Status

Current Version: 20051019

	See download for download

	information. Details of this release are part of the changelog.

	This release focused on updating the policy to bring it in line with

	the NSA example policy in sourceforge CVS.  Currently both strict and

	targeted policies can be built.  MLS policies can be built, but the

	policy has not been tested on running systems.  MCS support has also

	been added, but it is still experimental.  Loadable modules can

	now be built with a compiler that has the require-in-conditionals,

	delcare-then-require, and stack-overflow patches applied.

Status and Tasks

	Reference Policy Status

	Task/ComponentStatusDescription

		Policy Structure

		Complete

		The policy is converted over to new Reference Policy structure

		TE Policy

		Conversion Ongoing

		Conversion of old policy to Reference Policy modules is ongoing

		Loadable Policy Modules

		Major improvements

		Infrastructure is in place to support both source policy and

			loadable policy modules.  Makefile support completed.

			Loadable modules can be built with a compler

			that has the require-in-conditionals,

			delcare-then-require, and stack-overflow patches

			applied.

		Documentation Infrastructure

		Interfaces, templates, Booleans, and tunables complete

		Tools to create webpages from the module interface and 

			template documentation is complete. Global Booleans and

			tunables are supported. Booleans and tunables local to

			policies are planned.

		Policy Documentation

		Ongoing

		Most modules are documented.

		Unused Modules

		Complete

		Modules can be disabled by using modules.conf.

		MLS Infrastructure

		Minor improvements

		MLS infrastructure added to support easy conversion between

			MLS and non-MLS policy.  Policy is compilable, but

			untested. Need further investigations to ensure

			the levels in the policy are correct.

		MCS Support

		Minor improvements

		MLS infrastructure has been extended to support MCS

			categories in users and all contexts.  MCS constraints

			have been added.  Policy is compilable, but untested.

		Network Infrastructure

		Minor improvements

		All network ports, nodes, and interfaces moved to

			corenetwork module, interfaces generated automatically.

			Plan to add more infrastructure for configuration of

			ports, nodes, and interfaces.

		User domains and roles

		Minor improvements

		Some infrastructure added to support per-user domain policy,

			e.g., to create types and policy for ssh,

			for each user.  Plan to add infrastructure to easily

			configure userdomains and roles.

		Labeling

		Minor improvements

		All labeling moved to modules, consistent with Reference

			Policy structure. Levels can be added to the labels

			without changes to the policy.

		Tunables

		Minor improvements

		Tunables are documented and included in the webpage policy

			documentation.

		Users

		Unchanged

		Assignment of users to roles.

		Constraints

		Unchanged

		Plan to split up into relevant modules when loadable modules

			support this.  There are ordering problems with source

			policies.

		Flask

		Unchanged

		Headers for the policy, describing object classes, and

			their permissions.  No planned changes.

		Genhomedircon

		Unchanged

		Tool to properly label users' home directories.

			No planned changes

Roadmap

      Reference Policy Roadmap

      Version

      Date

      Description

      0.1

      June 2005

      Initial public release, basic policy restructuring, some infrastructure, few modules, and minimal documentation.

      0.2

      July 2005

      Restructuring complete, additional modules, and improved infrastructure.

      0.3

      August 2005

      Additional modules, documentation, and base module configuration support.

      0.4

      September 2005

      Additional modules, documentation, and tested loadable module support.

      0.5

      October 2005

      Additional modules, documentation, targeted policy, and tested MLS support

      0.6

      December 2005

      Additional modules, documentation, and module variations

Policy Conversion

This phase of reference policy development involves the conversion of policies

from the example strict policy.  Please use the current NSA example policy

in 

NSA SourceForge CVS.

We ask that modules that are in the targeted policy be given the first priority,

and then modules in the strict policy but not in targeted policy given second priority.

