[tomoyo-users-en 452] logging and execution tracing

I know that MAC isn't really the right place to do this, but I'm
investigating all possibilities.

Is it possible to have tomoyo log more information about binaries that
are exec'd? I know that it tracks the execution chain for all process
starting with init, but is it possible to attach more information to
the log tomoyo stores about each execve like the time and uid that
executed it? Actually, does tomoyo already log the uid? The other
question is would it be possible/easy to extract this information with
user-land tools?

Cheers,
peter

[tomoyo-users-en 450] Disallow read/write on any file in Ubuntu Linux 10.04 kernel

_______________________________________________
tomoyo-users-en mailing list
tomoyo-users-en@...
http://lists.sourceforge.jp/mailman/listinfo/tomoyo-users-en

[tomoyo-users-en 447] Tomoyo 2.5 and sockets beginning with null characters

In Tomoyo 2.5 (kernel 3.2.1) I am unable to add ACLs for sockets with
null characters as per:
http://tomoyo.sourceforge.jp/2.5/policy-specification/domain-policy-syntax.html.en

Nothing happens when I add them through tomoyo-editpolicy. If I manually
add them to the domain policy, they are removed on load. Using \?
instead of \000 works. Policy violations involving \000 are correctly
logged.

The ACL in question:
network unix stream connect \000/tmp/.X11-unix/X\$

--

-- 
Steven Allen
MIT 2014, EECS
MacGregor #E221
(310) 433-5865

_______________________________________________
tomoyo-users-en mailing list
tomoyo-users-en@...
http://lists.sourceforge.jp/mailman/listinfo/tomoyo-users-en

[tomoyo-users-en 444] Tomoyo 1.8 connections on UDP 0

Hi guys,

I'm using Tomoyo 1.8.3 on linux 3.1, migrating from in-kernel Tomoyo
2.4, I have started using socket filtering which is pretty cool!

I have found that Tomoyo generates logs like this:
"network inet dgram send X.X.X.X 0"
connection attempts on UDP port 0, for every outbound inet TCP
connection the program makes.

Is sending to UDP 0 still how the OS finds a free port?

Even if I do not authorize these packets through in the policy,
everything seems to work fine.

Is this a known behaviour?
Would you recommend allowing this activity?
Could it not be misused to communicate externally on port 0?

Cheers & Best wishes!
Milton

[tomoyo-users-en 439] Re: tomoyo-users-en Digest, Vol 42, Issue 2

_______________________________________________
tomoyo-users-en mailing list
tomoyo-users-en@...
http://lists.sourceforge.jp/mailman/listinfo/tomoyo-users-en

http://tomoyo.sourceforge.jp/cgi-bin/lxr/source?

_______________________________________________
tomoyo-users-en mailing list
tomoyo-users-en@...
http://lists.sourceforge.jp/mailman/listinfo/tomoyo-users-en

[tomoyo-users-en 436] Re: tomoyo helper scripts

_______________________________________________
tomoyo-users-en mailing list
tomoyo-users-en@...
http://lists.sourceforge.jp/mailman/listinfo/tomoyo-users-en

[tomoyo-users-en 435] Useful scripts for version 2.3

I'm evaluating tomyoo 2.3 in debian wheezy. Here are two scripts that I've found useful. Because I'm not
sure whether or how this list supports attachments, I'm also pasting the scripts in-line. I have no idea
whether these will work for version 2.5, but they are basically awk scripts, and should be easy to modify,
as you wish. Hope its helpful.

1 _tomoyo-policy-sort
================

Helps identify what domains are in need of 
patternizing, and possibly be candidates for domain-transition.

Usage hints:
1] No admin privileges are required to run the script. It DOES require 
read-access to a domain_policy file, and defaults to 
/etc/tomoyo/domain_policy.conf.
2] run the script with no 
parameters to see how may rules there are for each domain in 
/etc/tomoyo/domain_policy.conf, sorted by increasing number of rules,. 
So, the most likely candidates for patternizing will display at the end 
of the output.
3] run the 
script with the -d parameter to get the same output as above, but sorted by the last element of the domains and
nicely columnated for display in a browser/editor WITHOUT wordwrap. Use this to easily see duplicate 
executables, which would be the first step to considering a domain for 
domain-transition.

