Status

Current Version: 20050907

See download for download information. Details of this release are part of the changelog. This release focused on addition of policies from the NSA example policy. Currently both strict and targeted policies can be built. MLS policies can be built, but the policy has not been tested on running systems.

 

Status and Tasks

Reference Policy Status
Task/ComponentStatusDescription
Policy Structure Complete The policy is converted over to new Reference Policy structure
TE Policy Conversion Ongoing Conversion of old policy to Reference Policy modules is ongoing
Loadable Policy Modules Major improvements Infrastructure is in place to support both source policy and loadable policy modules. Makefile support completed.
Documentation Infrastructure Interfaces, templates, Booleans, and tunables complete Tools to create webpages from the module interface and template documentation is complete. Global Booleans and tunables are supported. Booleans and tunables local to policies are planned.
Policy Documentation Ongoing Most modules are documented.
Unused Modules Complete Modules can be disabled by using modules.conf.
MLS Infrastructure Minor improvements MLS infrastructure added to support easy conversion between MLS and non-MLS policy. Policy is compilable, but untested. Need further investigations to ensure the levels in the policy are correct.
Network Infrastructure Minor improvements All network ports, nodes, and interfaces moved to corenetwork module, interfaces generated automatically. Plan to add more infrastructure for configuration of ports, nodes, and interfaces.
User domains and roles Minor improvements Some infrastructure added to support per-user domain policy, e.g., to create types and policy for ssh, for each user. Plan to add infrastructure to easily configure userdomains and roles.
Labeling Minor improvements All labeling moved to modules, consistent with Reference Policy structure. Levels can be added to the labels without changes to the policy.
Tunables Minor improvements Tunables are documented and included in the webpage policy documentation.
Users Unchanged Assignment of users to roles.
Constraints Unchanged Plan to split up into relevant modules when loadable modules support this. There are ordering problems with source policies.
Flask Unchanged Headers for the policy, describing object classes, and their permissions. No planned changes.
Genhomedircon Unchanged Tool to properly label users' home directories. No planned changes

 

Roadmap

Reference Policy Roadmap
Version Date Description
0.1 June 2005 Initial public release, basic policy restructuring, some infrastructure, few modules, and minimal documentation.
0.2 July 2005 Restructuring complete, additional modules, and improved infrastructure.
0.3 August 2005 Additional modules, documentation, and base module configuration support.
0.4 September 2005 Additional modules, documentation, and tested loadable module support.
0.5 October 2005 Additional modules, documentation, targeted policy, and tested MLS support
0.6 December 2005 Additional modules, documentation, and module variations

 

Policy Conversion

This phase of reference policy development involves the conversion of policies from the example strict policy. We have been using the Fedora strict policy version 1.23.2-1 as a baseline for policy conversion, which is available on the download page. Then after these policies are added to reference policy, it can be updated to be in line with current versions of the NSA example policy. For those who wish to contribute, here is a listing of modules which need to be converted:

Policy Module Status
Module Name Previous Policy Files Assigned To
amanda amanda.te amanda.fc
anaconda anaconda.te anaconda.fc
apache apache.te apache.fc apache_macros.te Tresys
arpwatch arpwatch.te arpwatch.fc
automount automount.te automount.fc
bluetooth bluetooth.te bluetooth.fc
bonobo bonobo.te bonobo.fc bonobo_macros.te
browser mozilla.te mozilla.fc mozilla_macros.te
cdrecord cdrecord.te cdrecord.fc cdrecord_macros.te
certwatch certwatch.te certwatch.fc
cvs cvs.te cvs.fc
cyrus cyrus.te cyrus.fc
ddcprobe ddcprobe.te ddcprobe.fc
dmidecode dmidecode.te dmidecode.fc
dovecot dovecot.te dovecot.fc
ethereal ethereal.te ethereal.fc ethereal_macros.te
fetchmail fetchmail.te fetchmail.fc
finger fingerd.te fingerd.fc fingerd_macros.te
fontconfig fontconfig.te fontconfig.fc
ftp ftpd.te ftpd.fc
gconf gconf.te gconf.fc gconf_macros.te
games games.te games.fc games_domain.te
gnome gnome.te gnome.fc gnome_macros.te gnome_vfs.te gnome_vfs.fc gnome_vfs_macros.te gnome-pty-helper.te gnome-pty-helper.fc gph_macros.te
iceauth iceauth.te iceauth.fc iceauth_macros ice_macros.te(?)
irc irc.te irc.fc irc_macros.te
irqbalance irqbalance.te irqbalance.fc
java java.te java.fc java_macros.te
kudzu kudzu.te kudzu.fc
lockdev lockdev.te lockdev.fc lockdev_macros.te
mailman mailman.te mailman.fc
mplayer mplayer.te mplayer.fc mplayer_macros.te
mrtg mrtg.te mrtg.fc
openct openct.te openct.fc
orbit orbit.te orbit.fc orbit_macros.te
postfix postfix.te postfix.fc
ppp pppd.te pppd.fc
prelink prelink.te prelink.fc
print cups.te cups.fc lpd.te lpd.fc lpr_macros.te Tresys
procmail procmail.te procmail.fc
radius radius.te radius.fc
radvd radvd.te radvd.fc
rlogin rlogind.te rlogind.fc login_macros.te Tresys
sasl saslauthd.te saslauthd.fc
screen screen.te screen.fc screen_macros.te
slocate slocate.te slocate.fc slocate_macros.te
slrnpull slrnpull.te slrnpull.fc
sound alsa.te alsa.fc sound.te sound.fc
spamassassin spamassassin.te spamc.te spamd.te spamassassin.fc spamc.fc spamd.fc spamassassin_macros.te
stunnel stunnel.te stunnel.fc
sysstat sysstat.te sysstat.fc
telnet telnetd.te telnetd.fc
thunderbird thunderbird.te thunderbird.fc thunderbird_macros.te mail_client_macros.te
timidity timidity.te timidity.fc
tvtime tvtime.te tvtime.fc tvtime_macros.te
uml uml.te uml.fc uml_macros.te
userhelper userhelper.te userhelper.fc userhelper_macros.te
usernetctl usernetctl.te usernetctl.fc
uucp uucpd.te uucpd.fc
vmware vmware.te vmware.fc vmware_macros.te
vpn vpnc.te vpnc.fc
webalizer webalizer.te webalizer.fc
winbind winbind.te winbind.fc
xdm xdm.te xdm.fc xdm_macros.te
xfs xfs.te xfs.fc
xserver xserver.te xserver.fc xserver_macros.te xauth.te xauth.fc xauth_macros.te

Testing Status

The policy as successfully been booted and can run with a Fedora Core 4 installation, using a targeted Reference Policy. See the switching guide to switch a Fedora system over to targeted Reference policy configuration. A very minimal RedHat Enterprise Linux 4 system with the following RPMs has can be successfully booted in enforcing mode, and users can log in locally, with a strict Reference Policy: