy to
>> contribute that back upstream.
>>
>
> What kind of testing did you have in mind? Just a compile/link test or
> something more? If it's just compile/link then the CI tests are sufficient.
>
>
> On Tue, Aug 23, 2016 at 2:36 AM, Dominick Grift <dac.override@gmail.com
>> <mailto:dac.override@gmail.com>> wrote:
>>
>> On 08/22/2016 07:52 PM, Naftuli Tzvi Kay via refpolicy wrote:
>> > I'm currently working on a reference policy addition to restrict
>> access for
>> > a given application. Up until now, I've been testing my application
>> on a
>> > Fedora 24 Vagrant VM, compiling a non-base module and loading it
>> into the
>> > kernel, running, testing, auditing, etc.
>> >
>> > What I found is that I ended up using a lot of RedHat specific
>> downstream
>> > macros, which aren't supported here upstream.
>> >
>> > Is there a recommended way of testing reference policy code? How
>> can I
>> > alter my Fedora Vagrant VM setup to cover the use case I'm after?
>> Should I
>> > just compile the reference policy in my VM, relabel the filesystem,
>> and
>> > then reboot and load the reference policy into the kernel?
>> >
>> > My host OS is running Ubuntu 14.04, so it's not very useful for
>> debugging
>> > SELinux things; I once tried getting SELinux running on my desktop
>> > <https://rfkrocktk.github.io/2015/12/selinux-on-ubuntu
>> <https://rfkrocktk.github.io/2015/12/selinux-on-ubuntu>>, but X
>> wouldn't
>> > start, etc. and I imagine the policy is pretty out of date.
>> >
>> > How can I create an environment in which I can test my policy
>> against the
>> > program I'm aiming to constrain? (Syncthing)
>> >
>> >
>>
>> I spent the morning recording the full procedure of developing for
>> refpolicy on fedora.
>>
>> I start with installing refpolicy, enabling it. then it write a simple
>> module on top of the installation. This is what one would do when one
>> wants to write a module atop of refpolicy.
>>
>> I encourage you to not give up and take this final step. You are very
>> close, and your module so far is pretty good.
>>
>> Learning how to do what is in the video is the final piece in the
>> puzzle
>> i think.
>>
>> The video might be long but its comprehensive (the video might still
>> be
>> processing on youtube but it will become available shortly:
>>
>> https://www.youtube.com/watch?v=XIyxW4qT0UM
>> <https://www.youtube.com/watch?v=XIyxW4qT0UM>
>>
>> If you have any questions, then please do not hesitate to ask
>>
>> >
>> > _______________________________________________
>> > refpolicy mailing list
>> > refpolicy at oss.tresys.com <mailto:refpolicy@oss.tresys.com>
>> > http://oss.tresys.com/mailman/listinfo/refpolicy
>> <http://oss.tresys.com/mailman/listinfo/refpolicy>
>> >
>>
>>
>> --
>> Key fingerprint = 5F4D 3CDB D3F8 3652 FBD8 02D5 3B6C 5F1D 2C7B 6B02
>> https://sks-keyservers.net/pks/lookup?op=get&search=0x3B6C5F
>> 1D2C7B6B02
>> <https://sks-keyservers.net/pks/lookup?op=get&search=0x3B6C5
>> F1D2C7B6B02>
>> Dominick Grift
>>
>>
>>
>>
>> _______________________________________________
>> refpolicy mailing list
>> refpolicy at oss.tresys.com
>> http://oss.tresys.com/mailman/listinfo/refpolicy
>>
>>
>
> --
> Chris PeBenito
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://oss.tresys.com/pipermail/refpolicy/attachments/20160824/3e3aaf06/attachment-0001.html
^ permalink raw reply [flat|nested] 14+ messages in thread
* [refpolicy] Testing in the Reference Policy
2016-08-24 22:14 ` Naftuli Tzvi Kay
@ 2016-08-25 22:39 ` Chris PeBenito
2016-08-25 22:48 ` Naftuli Tzvi Kay
0 siblings, 1 reply; 14+ messages in thread
From: Chris PeBenito @ 2016-08-25 22:39 UTC (permalink / raw)
To: refpolicy
On 08/24/16 18:14, Naftuli Tzvi Kay wrote:
> I was thinking of making a Vagrant environment where users can test
> their applications on a system running the currently checked out master
> of refpolicy. This will make it easier for me to update my policy for
> Syncthing for instance.
>
> In short, an environment to:
> 1. compile the reference policy
> 2. install it in the running kernel
> 3. install applications and do integration tests of the policy against
> actual running binaries when developing new policies for applications
Will you be including configuration/scripts for provisioning too? How
would the provisioning be done? Shell scripts?
> On Wed, Aug 24, 2016 at 3:12 PM, Chris PeBenito <pebenito@ieee.org
> <mailto:pebenito@ieee.org>> wrote:
>
> On 08/23/16 23:35, Naftuli Tzvi Kay via refpolicy wrote:
>
> Don't worry, I'm not giving up :) It might just take a while
> before I
> have something working.
>
> Would the reference policy ever be interested in having a Vagrant VM
> setup for testing policy rules and everything? I'd be happy to
> contribute that back upstream.
>
>
> What kind of testing did you have in mind? Just a compile/link test
> or something more? If it's just compile/link then the CI tests are
> sufficient.
>
>
> On Tue, Aug 23, 2016 at 2:36 AM, Dominick Grift
> <dac.override at gmail.com <mailto:dac.override@gmail.com>
> <mailto:dac.override at gmail.com <mailto:dac.override@gmail.com>>>
> wrote:
>
> On 08/22/2016 07:52 PM, Naftuli Tzvi Kay via refpolicy wrote:
> > I'm currently working on a reference policy addition to
> restrict access for
> > a given application. Up until now, I've been testing my
> application on a
> > Fedora 24 Vagrant VM, compiling a non-base module and
> loading it into the
> > kernel, running, testing, auditing, etc.
> >
> > What I found is that I ended up using a lot of RedHat
> specific downstream
> > macros, which aren't supported here upstream.
