Tag Info

Hot answers tagged

7

I suspect you are slightly confused about how Bell-Lapadula works, and in particular, how categories work in Bell-Lapadula. Classifications are necessarily ordered. In your example, we have Restricted < Confidential < Secret < Top Secret. So far, so good. Categories are, in general, not ordered. Often, they are a set, with no ordering amongst ...


6

There are a couple of places that you can see Mandatory Access Control (MAC) systems in operation in consumer OSs, that spring to mind. SELinux is installed on a number of linux distributions and can be set in enforcing mode which would show an example. Also windows Mandatory Integrity Levels are another example. Seeing an example of this could be done by ...


6

[Restricted, Confidential, Secret, Top Secret] => [0, 1, 2, 3] //constants [Lieutenant, Colonel, Captain, Lieutenant General, General] => [0, 1, 2, 3, 4] //constants Set this up in a static class similar to how Math.MAX_INT and others work ... Classification.RESTRICTED will return 0. That makes it easy to read from a programmer's standpoint. How ...


6

Capabilities are considered more powerful. They prevent confused deputy attacks, where applications act of behalf of others, and provide a clear paradigm for reducing and delegating permissions. This is important in systems where applications communicate a lot with each other, like Android or microkernel systems. In fact, NICTA advertises that as a result of ...


6

Grsecurity is not a pure pathname-based MAC system like TOMOYO or AppArmor. Policy is described using pathnames (same as every other system, including SELinux), but these are converted to inode/dev pairs at enable time and used thereafter. Pathnames are only used when matching regular expressions from policy or to provide "policy-recreation" -- given the ...


5

MAC, in its academic form, is not about access control but about information flow. This is a fundamentally different approach than capabilities. MAC aims to prevents information flow from high to low levels or from low to high, depending on if you're worried about integrity or confidentiality. It's hierarchical that way. Capabilities are not as far as I ...


5

The short answer: They are two entirely different kinds of systems. They're just different. Comparing them is a bit like comparing apples and oranges. They are so fundamentally different -- different in so many ways -- that no one-sentence comparison will really do them justice. Oh, that's not good enough for you? OK, then, here's the long answer. ...


4

The simple way to remember the Bell-LaPadula model is: No read up, no write down. A classification is the label and controls whether the subject (person) can read the object (document, file, etc). For this example I will ignore compartments. Lets create four people Alice, Bob, Charlie, Diana, and Eve. Now lets give each one a laebl: Alice is Confidential, ...


3

On a practical level MAC (as implemented in SELinux) requires all objects (files, directories, processes, and users) in the system to be labeled. A default label is given to objects not otherwise specified. It also requires a policy describing what types of access labeled objects are allowed. A monitor watches access requests and compares labels to the ...


3

Unfortunately I think you already answered your question with the "fixing SELinux basically involves turning it off" comment. It is hard work. In an ideal world specific requirements for access etc. would be detailed and any application would be coded to enforce MAC or other control paradigm, however in the real world the following issues arise: ...


2

I think, pathname based access control in general is not flawed conceptually at all, it may even have advantages, but current implementations are not convenient. Advantage is that you can have cleaner and more understandable policy specified in the single place, and you don't have complications of xattrs spreading over whole filesystem. Thinkability, I say, ...


2

No, HIPS is fundamentally different than MAC. Mandatory access control (MAC) systems try to provide a robust foundation for security on your machine. MAC systems are generally intended to provide a high level of assurance: they are based upon a rigorous mathematical theory, they try to provide strong guarantees, and they are intended to be secure even if ...


2

If you look at an AppArmor rule-set or do any research into AppArmor you can see that they are designed to lock down a specific process. AppArmor is in no way shape or form a solution to "white-list" processes, nor will it ever be.


1

I cant give a scenario but I can tell you the difference in location. Physical Location in your terms refer to where your access the site from, as in a physical address. The logical address is what device you are using. Because Full blown computers are now the size of cell phones, the definitions have to change to better suit the understanding. Also you ...


1

A Linux system contains a lot of "applications" -- do a ls /usr/bin to see it. Many of these must be launched regularly for proper system operation, not only at boot but also afterwards. Also, a lot of applications rely on the ability to launch these other applications, without necessarily making it apparent to the human user. Anything which looks like a ...


1

I want to quote Casey Schaufler (SMACK creator): From the middle of the 1980's until the turn of the century Mandatory Access Control (MAC) was very closely associated with the Bell & LaPadula security model, a mathematical description of the United States Department of Defense policy for marking paper documents. MAC in this form enjoyed a ...


1

Re: "but to my knowledge only Fedora and subsequently RHEL ship with these enabled" Ubuntu has shipped since 8.04 (2008) with AppArmor enabled by default, and I hear that SUSE has had it since release 10. You can find out what it is doing on your system via sudo apparmor_status One of my current relatively vanilla Ubuntu desktop systems has 12 profiles ...


1

@Rory-Alsop is right on. Robust, effective, security has a very high cost. what is preventing the uptake of MAC systems such as SELinux/AppArmor in corporate and desktop computing environments? I believe the answer is cost. Security, like any other aspect of a system, has cost. Consciously or not, those responsible for purchasing IT, be it home user ...


1

Acutally no need to exclude kernel. You can tell though files /home/backup/\*{\*}\* may only be changed if domain "<kernel> /usr/bin/backup-script" does access. relevant links from Tomoyo Guide: http://tomoyo.sourceforge.jp/2.5/policy-specification/exception-policy-syntax.html.en#path_group Chapter 5-8


1

For Turing-complete languages, you can't detect what they're going to do or access ahead of time. You can try to detect certain things based on usage of various language-specific framework classes and keywords, but it's not easy. Let's say you're trying to stop someone from calling alert() in Javascript. Consider the following: exec( ...



Only top voted, non community-wiki answers of a minimum length are eligible