Rule set based access control (rsbac) for linux

headers Tomasz Kłoczko | 3 May 2007 14:33

$ make ARCH=x86_64 nonint_oldconfig
rsbac/Kconfig:1093:warning: 'select' used by config symbol 'RSBAC_PAX'
refer to undefined symbol 'PAX'

Is it not will be better put kernel menu entry "Rule Set Based Access
Control (RSBAC)" in "Security options" submenu istead in main ?

kloczek

Did you apply the PaX patch?

2007/5/3, Tomasz Kłoczko <kloczek <at> zie.pg.gda.pl>:
>
>
> $ make ARCH=x86_64 nonint_oldconfig
> rsbac/Kconfig:1093:warning: 'select' used by config symbol 'RSBAC_PAX'
> refer to undefined symbol 'PAX'
>
>
> _______________________________________________
> rsbac mailing list
> rsbac <at> rsbac.org
> http://www.rsbac.org/mailman/listinfo/rsbac
>

If I remember correctly the Security menu was related with the Linux
Security Framework (LSM) which rsbac is not based in (in the rsbac and the
grsecurity homepage there is one article about why rsbac/grsecurity does not
use the LSM framework). Probably the reason was this but I'm not sure...

2007/5/3, Tomasz Kłoczko <kloczek <at> zie.pg.gda.pl>:
>
>
> Is it not will be better put kernel menu entry "Rule Set Based Access
> Control (RSBAC)" in "Security options" submenu istead in main ?
>
> kloczek
>
> _______________________________________________
> rsbac mailing list
> rsbac <at> rsbac.org
> http://www.rsbac.org/mailman/listinfo/rsbac
>

Dnia 03-05-2007, Cz o godzinie 16:29 +0200, tazok napisał(a):
> If I remember correctly the Security menu was related with the Linux
> Security Framework (LSM) which rsbac is not based in (in the rsbac and
> the grsecurity homepage there is one article about why
> rsbac/grsecurity does not use the LSM framework). Probably the reason
> was this but I'm not sure...

In "Security options" submenu beside "Enable different security models"
entry exist "Enable access key retention support" which isn't LSM switch
but it is strict kernel security related. RSBAC it is part of kernel
security infrastructure and IMO logical will be putt group of all RSBAC
switches on the same level as two above.

kloczek

_______________________________________________
rsbac mailing list
rsbac <at> rsbac.org
http://www.rsbac.org/mailman/listinfo/rsbac
Dnia 03-05-2007, Cz o godzinie 16:20 +0200, tazok napisał(a):
> Did you apply the PaX patch?

All RSBAC modyfications I'm get from linux-2.6.21.1-rsbac-1.3.3.tar.bz2
tar ball. After unpacking this tar I'm generate diff between this tree
and vanilla. After this I'm put this patch in Fedora kernel.spec. After
commenting few Fedora patches which rejects (utrace and few other) I'm
start prepare .config files for new rpm packeges. First step for produce
updated *.config files is run nonint_oldconfig target (which isn't
vanilla kernel tree target) which validates all Kconfig entries.
So .. if linux-2.6.21.1-rsbac-1.3.3.tar.bz2 have intergrated PAX patches
answer is: yes :)

BTW PAX: any theoretical chance use PaX and prelink ?

kloczek

_______________________________________________
rsbac mailing list
rsbac <at> rsbac.org
http://www.rsbac.org/mailman/listinfo/rsbac
Well, I think that the "access key retention support" uses the LSM
framework, if not... there is some reason to include the security.h header
file in parts of their code?(please explanation required). I think that
rsbac is not only a part of the kernel security infrastructure, since it
modify (AFAIK) too many kernel code and is too complex. Probably the "model"
that I think is not an LSM and appears in this submenu is PaX, so I doubt
now in the real reason...

2007/5/3, Tomasz Kłoczko <kloczek <at> zie.pg.gda.pl>:
>
> Dnia 03-05-2007, Cz o godzinie 16:29 +0200, tazok napisał(a):
>
> In "Security options" submenu beside "Enable different security models"
> entry exist "Enable access key retention support" which isn't LSM switch
> but it is strict kernel security related. RSBAC it is part of kernel
> security infrastructure and IMO logical will be putt group of all RSBAC
> switches on the same level as two above.
>
> kloczek
>
> _______________________________________________
> rsbac mailing list
> rsbac <at> rsbac.org
> http://www.rsbac.org/mailman/listinfo/rsbac

Please, one think is that rsbac had hooks for work with PaX and other very
different is that rsbac had PaX. If you downloaded the tarball from rsbac
homepage the lonely tarballs that come with rsbac are the enhanced kernels
that you could found in rsbac (and had a pax-test as part of their name).
Please download one PaX patch for your kernel from PaX homepage and try
it...