> >
> > Is there a recommended way of testing reference policy
> code? How can I
> > alter my Fedora Vagrant VM setup to cover the use case I'm
> after? Should I
> > just compile the reference policy in my VM, relabel the
> filesystem, and
> > then reboot and load the reference policy into the kernel?
> >
> > My host OS is running Ubuntu 14.04, so it's not very
> useful for debugging
> > SELinux things; I once tried getting SELinux running on my
> desktop
> > <https://rfkrocktk.github.io/2015/12/selinux-on-ubuntu
> <https://rfkrocktk.github.io/2015/12/selinux-on-ubuntu>
> <https://rfkrocktk.github.io/2015/12/selinux-on-ubuntu
> <https://rfkrocktk.github.io/2015/12/selinux-on-ubuntu>>>, but X
> wouldn't
> > start, etc. and I imagine the policy is pretty out of date.
> >
> > How can I create an environment in which I can test my
> policy against the
> > program I'm aiming to constrain? (Syncthing)
> >
> >
>
> I spent the morning recording the full procedure of
> developing for
> refpolicy on fedora.
>
> I start with installing refpolicy, enabling it. then it
> write a simple
> module on top of the installation. This is what one would do
> when one
> wants to write a module atop of refpolicy.
>
> I encourage you to not give up and take this final step. You
> are very
> close, and your module so far is pretty good.
>
> Learning how to do what is in the video is the final piece
> in the puzzle
> i think.
>
> The video might be long but its comprehensive (the video
> might still be
> processing on youtube but it will become available shortly:
>
> https://www.youtube.com/watch?v=XIyxW4qT0UM
> <https://www.youtube.com/watch?v=XIyxW4qT0UM>
> <https://www.youtube.com/watch?v=XIyxW4qT0UM
> <https://www.youtube.com/watch?v=XIyxW4qT0UM>>
>
> If you have any questions, then please do not hesitate to ask
>
> >
> > _______________________________________________
> > refpolicy mailing list
> > refpolicy at oss.tresys.com <mailto:refpolicy@oss.tresys.com>
> <mailto:refpolicy at oss.tresys.com <mailto:refpolicy@oss.tresys.com>>
> > http://oss.tresys.com/mailman/listinfo/refpolicy
> <http://oss.tresys.com/mailman/listinfo/refpolicy>
> <http://oss.tresys.com/mailman/listinfo/refpolicy
> <http://oss.tresys.com/mailman/listinfo/refpolicy>>
> >
>
>
> --
> Key fingerprint = 5F4D 3CDB D3F8 3652 FBD8 02D5 3B6C 5F1D
> 2C7B 6B02
>
> https://sks-keyservers.net/pks/lookup?op=get&search=0x3B6C5F1D2C7B6B02
> <https://sks-keyservers.net/pks/lookup?op=get&search=0x3B6C5F1D2C7B6B02>
>
> <https://sks-keyservers.net/pks/lookup?op=get&search=0x3B6C5F1D2C7B6B02
> <https://sks-keyservers.net/pks/lookup?op=get&search=0x3B6C5F1D2C7B6B02>>
> Dominick Grift
>
>
>
>
> _______________________________________________
> refpolicy mailing list
> refpolicy at oss.tresys.com <mailto:refpolicy@oss.tresys.com>
> http://oss.tresys.com/mailman/listinfo/refpolicy
> <http://oss.tresys.com/mailman/listinfo/refpolicy>
>
>
>
> --
> Chris PeBenito
>
>
--
Chris PeBenito
^ permalink raw reply [flat|nested] 14+ messages in thread
* [refpolicy] Testing in the Reference Policy
2016-08-25 22:39 ` Chris PeBenito
@ 2016-08-25 22:48 ` Naftuli Tzvi Kay
2016-08-25 22:51 ` Chris PeBenito
0 siblings, 1 reply; 14+ messages in thread
From: Naftuli Tzvi Kay @ 2016-08-25 22:48 UTC (permalink / raw)
To: refpolicy
I'm hoping to have as few scripts as possible. Is there a preference here?
I could use Ansible, but if shell scripts are the most portable thing with
the least dependencies, I can do that.
Thanks,
- Naftuli Tzvi
On Thu, Aug 25, 2016 at 3:39 PM, Chris PeBenito <pebenito@ieee.org> wrote:
> On 08/24/16 18:14, Naftuli Tzvi Kay wrote:
>
>> I was thinking of making a Vagrant environment where users can test
>> their applications on a system running the currently checked out master
>> of refpolicy. This will make it easier for me to update my policy for
>> Syncthing for instance.
>>
>> In short, an environment to:
>> 1. compile the reference policy
>> 2. install it in the running kernel
>> 3. install applications and do integration tests of the policy against
>> actual running binaries when developing new policies for applications
>>
>
> Will you be including configuration/scripts for provisioning too? How
> would the provisioning be done? Shell scripts?
>
>
>
> On Wed, Aug 24, 2016 at 3:12 PM, Chris PeBenito <pebenito@ieee.org
>> <mailto:pebenito@ieee.org>> wrote:
>>
>> On 08/23/16 23:35, Naftuli Tzvi Kay via refpolicy wrote:
>>
>> Don't worry, I'm not giving up :) It might just take a while
>> before I
>> have something working.
>>
>> Would the reference policy ever be interested in having a Vagrant
>> VM
>> setup for testing policy rules and everything? I'd be happy to
>> contribute that back upstream.
>>
>>
>> What kind of testing did you have in mind? Just a compile/link test
>> or something more? If it's just compile/link then the CI tests are
>> sufficient.
>>
>>
>> On Tue, Aug 23, 2016 at 2:36 AM, Dominick Grift
>> <dac.override at gmail.com <mailto:dac.override@gmail.com>
>> <mailto:dac.override at gmail.com <mailto:dac.override@gmail.com>>>
>>
>> wrote:
>>
>> On 08/22/2016 07:52 PM, Naftuli Tzvi Kay via refpolicy wrote:
>> > I'm currently working on a reference policy addition to
>> restrict access for
>> > a given application. Up until now, I've been testing my
>> application on a
>> > Fedora 24 Vagrant VM, compiling a non-base module and
>> loading it into the
>> > kernel, running, testing, auditing, etc.
