Hi,

Can we do this BOF on Sunday or Monday evening? Tuesday would
work for me, but it conflicts with the social event. I need to leave on
Wednesday, and I really like to be at the BOF.

Thanks.

Jarrett

David P. Quigley wrote:

Hello,

For those who were interested in the Security Label Bar BOF we will be holding
it on Wednesday in the evening after the Operations and Administration Plenary
(roughly 8 or 8:30). I'm tentatively setting this time so if you have other
suggestions or believe it should be earlier feel free to suggest another time. I
will try to find a location for the BOF once I arrive on Sunday and once I have
found it I will post the location to the mailing list. I will not have access to
this email account while at IETF but I will be subscribed to the SAAG and
doi-discuss mailing lists with a travel account.

The bar BOF is meeting to discuss a consistent definition of Domains of
Interpretation and will also consist of discussion on the management and
administration of DOIs as well. A conversation about this has already started on
the DOI Discussion mailing list which can be found at the link below[1]. We hope
to start with the definition defined in the CALIPSO draft and see what changes
need to be made to allow it to support work being done with Labeled IPSec and
Labeled NFS.

While we are meeting to discuss DOIs, if there are additional topics relating to
security labels feel free to notify me and I will put them on the agenda.

Dave Quigley


[1] http://mail.opensolaris.org/mailman/listinfo/doi-discuss


_______________________________________________
doi-discuss mailing list
doi-discuss <at> opensolaris.org
http://mail.opensolaris.org/mailman/listinfo/doi-discuss
 

_______________________________________________
saag mailing list
saag <at> ietf.org
https://www.ietf.org/mailman/listinfo/saag

Hello,

    The Security Label Bar BOF will start by meeting in the lobby of the Hilton at 8pm. From there we can choose one of the nearby pubs to go to. I have a list of local restaurants/pubs from the concierge and it lists an Irish pub (The Local) and a British pub (Brit's Pub) within two blocks of the Hilton. If people prefer to stay at the hotel we can also use the restaurant down stairs as well. I figure if we go to one of the pubs people can eat there if they like or just go for drinks if they have already eaten.

 

Since I haven't received any other topics people wish to discuss the agenda at the moment contains one item (all be it a complex one).

 

Background:

 

Originally the term Security Label consisted of MLS and Integrity labels as they were used in the orange book. Since then there have been other forms of mandatory access control(MAC) and some MAC systems such as SELinux which implement several of the forms within the same system(Domain Type Enforcement (DTE), RBAC and MLS). In traditional MAC systems the policy is very rigid with the model being built into the operating system. In more recent MAC systems (SELinux, Trusted BSD, Solaris FMAC) the idea of flexibility of policy and mechanism have made it such that even if two systems use the same MAC model they may each possess completely different policies. Because of this the idea of a Domain of Interpretation(DOI) has become more important. Conceptually a DOI is a collection of systems where a label has a consistant semantic meaning across all of those systems. Traditionally MLS labels were represented as integers and bit fields so a DOI in this context defined what bits corresponded to which categories and what levels were present. In more recent systems labels are more directly represented as strings. For example in a DTE system a label may be httpd_content_t and two systems may possess this label but the semantics of it may be different.

 

Discussion Topics:

 

Since several drafts exist that use security labels (CALIPSO, Labeled NFSv4) there is a need for a consistent definition of a DOI. The CALIPSO document has a good starting point for a definition but it is very MLS centric. In addition to the two documents mentioned above there is also are also a couple of documents floating around pertaining to labeled IPSec which also contain a definition of DOIs. Once these make there way to the working group there will be four documents which will have the concept of a DOI.

 

In this meeting I would like to see what changes need to be made to the CALIPSO DOI definition that makes it suitable to Labeled NFS and potentially Labeled IPSec. Once we come up with this we can draw up an initial draft of a document outlining DOIs which these documents could use as a normative reference. In addition to this I would also like to see a discussion on the administration and management of the DOI space.If people with experience handling DOIs are present  it would be useful to hear some issues that have been encountered in traditional systems.

 

Dave Quigley

David Quigley wrote:

Background:

 
Originally the term Security Label consisted of MLS and Integrity labels as they were used in the orange book. Since then there have been other forms of mandatory access control(MAC) and some MAC systems such as SELinux which implement several of the forms within the same system(Domain Type Enforcement (DTE), RBAC and MLS). In traditional MAC systems the policy is very rigid with the model being built into the operating system. In more recent MAC systems (SELinux, Trusted BSD, Solaris FMAC) the idea of flexibility of policy and mechanism have made it such that even if two systems use the same MAC model they may each possess completely different policies. Because of this the idea of a Domain of Interpretation(DOI) has become more important. Conceptually a DOI is a collection of systems where a label has a consistant semantic meaning across all of those systems. Traditionally MLS labels were represented as integers and bit fields so a DOI in this context defined what bits corresponded to which categories and what levels were present. In more recent systems labels are more directly represented as strings. For example in a DTE system a label may be httpd_content_t and two systems may possess this label but the semantics of it may be different.

This is a significant departure from the DOI definition that I
understood. As you mentioned above, using same DOI implies
all systems agree to same label interpretation and hence enforce
same label policies. I don't quite understand the rationale in
wanting to change that definition to accommodate DTE MAC
systems. Labels can be represented by strings or bitmaps (e.g.
CIPSO). What's important is that systems interpret the labels
the same way, and a DOI value is used to ensure that. If a label
has different meanings on different systems, what do you need a
DOI for? Just to be able interpret a well formed label? I'd think the
ability to interpret a label is implicit. If one doesn't recognize a
label based on label definition, the packet should be dropped.

We can discuss this some more. This post is for people who are
interested in the topic but can't attend the BOF.


Jarrett