On Fri, 2007-06-15 at 11:01 -0700, Casey Schaufler wrote: > --- Greg KH <greg@xxxxxxxxx> wrote: > > > > A daemon using inotify can "instantly"[1] detect this and label the file > > properly if it shows up. > > In our 1995 B1 evaluation of Trusted Irix we were told in no > uncertain terms that such a solution was not acceptable under > the TCSEC requirements. Detection and relabel on an unlocked > object creates an obvious window for exploitation. We were told > that such a scheme would be considered a design flaw. > > I understand that some of the Common Criteria labs are less > aggressive regarding chasing down these issues than the NCSC > teams were. It might not prevent an evaluation from completing > today. It is still hard to explain why it's ok to have a file > that's labeled incorrectly _even briefly_. It is the systems > job to ensure that that does not happen. Um, Casey, he is talking about how to emulate AppArmor behavior on a label-based system like SELinux, not meeting B1 or LSPP or anything like that (which AppArmor can't do regardless). As far as general issue goes, if your policy is configured such that the new file gets the most restrictive label possible at creation time and then the daemon relabels it to a less restrictive label if appropriate, then there is no actual window of exposure. Also, there is such a daemon, restorecond, in SELinux (policycoreutils) although we avoid relying on it for anything security-critical naturally. And one could introduce the named type transition concept that has been discussed in this thread without much difficulty to selinux. -- Stephen Smalley National Security Agency - To unsubscribe from this list: send the line "unsubscribe linux-fsdevel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