>> >
>> > What I found is that I ended up using a lot of RedHat
>> specific downstream
>> > macros, which aren't supported here upstream.
>> >
>> > Is there a recommended way of testing reference policy
>> code? How can I
>> > alter my Fedora Vagrant VM setup to cover the use case I'm
>> after? Should I
>> > just compile the reference policy in my VM, relabel the
>> filesystem, and
>> > then reboot and load the reference policy into the kernel?
>> >
>> > My host OS is running Ubuntu 14.04, so it's not very
>> useful for debugging
>> > SELinux things; I once tried getting SELinux running on my
>> desktop
>> > <https://rfkrocktk.github.io/2015/12/selinux-on-ubuntu
>> <https://rfkrocktk.github.io/2015/12/selinux-on-ubuntu>
>> <https://rfkrocktk.github.io/2015/12/selinux-on-ubuntu
>> <https://rfkrocktk.github.io/2015/12/selinux-on-ubuntu>>>, but X
>> wouldn't
>> > start, etc. and I imagine the policy is pretty out of date.
>> >
>> > How can I create an environment in which I can test my
>> policy against the
>> > program I'm aiming to constrain? (Syncthing)
>> >
>> >
>>
>> I spent the morning recording the full procedure of
>> developing for
>> refpolicy on fedora.
>>
>> I start with installing refpolicy, enabling it. then it
>> write a simple
>> module on top of the installation. This is what one would do
>> when one
>> wants to write a module atop of refpolicy.
>>
>> I encourage you to not give up and take this final step. You
>> are very
>> close, and your module so far is pretty good.
>>
>> Learning how to do what is in the video is the final piece
>> in the puzzle
>> i think.
>>
>> The video might be long but its comprehensive (the video
>> might still be
>> processing on youtube but it will become available shortly:
>>
>> https://www.youtube.com/watch?v=XIyxW4qT0UM
>> <https://www.youtube.com/watch?v=XIyxW4qT0UM>
>> <https://www.youtube.com/watch?v=XIyxW4qT0UM
>> <https://www.youtube.com/watch?v=XIyxW4qT0UM>>
>>
>> If you have any questions, then please do not hesitate to ask
>>
>> >
>> > _______________________________________________
>> > refpolicy mailing list
>> > refpolicy at oss.tresys.com <mailto:refpolicy@oss.tresys.com>
>> <mailto:refpolicy at oss.tresys.com <mailto:refpolicy@oss.tresys.com
>> >>
>> > http://oss.tresys.com/mailman/listinfo/refpolicy
>> <http://oss.tresys.com/mailman/listinfo/refpolicy>
>> <http://oss.tresys.com/mailman/listinfo/refpolicy
>> <http://oss.tresys.com/mailman/listinfo/refpolicy>>
>> >
>>
>>
>> --
>> Key fingerprint = 5F4D 3CDB D3F8 3652 FBD8 02D5 3B6C 5F1D
>> 2C7B 6B02
>>
>> https://sks-keyservers.net/pks/lookup?op=get&search=0x3B6C5F
>> 1D2C7B6B02
>> <https://sks-keyservers.net/pks/lookup?op=get&search=0x3B6C5
>> F1D2C7B6B02>
>>
>> <https://sks-keyservers.net/pks/lookup?op=get&search=0x3B6C5
>> F1D2C7B6B02
>> <https://sks-keyservers.net/pks/lookup?op=get&search=0x3B6C5
>> F1D2C7B6B02>>
>> Dominick Grift
>>
>>
>>
>>
>> _______________________________________________
>> refpolicy mailing list
>> refpolicy at oss.tresys.com <mailto:refpolicy@oss.tresys.com>
>> http://oss.tresys.com/mailman/listinfo/refpolicy
>> <http://oss.tresys.com/mailman/listinfo/refpolicy>
>>
>>
>>
>> --
>> Chris PeBenito
>>
>>
>>
>
> --
> Chris PeBenito
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://oss.tresys.com/pipermail/refpolicy/attachments/20160825/99527525/attachment-0001.html
^ permalink raw reply [flat|nested] 14+ messages in thread
* [refpolicy] Testing in the Reference Policy
2016-08-25 22:48 ` Naftuli Tzvi Kay
@ 2016-08-25 22:51 ` Chris PeBenito
2016-08-25 22:54 ` Naftuli Tzvi Kay
0 siblings, 1 reply; 14+ messages in thread
From: Chris PeBenito @ 2016-08-25 22:51 UTC (permalink / raw)
To: refpolicy
On 08/25/16 18:48, Naftuli Tzvi Kay wrote:
> I'm hoping to have as few scripts as possible. Is there a preference
> here? I could use Ansible, but if shell scripts are the most portable
> thing with the least dependencies, I can do that.
I'd prefer shell scripts, because it doesn't incur even more
dependencies, but if they get too ugly, I'd be willing to entertain
something like an ansible playbook.
> On Thu, Aug 25, 2016 at 3:39 PM, Chris PeBenito <pebenito@ieee.org
> <mailto:pebenito@ieee.org>> wrote:
>
> On 08/24/16 18:14, Naftuli Tzvi Kay wrote:
>
> I was thinking of making a Vagrant environment where users can test
> their applications on a system running the currently checked out
> master
> of refpolicy. This will make it easier for me to update my
> policy for
> Syncthing for instance.
>
> In short, an environment to:
> 1. compile the reference policy
> 2. install it in the running kernel
> 3. install applications and do integration tests of the policy
> against
> actual running binaries when developing new policies for
> applications
>
>
> Will you be including configuration/scripts for provisioning too?
> How would the provisioning be done? Shell scripts?
>
>
>
> On Wed, Aug 24, 2016 at 3:12 PM, Chris PeBenito
> <pebenito at ieee.org <mailto:pebenito@ieee.org>
> <mailto:pebenito at ieee.org <mailto:pebenito@ieee.org>>> wrote:
>
> On 08/23/16 23:35, Naftuli Tzvi Kay via refpolicy wrote:
>
> Don't worry, I'm not giving up :) It might just take a while
> before I
> have something working.
>
> Would the reference policy ever be interested in having
> a Vagrant VM
> setup for testing policy rules and everything? I'd be
> happy to
> contribute that back upstream.