2 _tomoyo_patternize_home
===================== 
Since there are many configuration and other files in
 users' $HOME directory, and patternizing them manually is cumbersome, this script automates the
process. It should be 
followed with a 'tomoyo-checkpolicy' invocation, of course.

==============================
BEGIN SCRIPT #1 -  _tomoyo-policy-sort
==============================
#!/bin/bash
SCRIPT_VERSION="1.0, written for tomoyo v2.3"
#
# Tomoyo Policy Count / Sort
#
# Usage: _tomoyo-policy-sort [ [-d|-n] [-r] [file] ] | -v | -h
# OPTIONS
# -d  sort by domain
# -n  sort by number of policies (default)
# -r  raw (no columnation, headers, separators)
# -v  version
# -h  usage information
# The default input file is /etc/tomoyo/domain_policy.conf

# This script reads a tomoyo domain.conf file,
# counts the number of rules of each policy, and
# sorts the output either numerically, by the
# number of rules per domain, or alphabetically,
# by the final element in the domain path (the
# executable).
#
# When sorting alphabetically by executable, the
# output is displayed in a nicely columnated
# format for viewing in a non-wordwrap browser
# or editor.
#
# Written by: Boruch Baum <boruch-baum@...>
# No warranties ...
# Use at your own risk  ...
# License: OpenGPL2 ...
# Include author info when redistributing ...

function usage_message {
      echo -e "\n_tomoyo-policy-sort: count rules and sort a domain.conf file\nUSAGE:
_tomoyo-policy-sort [ [-d|-n] [-r] [file] ] | -v | -h\nOPTIONS:\n -d  sort by domain\n -n  sort by
number of policies (default)\n -r  raw (no columnation, headers, separators)\n -v  version\n -h 
usage information\n The default input file is /etc/tomoyo/domain_policy.conf\nVERSION: $SCRIPT_VERSION\n"
   }

function error_message {
      echo "error: a parameter is invalid or file unreadable: "$myparm
      usage_message
   }

SORT_OPTION="number"
DECORATION="TRUE"
POLICY_FILENAME="/etc/tomoyo/domain_policy.conf"

for myparm in "$@" ;do case $myparm in
-h|--help   ) usage_message; exit;;
-v|--version) echo "version "$SCRIPT_VERSION; exit;;
-d          ) SORT_OPTION="domain";; 
-n          ) ;;
-r          ) DECORATION="FALSE";;
*           ) if [[ -r "$myparm" ]]; then
                 POLICY_FILENAME=$myparm
              else
                 error_message
                 exit
              fi
              ;;
esac; done

if [[ "$SORT_OPTION" == "domain" ]] ; then
awk ' BEGIN {DOMAIN = ""; DOMAIN_PATH = ""; FIRST=1}
      /^</  {LAST = FNR ; TOTAL = LAST - FIRST
             if ( TOTAL > 3 ) print DOMAIN, TOTAL-3, DOMAIN_PATH
             DOMAIN=$NF; DOMAIN_PATH=$0; FIRST=FNR+1
            }
      END   {LAST = FNR
             if ( TOTAL > 3 ) print DOMAIN, TOTAL-3, DOMAIN_PATH
            }
    ' $POLICY_FILENAME | sort | \
awk -v decoration="$DECORATION" \
    ' BEGIN {if ( decoration == "TRUE" ) {
             UNDERLINE="------"
             printf "%6s  %s \\ %s\n", "Size", "Executable", "Domain Path" }}
      decoration == "TRUE" && DOMAIN != $1 {
             printf "%6s  %s \\ %s\n", UNDERLINE, UNDERLINE, UNDERLINE}
      {DOMAIN=$1; printf "%6i  %s \\ %s\n", $2, $1, substr($0,index($0,"<"))} ' | \
column -s"\\" -t

else # Sort numerically by number of rules per domain
awk ' BEGIN {DOMAIN = ""; FIRST=1}
      /^</  {LAST = FNR ; TOTAL = LAST - FIRST
             if ( TOTAL > 3 ) printf("%6i  %s\n",TOTAL-3,DOMAIN)
             DOMAIN=$0; FIRST=FNR+1
            }
      END   {LAST = FNR
             if ( TOTAL > 3 ) printf("%6i  %s\n",TOTAL-3,DOMAIN)
            }
    ' $POLICY_FILENAME | sort -n
fi

============================
END SCRIPT #1 -  _tomoyo-policy-sort
============================

