SELinux and the Desktop

[Colin Walters]

On Tue, 2004-10-12 at 20:14 -0500, Jerry Haltom wrote:

> So here's where SELinux comes in. SELinux allows the system to place 
> restrictions on executable programs beyond that offered by the user 
> identity itself. It allows you to audit, and deny syscall execution, 

Not precisely.  System calls aren't directly restricted; there are
simply hooks placed at security-relevant code paths in the kernel.  Not
all system calls are restricted, and not all permissions are obviously
mappable to one particular system call.  Also, you can have userspace
policy enforcers like D-BUS that aren't mappable to kernel syscalls at
all.

> So why can't one program place SELinux policy's on other software? 

SELinux provides mandatory access control, so the policy is generally
controlled centrally by a security administrator.  However, it is
possible right now for the administrator to allow some discretionary
user control over labeling.  That's what the Apache policy does.

> Why 
> can't a desktop interface listen for faults in SELinux, change those 
> policy's based on the user's actions or requests, and let the program 
> continue, at runtime?

The problem with this that I see is that it's very difficult to present
this to the user in a meaningful way.  Most users will simply have no
idea what's going on:

> 1) don't allow the program to do anything except read/write to /tmp
> 2) do allow the program to open outgoing ports after notifying the user

A lot of end users aren't going to know what /tmp, ports, or evolution-
data-server are.  Or even if they do, it's difficult to say whether the
program is actually doing something bad or not.

One major problem is that right now, without Security-Enhanced X, as
soon as you grant an untrusted application access to your X connection
you are screwed.  So it's basically impossible to usefully define a
"user_untrusted_t" domain that downloaded programs could run in; they
wouldn't be able to do anything besides use CPU.  I guess you could pop
them up in a terminal with a suitable program doing filtering with a
pty, but I don't see many people emailing exciting tty-based
applications to each other...