>
>
> What kind of testing did you have in mind? Just a
> compile/link test
> or something more? If it's just compile/link then the CI
> tests are
> sufficient.
>
>
> On Tue, Aug 23, 2016 at 2:36 AM, Dominick Grift
> <dac.override at gmail.com <mailto:dac.override@gmail.com>
> <mailto:dac.override at gmail.com <mailto:dac.override@gmail.com>>
> <mailto:dac.override@gmail.com
> <mailto:dac.override@gmail.com> <mailto:dac.override@gmail.com
> <mailto:dac.override@gmail.com>>>>
>
> wrote:
>
> On 08/22/2016 07:52 PM, Naftuli Tzvi Kay via
> refpolicy wrote:
> > I'm currently working on a reference policy
> addition to
> restrict access for
> > a given application. Up until now, I've been
> testing my
> application on a
> > Fedora 24 Vagrant VM, compiling a non-base module and
> loading it into the
> > kernel, running, testing, auditing, etc.
> >
> > What I found is that I ended up using a lot of RedHat
> specific downstream
> > macros, which aren't supported here upstream.
> >
> > Is there a recommended way of testing reference policy
> code? How can I
> > alter my Fedora Vagrant VM setup to cover the use
> case I'm
> after? Should I
> > just compile the reference policy in my VM,
> relabel the
> filesystem, and
> > then reboot and load the reference policy into the
> kernel?
> >
> > My host OS is running Ubuntu 14.04, so it's not very
> useful for debugging
> > SELinux things; I once tried getting SELinux
> running on my
> desktop
> >
> <https://rfkrocktk.github.io/2015/12/selinux-on-ubuntu
> <https://rfkrocktk.github.io/2015/12/selinux-on-ubuntu>
> <https://rfkrocktk.github.io/2015/12/selinux-on-ubuntu
> <https://rfkrocktk.github.io/2015/12/selinux-on-ubuntu>>
>
> <https://rfkrocktk.github.io/2015/12/selinux-on-ubuntu
> <https://rfkrocktk.github.io/2015/12/selinux-on-ubuntu>
> <https://rfkrocktk.github.io/2015/12/selinux-on-ubuntu
> <https://rfkrocktk.github.io/2015/12/selinux-on-ubuntu>>>>, but X
> wouldn't
> > start, etc. and I imagine the policy is pretty out
> of date.
> >
> > How can I create an environment in which I can test my
> policy against the
> > program I'm aiming to constrain? (Syncthing)
> >
> >
>
> I spent the morning recording the full procedure of
> developing for
> refpolicy on fedora.
>
> I start with installing refpolicy, enabling it. then it
> write a simple
> module on top of the installation. This is what one
> would do
> when one
> wants to write a module atop of refpolicy.
>
> I encourage you to not give up and take this final
> step. You
> are very
> close, and your module so far is pretty good.
>
> Learning how to do what is in the video is the final
> piece
> in the puzzle
> i think.
>
> The video might be long but its comprehensive (the video
> might still be
> processing on youtube but it will become available
> shortly:
>
> https://www.youtube.com/watch?v=XIyxW4qT0UM
> <https://www.youtube.com/watch?v=XIyxW4qT0UM>
> <https://www.youtube.com/watch?v=XIyxW4qT0UM
> <https://www.youtube.com/watch?v=XIyxW4qT0UM>>
> <https://www.youtube.com/watch?v=XIyxW4qT0UM
> <https://www.youtube.com/watch?v=XIyxW4qT0UM>
> <https://www.youtube.com/watch?v=XIyxW4qT0UM
> <https://www.youtube.com/watch?v=XIyxW4qT0UM>>>
>
> If you have any questions, then please do not
> hesitate to ask
>
> >
> > _______________________________________________
> > refpolicy mailing list
> > refpolicy at oss.tresys.com
> <mailto:refpolicy@oss.tresys.com>
> <mailto:refpolicy at oss.tresys.com <mailto:refpolicy@oss.tresys.com>>
> <mailto:refpolicy@oss.tresys.com
> <mailto:refpolicy@oss.tresys.com>
> <mailto:refpolicy at oss.tresys.com <mailto:refpolicy@oss.tresys.com>>>
> > http://oss.tresys.com/mailman/listinfo/refpolicy
> <http://oss.tresys.com/mailman/listinfo/refpolicy>
> <http://oss.tresys.com/mailman/listinfo/refpolicy
> <http://oss.tresys.com/mailman/listinfo/refpolicy>>
> <http://oss.tresys.com/mailman/listinfo/refpolicy
> <http://oss.tresys.com/mailman/listinfo/refpolicy>
> <http://oss.tresys.com/mailman/listinfo/refpolicy
> <http://oss.tresys.com/mailman/listinfo/refpolicy>>>
> >
>
>
> --
> Key fingerprint = 5F4D 3CDB D3F8 3652 FBD8 02D5
> 3B6C 5F1D
> 2C7B 6B02
>
>
> https://sks-keyservers.net/pks/lookup?op=get&search=0x3B6C5F1D2C7B6B02
> <https://sks-keyservers.net/pks/lookup?op=get&search=0x3B6C5F1D2C7B6B02>
>
> <https://sks-keyservers.net/pks/lookup?op=get&search=0x3B6C5F1D2C7B6B02
> <https://sks-keyservers.net/pks/lookup?op=get&search=0x3B6C5F1D2C7B6B02>>
>
>
> <https://sks-keyservers.net/pks/lookup?op=get&search=0x3B6C5F1D2C7B6B02
> <https://sks-keyservers.net/pks/lookup?op=get&search=0x3B6C5F1D2C7B6B02>
>
> <https://sks-keyservers.net/pks/lookup?op=get&search=0x3B6C5F1D2C7B6B02
> <https://sks-keyservers.net/pks/lookup?op=get&search=0x3B6C5F1D2C7B6B02>>>
> Dominick Grift
>
>
>
>
> _______________________________________________
> refpolicy mailing list
> refpolicy at oss.tresys.com
> <mailto:refpolicy@oss.tresys.com>
> <mailto:refpolicy at oss.tresys.com <mailto:refpolicy@oss.tresys.com>>
> http://oss.tresys.com/mailman/listinfo/refpolicy
> <http://oss.tresys.com/mailman/listinfo/refpolicy>
> <http://oss.tresys.com/mailman/listinfo/refpolicy
> <http://oss.tresys.com/mailman/listinfo/refpolicy>>
>
>
>
> --
> Chris PeBenito
>
>
>
>
> --
> Chris PeBenito
>
>
--
Chris PeBenito
^ permalink raw reply [flat|nested] 14+ messages in thread
* [refpolicy] Testing in the Reference Policy
2016-08-25 22:51 ` Chris PeBenito
@ 2016-08-25 22:54 ` Naftuli Tzvi Kay
2016-08-28 18:25 ` Naftuli Tzvi Kay
0 siblings, 1 reply; 14+ messages in thread
From: Naftuli Tzvi Kay @ 2016-08-25 22:54 UTC (permalink / raw)
To: refpolicy
Okay, I'll post back when I have something significant to report.