For those who wish to contribute, here is a listing of modules which need to be

converted:

      Policy Module Status

      Module Name

      Previous Policy Files

      Assigned To

      amavis

      amavis.te amavis.fc

      asterisk

      asterisk.te asterisk.fc

      audio-entropy

      audio-entropyd.te audio-entropyd.fc

      authbind

      authbind.te authbind.fc

      automount +

      automount.te automount.fc

      backup

      backup.te backup.fc

      bonobo +

      bonobo.te bonobo.fc bonobo_macros.te

      browser +

      mozilla.te mozilla.fc mozilla_macros.te

      calamaris

      calabaris.te calamaris.fc

      cdrecord +

      cdrecord.te cdrecord.fc cdrecord_macros.te

      certwatch +

      certwatch.te certwatch.fc

      cipe

      ciped.te ciped.fc

      clamav

      clamav.te clamav.fc clamav_macros.te

      courier

      courier.te courier.fc

      daemontools

      daemontools.te daemontools.fc daemontools_macros.te

      Tresys

      dante

      dante.te dante.fc

      dcc

      dcc.te dcc.fc

      ddclient

      ddclient.te ddclient.fc

      ddcprobe +

      ddcprobe.te ddcprobe.fc

      djbdns

      djbdns.te djbdns.fc

      dnsmasq

      dnsmasq.te dnsmasq.fc

      dpkg

      dpkg.te dpkg.fc

      ethereal +

      ethereal.te ethereal.fc ethereal_macros.te

      evolution +

      evolution.te evolution.fc evolution_macros.te

      fetchmail +

      fetchmail.te fetchmail.fc

      fontconfig +

      fontconfig.te fontconfig.fc

      gatekeeper

      gatekeeper.te gatekeeper.fc

      gconf +

      gconf.te gconf.fc gconf_macros.te

      games +

      games.te games.fc games_domain.te

      gift

      gift.te gift.fc gift_macros.te

      gnome +

      gnome.te gnome.fc gnome_macros.te gnome_vfs.te gnome_vfs.fc gnome_vfs_macros.te gnome-pty-helper.te gnome-pty-helper.fc gph_macros.te

      iceauth +

      iceauth.te iceauth.fc iceauth_macros ice_macros.te(?)

      imazesrv

      imazesrv.te imazesrv.fc

      irc +

      irc.te irc.fc irc_macros.te

      ircd

      ircd.te ircd.fc

      irqbalance +

      irqbalance.te irqbalance.fc

      jabber

      jabberd.te jabberd.fc

      java +

      java.te java.fc java_macros.te

      lcd

      lcd.te lcd.fc

      lockdev +

      lockdev.te lockdev.fc lockdev_macros.te

      lrr

      lrrd.te lrrd.fc

      monop

      monopd.te monopd.fc

      mplayer +

      mplayer.te mplayer.fc mplayer_macros.te

      mrtg +

      mrtg.te mrtg.fc

      nagios

      nagios.te nagios.fc nrpe.te nrpe.fc

      nessus

      nessusd.te nessusd.fc

      nsd

      nsd.te nsd.fc

      nx

      nx_server.te nx_server.fc

      oav-update

      oav-update.te oav-update.fc

      openca

      openca-ca.te openca-ca.fc

      openct +

      openct.te openct.fc

      orbit +

      orbit.te orbit.fc orbit_macros.te

      perdition

      perdition.te perdition.fc

      portslave

      portslave.te portslave.fc

      prelink +

      prelink.te prelink.fc

      publicfile

      publicfile.te publicfile.fc

      pxe

      pxe.te pxe.fc

      pyzor

      pyzor.te pyzor.fc pyzor_macros.te

      razor

      razor.te razor.fc razor_macros.te

      rdisc

      rdisc.te rdisc.fc

      resmgr

      resmgrd.te resmgrd.fc

      rhgb +

      rhgb.te rhgb.fc rhgb_macros.te

      rssh

      rssh.te rssh.fc rssh_macros.te

      scannerdaemon

      scannerdaemon.te scannerdaemon.fc

      screen +

      screen.te screen.fc screen_macros.te

      slocate +

      slocate.te slocate.fc slocate_macros.te

      slrnpull +

      slrnpull.te slrnpull.fc

      snort

      snort.te snort.fc

      sound +

      alsa.te alsa.fc sound.te sound.fc sound-server.te sound-server.fc

      spamassassin +

      spamassassin.te spamc.te spamd.te spamassassin.fc spamc.fc spamd.fc spamassassin_macros.te

