Re:The Insecurity of OpenBSD (2010)
by nickpsecurity on Tuesday November 29, 2016 @08:39PM
(#13067746)
You can do that in a SELinux-like system. There's been tools and policy languages for it. Even better, if the language is high-level & declarative, then it can be used to generate security policies on many different OS's and mechanisms instead of just SELinux or pledge.
[ Parent
| on HN ]
Re:The Insecurity of OpenBSD (2010)
by protomyth on Wednesday November 30, 2016 @08:47AM
(#13070583)
Which projects are doing this with SELinux?
Re:The Insecurity of OpenBSD (2010)
by nickpsecurity on Wednesday November 30, 2016 @10:48AM
(#13071638)
I haven't followed SELinux in a while. I recall Tresys made tools with dialog boxes to make it about as easy as Windows firewalls. A quick Google leads me to Lobster being an example of what I was thinking of:
https://selinuxproject.org/files/2008_selinux_developer_summ...
Re:The Insecurity of OpenBSD (2010)
by protomyth on Wednesday November 30, 2016 @12:07PM
(#13072443)
Given how fast pledge was able to be put into production, I think it was the right move. I get SELinux can and has (2008) had tools for this, but it really doesn't seem to have caught on.
Re:The Insecurity of OpenBSD (2010)
by nickpsecurity on Wednesday November 30, 2016 @06:43PM
(#13075744)
SELinux was a demonstrator of Type Enforcement by Mitre. It got put into production because why not. There's simpler schemes out there for MAC even on Linux. I'd have recommended OpenBSD clean-slate something like them.
I do like pledge, though. I promoted API reduction a long time. Even deleting the code in kernel for appliances a la Poly2 project. Only so much can be gained with it, though.