Thanks,
- Naftuli Tzvi
On Thu, Aug 25, 2016 at 3:51 PM, Chris PeBenito <pebenito@ieee.org> wrote:
> On 08/25/16 18:48, Naftuli Tzvi Kay wrote:
>
>> I'm hoping to have as few scripts as possible. Is there a preference
>> here? I could use Ansible, but if shell scripts are the most portable
>> thing with the least dependencies, I can do that.
>>
>
> I'd prefer shell scripts, because it doesn't incur even more dependencies,
> but if they get too ugly, I'd be willing to entertain something like an
> ansible playbook.
>
>
>
> On Thu, Aug 25, 2016 at 3:39 PM, Chris PeBenito <pebenito@ieee.org
>> <mailto:pebenito@ieee.org>> wrote:
>>
>> On 08/24/16 18:14, Naftuli Tzvi Kay wrote:
>>
>> I was thinking of making a Vagrant environment where users can
>> test
>> their applications on a system running the currently checked out
>> master
>> of refpolicy. This will make it easier for me to update my
>> policy for
>> Syncthing for instance.
>>
>> In short, an environment to:
>> 1. compile the reference policy
>> 2. install it in the running kernel
>> 3. install applications and do integration tests of the policy
>> against
>> actual running binaries when developing new policies for
>> applications
>>
>>
>> Will you be including configuration/scripts for provisioning too?
>> How would the provisioning be done? Shell scripts?
>>
>>
>>
>> On Wed, Aug 24, 2016 at 3:12 PM, Chris PeBenito
>> <pebenito at ieee.org <mailto:pebenito@ieee.org>
>> <mailto:pebenito at ieee.org <mailto:pebenito@ieee.org>>> wrote:
>>
>> On 08/23/16 23:35, Naftuli Tzvi Kay via refpolicy wrote:
>>
>> Don't worry, I'm not giving up :) It might just take a
>> while
>> before I
>> have something working.
>>
>> Would the reference policy ever be interested in having
>> a Vagrant VM
>> setup for testing policy rules and everything? I'd be
>> happy to
>> contribute that back upstream.
>>
>>
>> What kind of testing did you have in mind? Just a
>> compile/link test
>> or something more? If it's just compile/link then the CI
>> tests are
>> sufficient.
>>
>>
>> On Tue, Aug 23, 2016 at 2:36 AM, Dominick Grift
>> <dac.override at gmail.com <mailto:dac.override@gmail.com>
>> <mailto:dac.override at gmail.com <mailto:dac.override@gmail.com>>
>> <mailto:dac.override@gmail.com
>> <mailto:dac.override@gmail.com> <mailto:dac.override@gmail.com
>> <mailto:dac.override@gmail.com>>>>
>>
>> wrote:
>>
>> On 08/22/2016 07:52 PM, Naftuli Tzvi Kay via
>> refpolicy wrote:
>> > I'm currently working on a reference policy
>> addition to
>> restrict access for
>> > a given application. Up until now, I've been
>> testing my
>> application on a
>> > Fedora 24 Vagrant VM, compiling a non-base module
>> and
>> loading it into the
>> > kernel, running, testing, auditing, etc.
>> >
>> > What I found is that I ended up using a lot of
>> RedHat
>> specific downstream
>> > macros, which aren't supported here upstream.
>> >
>> > Is there a recommended way of testing reference
>> policy
>> code? How can I
>> > alter my Fedora Vagrant VM setup to cover the use
>> case I'm
>> after? Should I
>> > just compile the reference policy in my VM,
>> relabel the
>> filesystem, and
>> > then reboot and load the reference policy into the
>> kernel?
>> >
>> > My host OS is running Ubuntu 14.04, so it's not very
>> useful for debugging
>> > SELinux things; I once tried getting SELinux
>> running on my
>> desktop
>> >
>> <https://rfkrocktk.github.io/2015/12/selinux-on-ubuntu
>> <https://rfkrocktk.github.io/2015/12/selinux-on-ubuntu>
>> <https://rfkrocktk.github.io/2015/12/selinux-on-ubuntu
>> <https://rfkrocktk.github.io/2015/12/selinux-on-ubuntu>>
>>
>> <https://rfkrocktk.github.io/2015/12/selinux-on-ubuntu
>> <https://rfkrocktk.github.io/2015/12/selinux-on-ubuntu>
>> <https://rfkrocktk.github.io/2015/12/selinux-on-ubuntu
>> <https://rfkrocktk.github.io/2015/12/selinux-on-ubuntu>>>>, but X
>> wouldn't
>> > start, etc. and I imagine the policy is pretty out
>> of date.
>> >
>> > How can I create an environment in which I can test
>> my
>> policy against the
>> > program I'm aiming to constrain? (Syncthing)
>> >
>> >
>>
>> I spent the morning recording the full procedure of
>> developing for
>> refpolicy on fedora.
>>
>> I start with installing refpolicy, enabling it. then
>> it
>> write a simple
>> module on top of the installation. This is what one
>> would do
>> when one
>> wants to write a module atop of refpolicy.
>>
>> I encourage you to not give up and take this final
>> step. You
>> are very
>> close, and your module so far is pretty good.