2007/5/3, Tomasz Kłoczko <kloczek <at> zie.pg.gda.pl>:
>
> Dnia 03-05-2007, Cz o godzinie 16:20 +0200, tazok napisał(a):
> > Did you apply the PaX patch?
>
> All RSBAC modyfications I'm get from linux-2.6.21.1-rsbac-1.3.3.tar.bz2
> tar ball. After unpacking this tar I'm generate diff between this tree
> and vanilla. After this I'm put this patch in Fedora kernel.spec. After
> commenting few Fedora patches which rejects (utrace and few other) I'm
> start prepare .config files for new rpm packeges. First step for produce
> updated *.config files is run nonint_oldconfig target (which isn't
> vanilla kernel tree target) which validates all Kconfig entries.
> So .. if linux-2.6.21.1-rsbac-1.3.3.tar.bz2 have intergrated PAX patches
> answer is: yes :)
>
> BTW PAX: any theoretical chance use PaX and prelink ?
>
> kloczek
>
> _______________________________________________
> rsbac mailing list
> rsbac <at> rsbac.org
> http://www.rsbac.org/mailman/listinfo/rsbac

Nice, where you see: the lonely tarballs that come with rsbac, change with:
the lonely tarballs that come with PaX. One mistake...
2007/5/3, tazok <tazok.id0 <at> gmail.com>:
>
> Please, one think is that rsbac had hooks for work with PaX and other very
> different is that rsbac had PaX. If you downloaded the tarball from rsbac
> homepage the lonely tarballs that come with rsbac are the enhanced kernels
> that you could found in rsbac (and had a pax-test as part of their name).
> Please download one PaX patch for your kernel from PaX homepage and try
> it...
>
>

On May 3, 2007, at 2:33 PM, Tomasz Kłoczko wrote:

>
> $ make ARCH=x86_64 nonint_oldconfig
> rsbac/Kconfig:1093:warning: 'select' used by config symbol 'RSBAC_PAX'
> refer to undefined symbol 'PAX'
>
>
that's not really a bug, that's a feature :)
vanilla rsbac kernel does not have PAX included, hence the harmless 
warning (from rsbac pax module btw).

Mon	Tue	Wed	Thu	Fri	Sat	Sun

	1	2	3	4	5	6
7	8	9	10	11	12	13
14	15	16	17	18	19	20
21	22	23	24	25	26	27
28	29	30	31

14	May 2013
6	April 2013
5	March 2013
14	February 2013
2	January 2013
8	December 2012
4	November 2012
10	October 2012
2	September 2012
8	August 2012
18	July 2012
7	June 2012
7	May 2012
17	April 2012
31	March 2012
6	February 2012
3	January 2012
2	December 2011
18	November 2011
6	October 2011
1	September 2011
17	August 2011
11	July 2011
13	June 2011
6	May 2011
1	April 2011
8	March 2011
14	February 2011
10	January 2011
3	December 2010
3	November 2010
2	October 2010
8	August 2010
2	July 2010
3	May 2010
27	April 2010
7	March 2010
8	February 2010
1	January 2010
10	December 2009
6	November 2009
15	October 2009
22	September 2009
15	August 2009
6	June 2009
8	May 2009
14	April 2009
1	March 2009
8	February 2009
70	January 2009
13	December 2008
37	November 2008
12	October 2008
4	September 2008
3	August 2008
11	July 2008
13	June 2008
1	May 2008
5	February 2008
2	January 2008
3	December 2007
12	November 2007
9	October 2007
20	September 2007
13	August 2007
36	July 2007
13	June 2007
34	May 2007
30	April 2007
12	March 2007
8	February 2007
10	January 2007
10	December 2006
11	November 2006
10	October 2006
28	September 2006
44	August 2006
56	July 2006
37	June 2006
8	May 2006
23	April 2006
27	March 2006
21	February 2006
36	January 2006
15	December 2005
15	November 2005
18	October 2005
30	September 2005
25	August 2005
58	July 2005
39	June 2005
37	May 2005
27	April 2005
39	March 2005
58	February 2005
43	January 2005
20	December 2004
21	November 2004
42	October 2004
21	September 2004
48	August 2004
28	July 2004
59	June 2004
46	May 2004
48	April 2004
57	March 2004
28	February 2004
27	January 2004
60	December 2003
36	November 2003
59	October 2003
63	September 2003
23	August 2003

Kconfig bug in pre 1.3.3 patch

RSBAC kernel configurations menu question

Re: Kconfig bug in pre 1.3.3 patch

Re: RSBAC kernel configurations menu question

Re: RSBAC kernel configurations menu question

Re: Kconfig bug in pre 1.3.3 patch

Re: RSBAC kernel configurations menu question

Re: Kconfig bug in pre 1.3.3 patch

Re: Kconfig bug in pre 1.3.3 patch

Re: Kconfig bug in pre 1.3.3 patch