      Tresys

      speedtouch

      speedmgmt.te speedmgmt.fc

      sxid

      sxid.te sxid.fc

      sysstat +

      sysstat.te sysstat.fc

      thunderbird +

      thunderbird.te thunderbird.fc thunderbird_macros.te mail_client_macros.te

      timidity +

      timidity.te timidity.fc

      tinydns

      tinydns.te tinydns.fc

      transproxy

      transproxy.te transproxy.fc

      tripwire

      tripwire.te tripwire.fc

      tvtime +

      tvtime.te tvtime.fc tvtime_macros.te

      ucspi-tcp

      ucspi-tcp.te ucspi-tcp.fc

      uml +

      uml.te uml.fc uml_macros.te uml_net.te uml_net.fc

      uptimed

      uptimed.te uptimed.fc

      userhelper +

      userhelper.te userhelper.fc userhelper_macros.te

      usernetctl +

      usernetctl.te usernetctl.fc

      uwimap

      uwimapd.te uwimapd.fc

      vmware +

      vmware.te vmware.fc vmware_macros.te

      watchdog

      watchdog.te watchdog.fc

      xdm *+

      xdm.te xdm.fc xdm_macros.te

      Tresys

      xfs +

      xfs.te xfs.fc

      xprint

      xprint.te xprint.fc

      xserver +

      xserver.te xserver.fc xserver_macros.te xauth.te xauth.fc xauth_macros.te

      yam

      yam.te yam.fc

      (*) Modules in the Fedora targeted policy

      (+) Modules in the Fedora strict policy

Testing Status

The policy as successfully been booted and can run with a Fedora Core 4

installation, using a targeted Reference Policy.  See the

switching guide to switch a Fedora system 

over to targeted Reference policy configuration.

A very minimal RedHat Enterprise Linux 4 system with the following RPMs has

can be successfully booted in enforcing mode, and users can log in locally,

with a strict Reference Policy:

libgcc-3.4.3-9.EL4

rootfiles-8-1

filesystem-2.3.0-1

termcap-5.4-3

glibc-common-2.3.4-2

bzip2-libs-1.0.2-13

device-mapper-1.00.19-2

elfutils-libelf-0.97-5

expat-1.95.7-4

glib2-2.4.7-1

libattr-2.4.16-3

libcap-1.10-20

libsepol-1.1.1-2

db4-4.2.52-7.1

libtermcap-2.0.8-39

mktemp-1.5-20

iproute-2.6.9-3

less-382-4

pcre-4.5-3

usbutils-0.11-6.1

vim-minimal-6.3.046-0.40E.4

info-4.7-5

diffutils-2.8.1-12

gawk-3.1.3-10.1

coreutils-5.2.1-31

gzip-1.3.3-13

module-init-tools-3.1-0.pre5.3

procps-3.2.3-7EL

sed-4.1.2-4

MAKEDEV-3.15-2

sysklogd-1.4.1-26_EL

cracklib-2.7-29

pam-0.77-65.1

SysVinit-2.85-34

lvm2-2.00.31-1.0.RHEL4

kernel-2.6.9-5.0.5.EL

libuser-0.52.5-1

crontabs-1.10-7

tmpwatch-2.9.1-1

m4-1.4.1-16

mgetty-1.1.31-2

time-1.7-25

dhclient-3.0.1-12_EL

samhain-2.0.6-1

hwdata-0.146.1.EL-1

redhat-logos-1.1.25-1

setup-2.5.37-1.1

basesystem-8.0-4

tzdata-2004e-2

glibc-2.3.4-2

beecrypt-3.1.0-6

chkconfig-1.3.11.2-1

e2fsprogs-1.35-11.6.EL4

ethtool-1.8-4

gdbm-1.8.0-24

iputils-20020927-16

libacl-2.2.23-5

libselinux-1.19.1-7

libstdc++-3.4.3-9.EL4

mingetty-1.07-3

bash-3.0-19.2

ncurses-5.4-13

net-tools-1.60-37

popt-1.9.1-7_nonptl

redhat-release-4AS-2

hotplug-2004_04_01-7.2

zlib-1.2.1.2-1

cpio-2.5-7.EL4.1

findutils-4.1.20-7

grep-2.5.1-31

grub-0.95-3.1

readline-4.3-13

rpm-libs-4.3.3-7_nonptl

shadow-utils-4.0.3-41.1

rpm-4.3.3-7_nonptl

tar-1.14-4

cracklib-dicts-2.7-29

policycoreutils-1.18.1-4

util-linux-2.12a-16.EL4.6

udev-039-10.8.EL4

initscripts-7.93.11.EL-1

mkinitrd-4.1.18-2

passwd-0.68-10

bzip2-1.0.2-13

logrotate-3.7.1-2

libxml2-2.6.16-6

make-3.80-5

iptables-1.2.11-3.1.RHEL4

vixie-cron-4.1-20_EL

comps-4AS-0.20050107

-->