>>
>> Learning how to do what is in the video is the final
>> piece
>> in the puzzle
>> i think.
>>
>> The video might be long but its comprehensive (the
>> video
>> might still be
>> processing on youtube but it will become available
>> shortly:
>>
>> https://www.youtube.com/watch?v=XIyxW4qT0UM
>> <https://www.youtube.com/watch?v=XIyxW4qT0UM>
>> <https://www.youtube.com/watch?v=XIyxW4qT0UM
>> <https://www.youtube.com/watch?v=XIyxW4qT0UM>>
>> <https://www.youtube.com/watch?v=XIyxW4qT0UM
>> <https://www.youtube.com/watch?v=XIyxW4qT0UM>
>> <https://www.youtube.com/watch?v=XIyxW4qT0UM
>> <https://www.youtube.com/watch?v=XIyxW4qT0UM>>>
>>
>> If you have any questions, then please do not
>> hesitate to ask
>>
>> >
>> > _______________________________________________
>> > refpolicy mailing list
>> > refpolicy at oss.tresys.com
>> <mailto:refpolicy@oss.tresys.com>
>> <mailto:refpolicy at oss.tresys.com <mailto:refpolicy@oss.tresys.com
>> >>
>> <mailto:refpolicy@oss.tresys.com
>> <mailto:refpolicy@oss.tresys.com>
>> <mailto:refpolicy at oss.tresys.com <mailto:refpolicy@oss.tresys.com
>> >>>
>> > http://oss.tresys.com/mailman/listinfo/refpolicy
>> <http://oss.tresys.com/mailman/listinfo/refpolicy>
>> <http://oss.tresys.com/mailman/listinfo/refpolicy
>> <http://oss.tresys.com/mailman/listinfo/refpolicy>>
>> <http://oss.tresys.com/mailman/listinfo/refpolicy
>> <http://oss.tresys.com/mailman/listinfo/refpolicy>
>> <http://oss.tresys.com/mailman/listinfo/refpolicy
>> <http://oss.tresys.com/mailman/listinfo/refpolicy>>>
>> >
>>
>>
>> --
>> Key fingerprint = 5F4D 3CDB D3F8 3652 FBD8 02D5
>> 3B6C 5F1D
>> 2C7B 6B02
>>
>>
>> https://sks-keyservers.net/pks/lookup?op=get&search=0x3B6C5F
>> 1D2C7B6B02
>> <https://sks-keyservers.net/pks/lookup?op=get&search=0x3B6C5
>> F1D2C7B6B02>
>>
>> <https://sks-keyservers.net/pks/lookup?op=get&search=0x3B6C5
>> F1D2C7B6B02
>> <https://sks-keyservers.net/pks/lookup?op=get&search=0x3B6C5
>> F1D2C7B6B02>>
>>
>>
>> <https://sks-keyservers.net/pks/lookup?op=get&search=0x3B6C5
>> F1D2C7B6B02
>> <https://sks-keyservers.net/pks/lookup?op=get&search=0x3B6C5
>> F1D2C7B6B02>
>>
>> <https://sks-keyservers.net/pks/lookup?op=get&search=0x3B6C5
>> F1D2C7B6B02
>> <https://sks-keyservers.net/pks/lookup?op=get&search=0x3B6C5
>> F1D2C7B6B02>>>
>> Dominick Grift
>>
>>
>>
>>
>> _______________________________________________
>> refpolicy mailing list
>> refpolicy at oss.tresys.com
>> <mailto:refpolicy@oss.tresys.com>
>> <mailto:refpolicy at oss.tresys.com <mailto:refpolicy@oss.tresys.com
>> >>
>> http://oss.tresys.com/mailman/listinfo/refpolicy
>> <http://oss.tresys.com/mailman/listinfo/refpolicy>
>> <http://oss.tresys.com/mailman/listinfo/refpolicy
>> <http://oss.tresys.com/mailman/listinfo/refpolicy>>
>>
>>
>>
>> --
>> Chris PeBenito
>>
>>
>>
>>
>> --
>> Chris PeBenito
>>
>>
>>
>
> --
> Chris PeBenito
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://oss.tresys.com/pipermail/refpolicy/attachments/20160825/7ddfea51/attachment-0001.html
^ permalink raw reply [flat|nested] 14+ messages in thread
* [refpolicy] Testing in the Reference Policy
2016-08-25 22:54 ` Naftuli Tzvi Kay
@ 2016-08-28 18:25 ` Naftuli Tzvi Kay
2016-08-28 18:44 ` Chris PeBenito
0 siblings, 1 reply; 14+ messages in thread
From: Naftuli Tzvi Kay @ 2016-08-28 18:25 UTC (permalink / raw)
To: refpolicy
Would most of you appreciate a Fedora VM or a CentOS VM for the Vagrant box?
On Aug 25, 2016 15:54, "Naftuli Tzvi Kay" <rfkrocktk@gmail.com> wrote:
> Okay, I'll post back when I have something significant to report.
>
> Thanks,
> - Naftuli Tzvi
>
> On Thu, Aug 25, 2016 at 3:51 PM, Chris PeBenito <pebenito@ieee.org> wrote:
>
>> On 08/25/16 18:48, Naftuli Tzvi Kay wrote:
>>
>>> I'm hoping to have as few scripts as possible. Is there a preference
>>> here? I could use Ansible, but if shell scripts are the most portable
>>> thing with the least dependencies, I can do that.
>>>
>>
>> I'd prefer shell scripts, because it doesn't incur even more
>> dependencies, but if they get too ugly, I'd be willing to entertain
>> something like an ansible playbook.
>>
>>
>>
>> On Thu, Aug 25, 2016 at 3:39 PM, Chris PeBenito <pebenito@ieee.org
>>> <mailto:pebenito@ieee.org>> wrote:
>>>
>>> On 08/24/16 18:14, Naftuli Tzvi Kay wrote:
>>>
>>> I was thinking of making a Vagrant environment where users can
>>> test
>>> their applications on a system running the currently checked out
>>> master
>>> of refpolicy. This will make it easier for me to update my
>>> policy for
>>> Syncthing for instance.
