Status

Current Version: 20050802

	See download for download

	information. Details of this release are part of the changelog. This release

	focused on infrastructure, organization, and initial design rather than

	comprehensive policy coverage or security improvements.  Currently only the

	strict policy is supported, with targeted policy support planned for the future.

	
 Warning:This is a prototype release, not meant to be used

	on real systems.  It is targeted towards developers, to show the direction of

	the policy's development and to solicit feedback.

Status and Tasks

	Reference Policy Status

	Task/ComponentStatusDescription

		Policy Structure

		Complete

		The policy is converted over to new Reference Policy structure

		TE Policy

		Conversion Ongoing

		Conversion of old policy to Reference Policy modules is ongoing

		Loadable Policy Modules

		Major improvements

		Infrastructure is in place to support both source policy and

			loadable policy modules.  Makefile support planned.

		Documentation Infrastructure

		Interfaces complete

		Tools to create webpages from the module interface documentation

			is complete. Adding tunables to the webpages is planned.

		Policy Documentation

		Ongoing

		Most kernel layer modules are documented.

		Unused Modules

		Complete

		Modules can be disabled by using modules.conf.

		MLS Infrastructure

		Minor improvements

		MLS infrastructure added to support easy conversion between

			MLS and non-MLS policy.  Policy is compilable, but

			untested.

		Network Infrastructure

		Minor improvements

		All network ports, nodes, and interfaces moved to

			corenetwork module, interfaces generated automatically.

			Plan to add more infrastructure for configuration of

			ports, nodes, and interfaces.

		User domains and roles

		Minor improvements

		Some infrastructure added to support per-user domain policy,

			e.g., to create types and policy for ssh,

			for each user.  Plan to add infrastructure to easily

			configure userdomains and roles.

		Labeling

		Minor improvements

		All labeling moved to modules, consistent with Reference

			Policy structure.

		Tunables

		Minor improvements

		Tunables are documented, and in the future will be included

			in the webpage policy documentation.

		Users

		Unchanged

		Assignment of users to roles

		Constraints

		Unchanged

		Plan to split up into relevant modules.  There are ordering

			problems with source policies.

		Flask

		Unchanged

		Headers for the policy, describing object classes, and

			their permissions.  No planned changes

		Genhomedircon

		Unchanged

		Tool to properly label users' home directories.

			No planned changes

Roadmap

      Reference Policy Roadmap

      Version

      Date

      Description

      0.1

      June 2005

      Initial public release, basic policy restructuring, some infrastructure, few modules, and minimal documentation.

      0.2

      July 2005

      Restructuring complete, additional modules, and improved infrastructure.

      0.3

      August 2005

      Additional modules, documentation, and base module configuration support.

      0.4

      September 2005

      Additional modules, documentation, and tested loadable module support.

      0.5

      October 2005

      Additional modules, documentation, targeted policy, and tested MLS support

      0.6

      December 2005

      Additional modules, documentation, and module variations

Policy Conversion

This phase of reference policy development involves the conversion of policies

from the example strict policy.  We have been using the Fedora strict policy

version 1.23.2-1 as a baseline for policy conversion, which is available 

on the download page.  Then after these policies

are added to reference policy, it can be updated to be in line with current

versions of the NSA example policy. For those who wish to contribute, here

is a listing of modules which need to be converted:

acct

arpwatch

automount

bind

bluetooth

cdrecord

comsat

cyrus

dictd

dovecot

fetchmail

fingerd

firstboot

ftpd

games

gpm

howl

inn

irqbalance

ktalkd

kudzu

loadkeys

lockdev

mrtg

ntpd

portmap

postfix

postgresql

prelink

procmail

quota

radius

radvd

rlogin

rsync

samba

sasl

screen

slocate

slrnpull

snmp

spamassassin

squid

stunnel

sysstat

tcpd

telnet

tftp

tmpreaper

uml

updfstab

userhelper

vpnc

zebra

Testing Status

A very minimal RedHat Enterprise Linux 4 system with the following RPMs has

can be successfully booted in enforcing mode, and users can log in locally,

with Reference Policy:

libgcc-3.4.3-9.EL4

rootfiles-8-1

filesystem-2.3.0-1

termcap-5.4-3

glibc-common-2.3.4-2

bzip2-libs-1.0.2-13

device-mapper-1.00.19-2

elfutils-libelf-0.97-5

expat-1.95.7-4

glib2-2.4.7-1

libattr-2.4.16-3

libcap-1.10-20

libsepol-1.1.1-2

db4-4.2.52-7.1

libtermcap-2.0.8-39

mktemp-1.5-20

iproute-2.6.9-3

less-382-4

pcre-4.5-3

usbutils-0.11-6.1

vim-minimal-6.3.046-0.40E.4

info-4.7-5

diffutils-2.8.1-12

gawk-3.1.3-10.1

coreutils-5.2.1-31

gzip-1.3.3-13

module-init-tools-3.1-0.pre5.3

procps-3.2.3-7EL

sed-4.1.2-4

MAKEDEV-3.15-2

sysklogd-1.4.1-26_EL

cracklib-2.7-29

pam-0.77-65.1

SysVinit-2.85-34

lvm2-2.00.31-1.0.RHEL4

kernel-2.6.9-5.0.5.EL

libuser-0.52.5-1

crontabs-1.10-7

tmpwatch-2.9.1-1

m4-1.4.1-16

mgetty-1.1.31-2

time-1.7-25

dhclient-3.0.1-12_EL

samhain-2.0.6-1

hwdata-0.146.1.EL-1

redhat-logos-1.1.25-1

setup-2.5.37-1.1

basesystem-8.0-4

tzdata-2004e-2

glibc-2.3.4-2

beecrypt-3.1.0-6

chkconfig-1.3.11.2-1

e2fsprogs-1.35-11.6.EL4

ethtool-1.8-4

gdbm-1.8.0-24

iputils-20020927-16

libacl-2.2.23-5

libselinux-1.19.1-7

libstdc++-3.4.3-9.EL4

mingetty-1.07-3

bash-3.0-19.2

ncurses-5.4-13

net-tools-1.60-37

popt-1.9.1-7_nonptl

redhat-release-4AS-2

hotplug-2004_04_01-7.2

zlib-1.2.1.2-1

cpio-2.5-7.EL4.1

findutils-4.1.20-7

grep-2.5.1-31

grub-0.95-3.1

readline-4.3-13

rpm-libs-4.3.3-7_nonptl

shadow-utils-4.0.3-41.1

rpm-4.3.3-7_nonptl

tar-1.14-4

cracklib-dicts-2.7-29

policycoreutils-1.18.1-4

util-linux-2.12a-16.EL4.6

udev-039-10.8.EL4

initscripts-7.93.11.EL-1

mkinitrd-4.1.18-2

passwd-0.68-10

bzip2-1.0.2-13

logrotate-3.7.1-2

libxml2-2.6.16-6

make-3.80-5

iptables-1.2.11-3.1.RHEL4

vixie-cron-4.1-20_EL

comps-4AS-0.20050107