L.S., I'm currently running kernel 2.6.25 with SELinux and Tomoyo on a CentOS-5.2 workstation. First of all thanks for the patch and the documentation which are well-written making it *very easy* to patch, compile and run it. My goal is to understand Tomoyo better from a practical point of view, asking myself questions like: "can Tomoyo help me accomplish things easier, more efficient, than product X?" (where X is any of SELinux, GRSecurity or other security-enhancing methods and tools). Better understanding may help produce examples that may encourage others to explore and use Tomoyo. Most of what I'm reading right now will be from the Policy Specifications (polspec), and consequently questons arise... Currently the whole kernel domain runs in learning mode setting it up with 'setprofile -r 1 '<kernel>'' early on in /etc/rc.d/rc.sysinit. Is it possible for me to configure this as the default mode on bootup in other ways? In learning mode some domains collect too much information, but after patternizing entries in the domain_policy.conf (edit file, save, load) I *still* see newly learned entries that should match the pattern. In the polspec, /proc/ccs/exception_policy, file_pattern it reads "When file access requests arise in learning mode (..) , the requested pathname is automatically patterned according to patterns specified using this keyword". So could you tell me the correct procedure? Learn > patternize in exception_policy.conf > remove matching entries from domain_policy.conf? To make one domain enter enforcing mode always, where would be the best place to set that? Currently running 2452 domains, in the policy editor the tree view is large. Would it be possible to add a "collapse view" feature so I can browse by levels? Just an idea, I also found more than 1K domains share a "common root", say: '<kernel> /sbin/init /etc/X11/prefdm /usr/bin/kdm /etc/X11/xinit/Xsession /usr/bin/ssh-agent /bin/sh /bin/bash /usr/bin/dbus-launch /home/username/.Xclients /home/username/.Xclients-default /usr/bin/windowmanager'. That's not easy to read and therefore not easy to manage. Also the string is 200-plus chars, while a hash value would be consistent and maybe faster (in terms of lookups) and use way less chars. Would it someday be possible to use say a hash table so we can assign a "trivial name" to a common root? Thanks for your patience! Best regards, unSpawn * One of the "side effects" mentioned in the docs is that Tomoyo may help you understand the intricacies of the system "better" and for sure it does. For example it helped me realise that a certain file integrity checker regularly executed '/bin/ps' (which is good to know because I would have thought it would have it's own, built- in implementation) which isn't good if you know 'ps' is a regular target of rootkits... --- -- Click here for great computer networking solutions! http://tagline.hushmail.com/fc/Ioyw6h4fM6l2LHMaTgeIrmddI8TMne9NuZznWoXUvWPKjovkiGjeaB/
TOMOYO
Fork