>>>
>>> In short, an environment to:
>>> 1. compile the reference policy
>>> 2. install it in the running kernel
>>> 3. install applications and do integration tests of the policy
>>> against
>>> actual running binaries when developing new policies for
>>> applications
>>>
>>>
>>> Will you be including configuration/scripts for provisioning too?
>>> How would the provisioning be done? Shell scripts?
>>>
>>>
>>>
>>> On Wed, Aug 24, 2016 at 3:12 PM, Chris PeBenito
>>> <pebenito at ieee.org <mailto:pebenito@ieee.org>
>>> <mailto:pebenito at ieee.org <mailto:pebenito@ieee.org>>> wrote:
>>>
>>> On 08/23/16 23:35, Naftuli Tzvi Kay via refpolicy wrote:
>>>
>>> Don't worry, I'm not giving up :) It might just take a
>>> while
>>> before I
>>> have something working.
>>>
>>> Would the reference policy ever be interested in having
>>> a Vagrant VM
>>> setup for testing policy rules and everything? I'd be
>>> happy to
>>> contribute that back upstream.
>>>
>>>
>>> What kind of testing did you have in mind? Just a
>>> compile/link test
>>> or something more? If it's just compile/link then the CI
>>> tests are
>>> sufficient.
>>>
>>>
>>> On Tue, Aug 23, 2016 at 2:36 AM, Dominick Grift
>>> <dac.override at gmail.com <mailto:dac.override@gmail.com>
>>> <mailto:dac.override at gmail.com <mailto:dac.override@gmail.com>>
>>> <mailto:dac.override@gmail.com
>>> <mailto:dac.override@gmail.com> <mailto:dac.override@gmail.com
>>> <mailto:dac.override@gmail.com>>>>
>>>
>>> wrote:
>>>
>>> On 08/22/2016 07:52 PM, Naftuli Tzvi Kay via
>>> refpolicy wrote:
>>> > I'm currently working on a reference policy
>>> addition to
>>> restrict access for
>>> > a given application. Up until now, I've been
>>> testing my
>>> application on a
>>> > Fedora 24 Vagrant VM, compiling a non-base module
>>> and
>>> loading it into the
>>> > kernel, running, testing, auditing, etc.
>>> >
>>> > What I found is that I ended up using a lot of
>>> RedHat
>>> specific downstream
>>> > macros, which aren't supported here upstream.
>>> >
>>> > Is there a recommended way of testing reference
>>> policy
>>> code? How can I
>>> > alter my Fedora Vagrant VM setup to cover the use
>>> case I'm
>>> after? Should I
>>> > just compile the reference policy in my VM,
>>> relabel the
>>> filesystem, and
>>> > then reboot and load the reference policy into the
>>> kernel?
>>> >
>>> > My host OS is running Ubuntu 14.04, so it's not
>>> very
>>> useful for debugging
>>> > SELinux things; I once tried getting SELinux
>>> running on my
>>> desktop
>>> >
>>> <https://rfkrocktk.github.io/2015/12/selinux-on-ubuntu
>>> <https://rfkrocktk.github.io/2015/12/selinux-on-ubuntu>
>>> <https://rfkrocktk.github.io/2015/12/selinux-on-ubuntu
>>> <https://rfkrocktk.github.io/2015/12/selinux-on-ubuntu>>
>>>
>>> <https://rfkrocktk.github.io/2015/12/selinux-on-ubuntu
>>> <https://rfkrocktk.github.io/2015/12/selinux-on-ubuntu>
>>> <https://rfkrocktk.github.io/2015/12/selinux-on-ubuntu
>>> <https://rfkrocktk.github.io/2015/12/selinux-on-ubuntu>>>>, but
>>> X
>>> wouldn't
>>> > start, etc. and I imagine the policy is pretty out
>>> of date.
>>> >
>>> > How can I create an environment in which I can
>>> test my
>>> policy against the
>>> > program I'm aiming to constrain? (Syncthing)
>>> >
>>> >
>>>
>>> I spent the morning recording the full procedure of
>>> developing for
>>> refpolicy on fedora.
>>>
>>> I start with installing refpolicy, enabling it. then
>>> it
>>> write a simple
>>> module on top of the installation. This is what one
>>> would do
>>> when one
>>> wants to write a module atop of refpolicy.
>>>
>>> I encourage you to not give up and take this final
>>> step. You
>>> are very
>>> close, and your module so far is pretty good.
>>>
>>> Learning how to do what is in the video is the final
>>> piece
>>> in the puzzle
>>> i think.
