[refpolicy] Testing in the Reference Policy

[dac.override@gmail.com (Dominick Grift)]

On 08/22/2016 07:52 PM, Naftuli Tzvi Kay via refpolicy wrote:
> I'm currently working on a reference policy addition to restrict access for
> a given application. Up until now, I've been testing my application on a
> Fedora 24 Vagrant VM, compiling a non-base module and loading it into the
> kernel, running, testing, auditing, etc.
> 
> What I found is that I ended up using a lot of RedHat specific downstream
> macros, which aren't supported here upstream.
> 
> Is there a recommended way of testing reference policy code? How can I
> alter my Fedora Vagrant VM setup to cover the use case I'm after? Should I
> just compile the reference policy in my VM, relabel the filesystem, and
> then reboot and load the reference policy into the kernel?
> 
> My host OS is running Ubuntu 14.04, so it's not very useful for debugging
> SELinux things; I once tried getting SELinux running on my desktop
> <https://rfkrocktk.github.io/2015/12/selinux-on-ubuntu>, but X wouldn't
> start, etc. and I imagine the policy is pretty out of date.
> 
> How can I create an environment in which I can test my policy against the
> program I'm aiming to constrain? (Syncthing)
> 

syncthing does not need X. So you can install a text-based system. f24
minimal server install maybe.

then you can just install refpolicy (make sure though to build with
init_systemd (i forgot that)

Also make sure you set selinux to permissive mode

then you can just start developing your policy.

Your query prompted me to try it out myself and record it. Most of the
video is me struggling with updating my qemu script and eventually i
realized i forgot to set init_systemd in the makefile, but its too late
for me to redo it tonight (tired). but its roughly the procedure.

https://youtu.be/9vgdHb2eXjg  (its currently still processing)

Maybe tomorrow ill have another look (try it again and this time make
sure init_systemd is enabled ...

Anyhow this example does have some good information in between all the noise


> 
> 
> _______________________________________________
> refpolicy mailing list
> refpolicy at oss.tresys.com
> http://oss.tresys.com/mailman/listinfo/refpolicy
> 


-- 
Key fingerprint = 5F4D 3CDB D3F8 3652 FBD8  02D5 3B6C 5F1D 2C7B 6B02
https://sks-keyservers.net/pks/lookup?op=get&search=0x3B6C5F1D2C7B6B02
Dominick Grift

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 648 bytes
Desc: OpenPGP digital signature
Url : http://oss.tresys.com/pipermail/refpolicy/attachments/20160822/8d46a23d/attachment.bin