sec: Add Mandatory Access Control slides

Signed-off-by: Holger Dengler <dengler@linutronix.de>

3 files changed, 227 insertions, 0 deletions

diff --git a/security/advanced/Makefile b/security/advanced/Makefile
index 2bb84de..2643c9e 100644
--- a/security/advanced/Makefile
+++ b/security/advanced/Makefile
@@ -4,3 +4,4 @@ obj-$(CONFIG_SECURITY_ADV) += pres_exploit.pdf
 obj-$(CONFIG_SECURITY_ADV) += pres_process_thread.pdf
 obj-$(CONFIG_SECURITY_ADV) += pres_multiuser_dac.pdf
 obj-$(CONFIG_SECURITY_ADV) += pres_namespace_container.pdf
+obj-$(CONFIG_SECURITY_ADV) += pres_mac.pdf
diff --git a/security/advanced/frm_mac.tex b/security/advanced/frm_mac.tex
new file mode 100644
index 0000000..31a3915
--- /dev/null
+++ b/security/advanced/frm_mac.tex
@@ -0,0 +1,206 @@
+% ----------------------------
+\subsubsection{Linux Security Modules}
+
+% ----------------------------
+\begin{frame}[fragile]
+\frametitle{Linux Security Modules}
+\begin{itemize}
+\item Problem: Malware, Exploits
+\item Solution: Mandatory Access Control
+ \begin{itemize}
+ \item Categories: Subjects and Objects
+ \item systemwide, static rule set
+ \item Context sensitive Resource Access
+ \end{itemize}
+\item Implementation
+ \begin{itemize}
+ \item SE-Linux
+ \item AppArmor
+ \item SMACK
+ \item Tomoyo
+ \end{itemize}
+\end{itemize}
+\end{frame}
+
+% ----------------------------
+\subsubsection{Terms}
+
+% ----------------------------
+\begin{frame}[fragile]
+\frametitle{Domain}
+\begin{figure}[h]
+\centering
+\includegraphics[width=8cm]{images/mac_terms.png}
+\end{figure}
+\end{frame}
+
+% ----------------------------
+\begin{frame}[fragile]
+\frametitle{Domain}
+\begin{itemize}
+\item Domain transition for each starting Process
+\item Default: Inherit previous Domain
+\item Note: Domains are unique
+\end{itemize}
+\begin{beamerboxesrounded}[shadow=true]{Example:}
+\begin{small}
+\begin{verbatim}
+<kernel> /sbin/init /etc/rc.d/rcS /usr/local/bin/myappl
+<kernel> /sbin/init /etc/rc.d/rcS /usr/bin/opensshd \
+                    /bin/bin/bash /usr/local/bin/myappl
+\end{verbatim}
+\end{small}
+\end{beamerboxesrounded}
+\end{frame}
+
+% ----------------------------
+\begin{frame}[fragile]
+\frametitle{Domain Transition Management}
+\begin{itemize}
+\item Control Domain Transition Behavior
+\item Syntax: \\
+\begin{verbatim}
+<directive> <domain> from <domain>
+\end{verbatim}
+\item Directives:
+\begin{itemize}
+\item initialize\_domain / no\_initialize\_domain
+\item keep\_domain / no\_keep\_domain
+\end{itemize}
+\end{itemize}
+\end{frame}
+
+% ----------------------------
+\begin{frame}[fragile]
+\frametitle{Profile}
+\begin{itemize}
+\item Profiles define Domain restriction behavior
+\item Profile Relation to Domain: n..m
+\item Up to 255 Profiles
+\item Profile Modes:
+ \begin{itemize}
+ \item disabled
+ \item learning
+ \item permissive
+ \item enforcing
+ \end{itemize}
+\item Logging
+\end{itemize}
+\end{frame}
+
+% ----------------------------
+\begin{frame}[fragile]
+\frametitle{Policy}
+\begin{itemize}
+\item Policies describe Domain restrictions
+\item Policy for each Domain
+\item Directives:
+\begin{itemize}
+\item file (read, write, execute, append, chown, chgrp, create, mkfifo, \dots)
+\item misc env
+\item network inet (stream, dgram, raw)
+\item network unix (stream, dgram, seqpacket)
+\end{itemize}
+\end{itemize}
+\end{frame}
+
+% ----------------------------
+\subsubsection{Examples}
+
