os/doc
3
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

Add mandatory access control project idea.

Browse source 
Add "Requirements" string ahead of requirement lists for two other
TrustedBSD-related ideas I put in the list earlier.
This commit is contained in:
Robert Watson 2007-02-16 11:56:01 +00:00
parent 09874f3aff
commit 3aed7b3751
Notes: svn2git 2020-12-08 03:00:23 +00:00 
svn path=/www/; revision=29577
1 changed files with 44 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

45
en/projects/ideas/index.sgml
View file

@ -1,6 +1,6 @@
<!DOCTYPE HTML PUBLIC "-//FreeBSD//DTD HTML 4.01 Transitional-Based Extension//EN" [
<!ENTITY base CDATA "../..">
<!ENTITY date "$FreeBSD: www/en/projects/ideas/index.sgml,v 1.83 2007/02/16 11:40:46 rwatson Exp $">
<!ENTITY date "$FreeBSD: www/en/projects/ideas/index.sgml,v 1.84 2007/02/16 11:42:32 rwatson Exp $">
<!ENTITY title "FreeBSD list of projects and ideas for volunteers">
<!ENTITY % navinclude.developers "INCLUDE">
<!ENTITY % developers SYSTEM "../../developers.sgml"> %developers;
@ -117,6 +117,7 @@
<li><a href="#p-distribaudit">Distributed audit daemon</a></li>
<li><a href="#p-auditkernel">Audit kernel event sources</a></li>
<li><a href="#p-securityregression">Security regression tests</a></li>
<li><a href="#p-mac">Mandatory Access Control</a></li>
</ul>
<h3>Userland / Installation Tools</h3>
@ -1212,6 +1213,7 @@ will likely need some re-working of the kernel audit framework (which is
currently entirely focused on gathering user and kernel system call audit
data).
</p>
<p><strong>Requirements</strong>:</p>
<ul>
<li>Strong C programming skills.</li>
<li>Familiarity with concurrent programming techniques.</li>
@ -1236,6 +1238,7 @@ href="http://www.freebsd.org/cgi/cvsweb.cgi/src/tools/regression/">FreeBSD
regression test tree</a>, but they are both incomplete and and inadequate.
New tests must be created; existing tests must be completed and updated.
</p>
<p><strong>Requirements</strong>:</p>
<ul>
<li>Strong C programming skills.</li>
<li>High tolerance for writing test code.</li>
@ -1243,6 +1246,46 @@ New tests must be created; existing tests must be completed and updated.
<li>Rigorous and devious mindset.</li>
</ul>
<a name="#p-mac"></a>
<h2>Mandatory Access Control</h2>
<p><strong>Technical contact</strong>: <a
href="mailto:rwatson@FreeBSD.org">&a.rwatson;</a></p>
<p>
FreeBSD 5.0 was the first FreeBSD release to ship with support for Mandatory
Access Control (MAC), an access control technology allowing system
administrators to implement multi-level security, integrity protection, and
other "mandatory" policies. Policies may be compiled into the kernel, or
loaded as loadable kernel modules.
Later revisions of FreeBSD and the MAC Framework enhanced MAC support,
and additional policy modules were made available, such as a port of the
SELinux FLASK/TE framework available as a third party policy module.
However, many of the sample MAC modules included with FreeBSD are considered
experimental examples of what the technology can be used for, rather than
production policies.
For example, the Biba integrity policy can be deployed in production, but
requires significant tuning to do so effectively.
</p>
<p>
This task involves a general review of the MAC Framework and Policy modules,
with the goal of identifying improvement areas. It also involves specific
cleanups, optimizations, and completeness work on specific policy modules --
most importantly, the Biba and MLS sample labeled policy modules. Work there
includes improving memory overhead and efficiency; for example, moving from
allocating complete labels for every labeled object to referencing common
label storage where labels are identical, which occurs a great deal of the
time in most systems.
Other cleanups include moving towards a canonical/extensible on-disk label
storage format, adding regression tests, investigating interactions with user
applications, and writing documentation.
</p>
<p><strong>Requirements</strong>:</p>
<ul>
<li>Strong C programming skills.</li>
<li>Familiarity with OS security policies, including discretionary and
mandatory access control.<li>
<li>Familiarity with concurrent programming techniques.</li>
<li>Willingness to read the CC/CAPP specification.</li>
</ul>
<hr>
<!------------------------------------------------------------------>