================================
BEGIN SCRIPT # -_tomoyo-patternize-home
================================
#!/bin/bash
SCRIPT_VERSION="1.0, written for tomoyo v2.3"
#
# Tomoyo Policy Patternize $HOME
#
# USAGE: _tomoyo-patternize-home [ [-i|-a] [-c|-A] [file] | -v | -h ]
# OPTIONS
# -i  interactive (prompts for each action) (default)
# -a  automatic (no prompting)
# -c  configuration files only (default)
# -A  all files
# -v  version
# -h  usage information
# The default input file is /etc/tomoyo/domain_policy.conf
# The default output file is ./domain_policy.conf.new

# The idea is to offer a variant on patternizing to account for the special case of user home directories, in
which what is desired is to globally or selectively patternize just the user directory name for many (or
all) user directory configuration files. I know that last sentence may sound unclear; what I mean is to
have a simple way to patternize "/home/\*/foo/bar", without having to tell the script what "foo/bar" is.

# Written by: Boruch Baum <boruch-baum@...rge.net>
# No warranties ...
# Use at your own risk  ...
# License: OpenGPL2 ...
# Include author info when redistributing ...

function usage_message {
      echo -e "\nTomoyo Policy Patternize \$HOME: patternize just the \$HOME directory\nUSAGE:
_tomoyo-patternize-home [ [-i|-a] [-c|-A] [file] | -v | -h ]\nOPTIONS:\n -i  interactive (prompts for
each action) (default)\n -a  automatic (no prompting)\n -c  configuration files only (default)\n
-A  all files\n -v  version\n -h  usage information\n The default input file is
/etc/tomoyo/domain_policy.conf\n The default output file is ./domain_policy.conf.new\nVERSION: $SCRIPT_VERSION\n"
   }

function error_message {
      echo "error: a parameter is invalid or file unreadable: "$myparm
      usage_message
   }

# POLICY_FILENAME="/etc/tomoyo/domain_policy.conf"
POLICY_FILENAME="test-data-file"
OUTPUT_FILENAME="domain_policy.conf.new"
MODE="interactive"
FILESPEC="config-only"

for myparm in "$@" ;do case $myparm in
-h|--help   ) usage_message; exit;;
-v|--version) echo "version "$SCRIPT_VERSION; exit;;
-i          ) MODE="interactive";; 
-a          ) MODE="automatic";;
-c          ) FILESPEC="config-only";;
-A          ) FILESPEC="all-files";;
*           ) if [[ -r "$myparm" ]]; then
                 POLICY_FILENAME=$myparm
              else
                 error_message
                 exit
              fi
              ;;
esac; done

if [[ $MODE == "interactive" ]] ; then

exec 3<>$POLICY_FILENAME
cat /dev/null > $OUTPUT_FILENAME
FINISHED=0
while [[ $FINISHED == 0 ]] ; do
   read <&3
   FINISHED=$?
   if [[ "$REPLY" =~ (<.*) ]] ; then
      DOMAIN=$REPLY
      echo $DOMAIN >> $OUTPUT_FILENAME
   else
      RULE=$REPLY
      REPLY="-"
      if   [[ "$FILESPEC" == "all-files" ]] &&  $(grep -q " /home/" <<<$RULE) ; then
         while [[ $REPLY =~ ([^yn]) ]] ; do
            echo -e "\n\nDOMAIN: $DOMAIN\nRULE: $RULE"
            read -rs -n 1 -p "Do you want to patternize? y/n"
            done
         if [[ $REPLY == "y" ]] ; then
            RULE=$( sed 's/ \/home\/[^\/]*\// \/home\/\\\*\//g' <<<$RULE )
         fi
      elif [[ "$FILESPEC" == "config-only" ]] &&  $(grep -q " /home/[^/]*/\." <<<$RULE) ; then
         while [[ $REPLY =~ ([^yn]) ]] ; do
            echo -e "\n\nDOMAIN: $DOMAIN\nRULE: $RULE"
            read -rs -n 1 -p "Do you want to patternize? y/n"
            done
         if [[ $REPLY == "y" ]] ; then
            RULE=$( sed 's/ \/home\/[^\/]*\/\./ \/home\/\\\*\/\./g' <<<$RULE )
         fi
      fi
      echo $RULE >> $OUTPUT_FILENAME
   fi
   done
exec 3>&-
exit

else # [[ $MODE == "automatic" ]]

