Various MAC framework changes (read or be surprised) (fwd)

[Robert Watson]

FYI for those attempting to track the MAC tree.

Robert Watson
Research Scientist
NAI Labs at Network Associates

---------- Forwarded message ----------
Date: Thu, 2 May 2002 01:49:55 -0400 (EDT)
From: Robert Watson <rwatson at tislabs.com>
To: cboss at tislabs.com
Subject: Various MAC framework changes (read or be surprised)


Ran through a bunch of changes this evening; I suggest reading the
perforce commit messages before getting started.  The most relevant change
is that I pushed the TrustedBSD Biba, MLS, and TE policies into loadable
kernel modules, and no longer link them directly with the kernel.  To use
these policies, add the following lines to /boot/loader.conf:

mac_biba_load="YES"
mac_mls_load="YES"
mac_te_load="YES"

This also works for various other policies; see the loader.conf changes I
committed for sample entries.  I added a facility to permit a module to
indicate that it is not interested in being loaded except early in the
kernel boot process (i.e., in the loader), which was the main reason that
modules were previously linked to the kernel directly (to prevent their
being loaded at a bad moment later on).  This suggests similar changes
could be made to the sebsd code.  I also tweaked the behavior of MAC
kernel options so that all MAC-related kernel code didn't rebuild if you
changed the set of active policies for the kernel.  This works right for
all the non-SEBSD policies, and I believe it works right for SEBSD, but
someone should check :-).  The method for rejecting late load is a bit
ugly, but we'll get a chance to clean all this up later.

In theory, you can still link these modules into the kernel directly in
the kernel linking phase, but right now there's no need to.  This set of
changes pushes us quite a bit more firmly in the "modular policy
framework" direction; hopefully we're far enough forward that this doesn't
trip us up.  If it does, we can always back the changes out.

Let me know if there are any problems (or better yet, fix 'em :-).

Robert Watson
Research Scientist
NAI Labs at Network Associates


To Unsubscribe: send mail to majordomo at trustedbsd.org
with "unsubscribe trustedbsd-discuss" in the body of the message