+% ----------------------------
+\begin{frame}[fragile]
+\frametitle{Example I}
+\begin{beamerboxesrounded}[shadow=true]{profile.conf:}
+\begin{tiny}
+\begin{verbatim}
+PROFILE_VERSION=20110903
+0-COMMENT=-----Disabled Mode-----
+0-PREFERENCE={ max_audit_log=1024 max_learning_entry=2048 }
+0-CONFIG={ mode=disabled grant_log=no reject_log=yes }
+1-COMMENT=-----Learning Mode-----
+1-PREFERENCE={ max_audit_log=1024 max_learning_entry=2048 }
+1-CONFIG={ mode=learning grant_log=no reject_log=yes }
+2-COMMENT=-----Permissive Mode-----
+2-PREFERENCE={ max_audit_log=1024 max_learning_entry=2048 }
+2-CONFIG={ mode=permissive grant_log=no reject_log=yes }
+3-COMMENT=-----Enforcing Mode-----
+3-PREFERENCE={ max_audit_log=1024 max_learning_entry=2048 }
+3-CONFIG={ mode=enforcing grant_log=no reject_log=yes }
+4-COMMENT=-----Permissive Mode File-only -----
+4-PREFERENCE={ max_audit_log=1024 max_learning_entry=2048 }
+4-CONFIG::file={ mode=permissive grant_log=no reject_log=yes }
+4-CONFIG::file::execute={ mode=disabled grant_log=no reject_log=no }
+\end{verbatim}
+\end{tiny}
+\end{beamerboxesrounded}
+\end{frame}
+
+% ----------------------------
+\begin{frame}[fragile]
+\frametitle{Example II}
+\begin{beamerboxesrounded}[shadow=true]{exception\_policy.conf:}
+\begin{tiny}
+\begin{verbatim}
+initialize_domain /sbin/ldconfig from any
+keep_domain any from /sbin/ldconfig
+
+path_group ANY_PATHNAME /
+path_group ANY_PATHNAME /\*
+path_group ANY_PATHNAME /\{\*\}/
+path_group ANY_PATHNAME /\{\*\}/\*
+path_group ANY_PATHNAME \*:/
+path_group ANY_PATHNAME \*:/\*
+path_group ANY_PATHNAME \*:/\{\*\}/
+path_group ANY_PATHNAME \*:/\{\*\}/\*
+path_group ANY_PATHNAME \*:[\$]
+path_group ANY_PATHNAME socket:[family=\$:type=\$:protocol=\$]
+path_group ANY_DIRECTORY /
+path_group ANY_DIRECTORY /\{\*\}/
+path_group ANY_DIRECTORY \*:/
+path_group ANY_DIRECTORY \*:/\{\*\}/
+
+acl_group 1 file read/getattr @ANY_DIRECTORY
+acl_group 1 file read/getattr @ANY_PATHNAME
+\end{verbatim}
+\end{tiny}
+\end{beamerboxesrounded}
+\end{frame}
+
+% ----------------------------
+\begin{frame}[fragile]
+\frametitle{Example III}
+\begin{beamerboxesrounded}[shadow=true]{profile.conf:}
+\begin{tiny}
+\begin{verbatim}
+<kernel>
+use_profile 4
+use_group 1
+
+<kernel> /sbin/ldconfig
+use_profile 4
+use_group 1
+file create /etc/ld.so.cache~ 0600
+file write /etc/ld.so.cache~
+file chmod /etc/ld.so.cache~ 0644
+file rename /etc/ld.so.cache~ /etc/ld.so.cache
+\end{verbatim}
+\end{tiny}
+\end{beamerboxesrounded}
+\end{frame}
+
+% ----------------------------
+\subsubsection{Tools}
+
+% ----------------------------
+\begin{frame}[fragile]
+\frametitle{Tools}
+\begin{itemize}
+\item tomoyo-editpolicy
+\item tomoyo-selectpolicy
+\item tomoyo-patternize
+\item tomoyo-diffpolicy
+\item tomoyo-sortpolicy
+\item tomoyo-loadpolicy
+\end{itemize}
+\end{frame}
+
diff --git a/security/advanced/pres_mac.tex b/security/advanced/pres_mac.tex
new file mode 100644
index 0000000..e50ec66
--- /dev/null
+++ b/security/advanced/pres_mac.tex
@@ -0,0 +1,20 @@
+\input{configpres}
+
+% ----------------------------
+\subsection{Linux Mandatory Access Control}
+
+\title{Linux Mandatory Access Control}
+\maketitle
+
+% ----------------------------
+\begin{frame}
+\frametitle{Overview}
+\tableofcontents
+\end{frame}
+
+% ----------------------------
+\input{security/advanced/frm_mac.tex}
+
+% ----------------------------
+\subsection*{}
+\input{tailpres}