awk -v file_spec="$FILESPEC" '
      /^</ { DOMAIN=$0; print; next}
     !/^</ {

if ( $2 !~ /^\/home\// && $3 !~ /^\/home\// ) print
else {
   if ( file_spec == "config-only" )  \
        $2 =~ /^\/home\/[^/]*\/\./ {
            $2 = gensub("^\/home\/[^/]*\/","\/home\/\\\\*\/",1,$2) }
        $3 =~ /^\/home\/[^/]*\/\./ {
            $3 = gensub("^\/home\/[^/]*\/","\/home\/\\\\*\/",1,$3) }
   else {
        $2 = gensub("^\/home\/[^/]*\/","\/home\/\\\\*\/",1,$2)
        $3 = gensub("^\/home\/[^/]*\/","\/home\/\\\\*\/",1,$3)
        }
   print
   }
           }
    ' $POLICY_FILENAME 2>/dev/null

fi
===============================
END SCRIPT # -_tomoyo-patternize-home
===============================

_______________________________________________
tomoyo-users-en mailing list
tomoyo-users-en@...
http://lists.sourceforge.jp/mailman/listinfo/tomoyo-users-en

[tomoyo-users-en 433] Can't set policy on Arch Linux

Hi,

I've just started with Tomoyo 2.4 on a fresh install on Arch Linux,
but I can't set a policy.
I've followed the instructions on the wiki: setting the grub command
line, executing /usr/lib/tomoyo/init_policy, and running
tomoyo-editpolicy; however, if I try to set a policy on any process
("s" and entering "1" where it asks for the new profile number), it
does not change, the profile number remains at 0.

I've tried saving the policy and loading it at reboot, yet it still
remains unchanged. I've also tried removing the program, deleting all
the files within /etc/tomoyo/, and retrying but to no avail.

Can any one shed some light on this please?

Thanks, JD.

[tomoyo-users-en 431] TOMOYO Linux doumentation as .epub from Jan Kechel

Hi,

Jan Kechel created an epub version of TOMOYO ver 2.5 documentation and
kindly publish it to the world.  But a lazy administrator of the list
(me) didn't notice
the message until this morning.

I apologized to Jan and viewed his work with FireFox and EPUBreader extension.
http://www.epubread.com/en/ (Many other choices available)
It works fine and quite useful. Please try yourself.

Wishing you all the very merry Christmas and promising you to work
a bit harder. 

PS
Jan is not on the list, so please cc him when you reply.

Best regards,
Toshiharu

> From: Jan Kechel <jan@...>
> To: tomoyo-users-en@...
> Date: Mon, 10 Oct 2011 21:56:56 +0100
> Subject: TOMOYO Linux-Documentation as .epub Ebook-Format ?
> -----BEGIN PGP SIGNED MESSAGE-----
>
>
> Hi everybody,
>
> i just love .epub format .. so I can read books / documentation on my
> phone wherever/whenever I'm bored otherwise ;)
>
> I made a copy of your 2.5 Documentation-Website, concateneted each
> html-file into one and deleted all the duplicate headers/footers between
> the id="content" divs. After that simply converted it via calibre and
> got the following:
>
> http://prevalent-digest.de/downloads/TOMOYO-Linux-2.5.x_The-Official-Guide.epub
>
> It's just great to have it in this format and all I wanted to do is to
> share this little epub back to you ;)
>
> best regards,
>
> jan
>
>
> PS: maybe you can automatically create epubs for future
> documentation-versions?
> PPS: i'm not on the mailinglist, so please cc me in replies

[tomoyo-users-en 427] TOMOYO 1.8/AKARI on Linux 3.2-rc5

Please don't use ccs-patch-1.8.3-20111118.tar.gz / akari-1.0.23-20111118.tar.gz
on Linux 3.2-rc5 and later, for the behavior of __d_path() (the function used
for calculating pathnames) has changed. If you use these tarballs, the kernel
will panic due to NULL pointer dereference.

If you want to try 3.2-rc5 soon, the updated versions are available at
http://sourceforge.jp/projects/tomoyo/svn/view/trunk/1.8.x/ccs-patch/?root=tomoyo
and http://sourceforge.jp/projects/akari/svn/view/trunk/akari/?root=akari .

Also, this __d_path() update might be backported to 2.6.36 to 3.1 kernels.
If backported, you will need to recompile TOMOYO 1.8/AKARI using the updated
versions.