Subject: [nfsv4] Would SElinux folk

From: Nico Williams <[email-masked]>
Date: Thu, 7 Apr 2011 20:38:43 -0500

please confirm whether SElinux has many process label transitions, and
please characterize the frequency of process label transitions?

Thanks,

Nico
--

---

From: Trond Myklebust <[email-masked]>
Date: Fri, 08 Apr 2011 07:44:39 -0700

> please characterize the frequency of process label transitions?

Usually a process has 1 label attached to it at startup. That label is
rarely if ever changed, since the whole point is to tag the workload and
hence allow the kernel to match that to a ruleset that authorises the
set of actions that are needed to perform only that particular task.

Trond
-- 
Trond Myklebust
Linux NFS client maintainer

NetApp
[email-masked]
www.netapp.com

---

From: Dave Quigley <[email-masked]>
Date: Fri, 08 Apr 2011 11:53:08 -0400

> set of actions that are needed to perform only that particular task.
The purposes of Process Label Transitions is mainly so you don't have to 
issue commands like run this program with this context. SELinux differs 
from other MAC systems in an important way by introducing an entry point 
concept. With the entrypoints plus the type transitions we ensure that 
an application can enter its security domain in certain ways. So one 
example of when a type transition happens is when you run a command 
similar to service myservice start. To get myservice to run in the 
appropriate security domain there is a type transition rule saying that 
when init runs myservice the resulting process will be in the myservice 
security domain. So in terms of file system labels and process labels 
this is how it would work.

Init runs with process label init_t
Init forks still running in init_t.
Upon execve init execs myservice.
myservice has a file label myservice_exec_t. (This is what allows us to 
use the entry point rule)
now the new process on exec has a context calculated based on a 
transition rule
This rule takes into account a process running as init_t execed a file 
labeled myservice_exec_t.
The kernel calculates the resulting process label which is myservice_t.
Once we are in myservice_t process labels rarely change.
To require a process to change its own label in SELinux requires a 
semi-privileged permission which we almost never give out in policy.

Dave

---

From: Nico Williams <[email-masked]>
Date: Fri, 8 Apr 2011 13:57:30 -0500

On Fri, Apr 8, 2011 at 10:53 AM, Dave Quigley <[email-masked]> wrote:
> issue commands like run this program with this context. SELinux differs from
> other MAC systems in an important way by introducing an entry point concept.
> With the entrypoints plus the type transitions we ensure that an application
> can enter its security domain in certain ways. So one example of when a type
> transition happens is when you run a command similar to service myservice
> start. To get myservice to run in the appropriate security domain there is a
> type transition rule saying that when init runs myservice the resulting
> process will be in the myservice security domain. So in terms of file system
> labels and process labels this is how it would work.
>
> myservice has a file label myservice_exec_t. (This is what allows us to use
> the entry point rule)
> now the new process on exec has a context calculated based on a transition
> rule

OK, I knew all of that, sort of, except that I expected many more
process label transitions (e.g., from the passwd(1) example).

If process label transitions for _user_ processes (the ones that are
going to be driving NFS clients in most cases) are few and far
between, then that's great news.  It means we won't have to worry
about performance here.

Nico
--

---

From: Stephen Smalley <[email-masked]>
Date: Mon, 11 Apr 2011 08:56:54 -0400

> please characterize the frequency of process label transitions?

On Fedora 14:
# sesearch --type -c process |head -1
Found 5284 semantic te rules:

As to frequency, it can happen whenever there is an exec, although in
practice, a transition is only defined when we need to distinguish the
permissions of the newly executed program from those of its caller
(whether shedding, gaining, or just switching to an orthogonal set of
permissions).  Most processes will stay in label for their lifetime.  A
program designed to invoke a more or less privileged helper would
typically switch labels whenever it invokes that helper.

-- 
Stephen Smalley
National Security Agency

---

From: Nico Williams <[email-masked]>
Date: Mon, 11 Apr 2011 09:31:34 -0500

> typically switch labels whenever it invokes that helper.

Thanks.  For data access then the number of process label transitions
we can expect out of SElinux sounds much like for any other MAC
scheme.  Access by diskless clients to their / would have many more
process label transitions, but diskless is best handled by allowing
the client full access, letting the client enforce its local MAC
policies.

In conclusion, I don't think we need to pursue an optimization
allowing one RPCSEC_GSSv3 context handle to be used for many different
subject labels.  If that were to become necessary we could pursue it
using the extensibility fields of the RPCSEC_GSSv3 messages (and the
400 bytes afforded by ONC RPC in every RPC).

Nico
--