>>>
>>> The video might be long but its comprehensive (the
>>> video
>>> might still be
>>> processing on youtube but it will become available
>>> shortly:
>>>
>>> https://www.youtube.com/watch?v=XIyxW4qT0UM
>>> <https://www.youtube.com/watch?v=XIyxW4qT0UM>
>>> <https://www.youtube.com/watch?v=XIyxW4qT0UM
>>> <https://www.youtube.com/watch?v=XIyxW4qT0UM>>
>>> <https://www.youtube.com/watch?v=XIyxW4qT0UM
>>> <https://www.youtube.com/watch?v=XIyxW4qT0UM>
>>> <https://www.youtube.com/watch?v=XIyxW4qT0UM
>>> <https://www.youtube.com/watch?v=XIyxW4qT0UM>>>
>>>
>>> If you have any questions, then please do not
>>> hesitate to ask
>>>
>>> >
>>> > _______________________________________________
>>> > refpolicy mailing list
>>> > refpolicy at oss.tresys.com
>>> <mailto:refpolicy@oss.tresys.com>
>>> <mailto:refpolicy at oss.tresys.com <mailto:refpolicy@oss.tresys.c
>>> om>>
>>> <mailto:refpolicy@oss.tresys.com
>>> <mailto:refpolicy@oss.tresys.com>
>>> <mailto:refpolicy at oss.tresys.com <mailto:refpolicy@oss.tresys.c
>>> om>>>
>>> > http://oss.tresys.com/mailman/listinfo/refpolicy
>>> <http://oss.tresys.com/mailman/listinfo/refpolicy>
>>> <http://oss.tresys.com/mailman/listinfo/refpolicy
>>> <http://oss.tresys.com/mailman/listinfo/refpolicy>>
>>> <http://oss.tresys.com/mailman/listinfo/refpolicy
>>> <http://oss.tresys.com/mailman/listinfo/refpolicy>
>>> <http://oss.tresys.com/mailman/listinfo/refpolicy
>>> <http://oss.tresys.com/mailman/listinfo/refpolicy>>>
>>> >
>>>
>>>
>>> --
>>> Key fingerprint = 5F4D 3CDB D3F8 3652 FBD8 02D5
>>> 3B6C 5F1D
>>> 2C7B 6B02
>>>
>>>
>>> https://sks-keyservers.net/pks/lookup?op=get&search=0x3B6C5F
>>> 1D2C7B6B02
>>> <https://sks-keyservers.net/pks/lookup?op=get&search=0x3B6C5
>>> F1D2C7B6B02>
>>>
>>> <https://sks-keyservers.net/pks/lookup?op=get&search=0x3B6C5
>>> F1D2C7B6B02
>>> <https://sks-keyservers.net/pks/lookup?op=get&search=0x3B6C5
>>> F1D2C7B6B02>>
>>>
>>>
>>> <https://sks-keyservers.net/pks/lookup?op=get&search=0x3B6C5
>>> F1D2C7B6B02
>>> <https://sks-keyservers.net/pks/lookup?op=get&search=0x3B6C5
>>> F1D2C7B6B02>
>>>
>>> <https://sks-keyservers.net/pks/lookup?op=get&search=0x3B6C5
>>> F1D2C7B6B02
>>> <https://sks-keyservers.net/pks/lookup?op=get&search=0x3B6C5
>>> F1D2C7B6B02>>>
>>> Dominick Grift
>>>
>>>
>>>
>>>
>>> _______________________________________________
>>> refpolicy mailing list
>>> refpolicy at oss.tresys.com
>>> <mailto:refpolicy@oss.tresys.com>
>>> <mailto:refpolicy at oss.tresys.com <mailto:refpolicy@oss.tresys.c
>>> om>>
>>> http://oss.tresys.com/mailman/listinfo/refpolicy
>>> <http://oss.tresys.com/mailman/listinfo/refpolicy>
>>> <http://oss.tresys.com/mailman/listinfo/refpolicy
>>> <http://oss.tresys.com/mailman/listinfo/refpolicy>>
>>>
>>>
>>>
>>> --
>>> Chris PeBenito
>>>
>>>
>>>
>>>
>>> --
>>> Chris PeBenito
>>>
>>>
>>>
>>
>> --
>> Chris PeBenito
>>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://oss.tresys.com/pipermail/refpolicy/attachments/20160828/1e62a264/attachment-0001.html
^ permalink raw reply [flat|nested] 14+ messages in thread
* [refpolicy] Testing in the Reference Policy
2016-08-28 18:25 ` Naftuli Tzvi Kay
@ 2016-08-28 18:44 ` Chris PeBenito
0 siblings, 0 replies; 14+ messages in thread
From: Chris PeBenito @ 2016-08-28 18:44 UTC (permalink / raw)
To: refpolicy
On 08/28/16 14:25, Naftuli Tzvi Kay wrote:
> Would most of you appreciate a Fedora VM or a CentOS VM for the Vagrant box?
A minimal Fedora would probably be a better bet, as it is more up to date.
On a side note, please do not send HTML emails to the list.
> On Aug 25, 2016 15:54, "Naftuli Tzvi Kay" <rfkrocktk@gmail.com
> <mailto:rfkrocktk@gmail.com>> wrote:
>
> Okay, I'll post back when I have something significant to report.
>
> Thanks,
> - Naftuli Tzvi
>
> On Thu, Aug 25, 2016 at 3:51 PM, Chris PeBenito <pebenito@ieee.org
> <mailto:pebenito@ieee.org>> wrote:
>
> On 08/25/16 18:48, Naftuli Tzvi Kay wrote:
>
> I'm hoping to have as few scripts as possible. Is there a
> preference
> here? I could use Ansible, but if shell scripts are the most
> portable
> thing with the least dependencies, I can do that.
>
>
> I'd prefer shell scripts, because it doesn't incur even more
> dependencies, but if they get too ugly, I'd be willing to
> entertain something like an ansible playbook.
>
>
>
> On Thu, Aug 25, 2016 at 3:39 PM, Chris PeBenito
> <pebenito at ieee.org <mailto:pebenito@ieee.org>
> <mailto:pebenito at ieee.org <mailto:pebenito@ieee.org>>> wrote:
>
> On 08/24/16 18:14, Naftuli Tzvi Kay wrote:
>
> I was thinking of making a Vagrant environment where
> users can test
> their applications on a system running the currently
> checked out
> master
> of refpolicy. This will make it easier for me to
> update my
> policy for
> Syncthing for instance.
>
> In short, an environment to:
> 1. compile the reference policy
> 2. install it in the running kernel
> 3. install applications and do integration tests of
> the policy
> against
> actual running binaries when developing new policies for
> applications
>
>
> Will you be including configuration/scripts for
> provisioning too?
> How would the provisioning be done? Shell scripts?
--
Chris PeBenito
^ permalink raw reply [flat|nested] 14+ messages in thread
end of thread, other threads:[~2016-08-28 18:44 UTC | newest]
Thread overview: 14+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2016-08-22 17:52 [refpolicy] Testing in the Reference Policy Naftuli Tzvi Kay
2016-08-22 17:58 ` Dominick Grift
2016-08-22 19:33 ` Dominick Grift
2016-08-23 5:16 ` Jason Zaman
2016-08-23 9:36 ` Dominick Grift
2016-08-24 3:35 ` Naftuli Tzvi Kay
2016-08-24 22:12 ` Chris PeBenito
2016-08-24 22:14 ` Naftuli Tzvi Kay
2016-08-25 22:39 ` Chris PeBenito
2016-08-25 22:48 ` Naftuli Tzvi Kay
2016-08-25 22:51 ` Chris PeBenito
2016-08-25 22:54 ` Naftuli Tzvi Kay
2016-08-28 18:25 ` Naftuli Tzvi Kay
2016-08-28 18:44 ` Chris PeBenito
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.