multi category security mcs
play

Multi- Category Security (MCS) Daniel J Walsh SELinux Lead Engineer - PowerPoint PPT Presentation

Dec 16, 2023 •425 likes •561 views

Multi- Category Security (MCS) Daniel J Walsh SELinux Lead Engineer dwalsh@ redhat.com Oops!!!! 2 Setting the record straight Example Policy - > Reference Policy Base policies package used by distributions to build shipping

  1. Multi- Category Security (MCS) Daniel J Walsh SELinux Lead Engineer dwalsh@ redhat.com

  2. Oops!!!! 2

  3. Setting the record straight  Example Policy - > Reference Policy ● Base policies package used by distributions to build shipping policy ● targeted, strict, MLS  MCS Is not a new policy package  MCS is a optional way to build targeted or strict  Fedora/ Red Hat will ship in FC5/ RHEL5: ● selinux- policy- targeted = = targeted- mcs ● selinux- policy- strict = = strict- mcs ● selinux- policy- mls = = strict- mls 3

  4. What is MCS?  MCS Is MLS with a single Sensitivity  MLS/ MCS flag is the fourth field of the SELinux context ● system_u:object_r:user_home_t: s0:c1 ● MLS runs with up to 16 sensitivities, s0- s15 ● MCS runs with single sensitivity, s0 ● MLS/ MCS support 256 category combinations, c0- c255  Prevent Stupid Mistakes versus Malicious Users ● Discretionary/ advisory scheme ● User- oriented ● Prevent Accidental Leakage  Targeted domains will be prevented by TE by default 4

  5. Benefits of MLS for a Mainstream OS  Can MCS do for MLS what targeted policy did for SELinux? ● Potentially useful to more people ● Mainstream use of technology ● Higher overall quality  User- innovation  Currently in Rawhide ● MCS labeling for files ● MLS kernel flag enabled by default 5

  6. MCS/ MLS Infrastucture  Needed a way to make categories human readable ● libsetrans ● optional library used by libselinux to translate MLS Level of security context into Human readable context 6

  7. / etc/ selinux/ POLICYTYPE/ setrans.conf # Multi- Category Security translation table for SELinux # Uncomment the following to disable translation libary # disable= 1 # Objects can be categorized with 0- 256 categories defined by the admin. # Objects can be in more than one category at a time. # Categories are stored in the system as c0- c255. Users can use this # table to translate the categories into a more meaningful output. # Examples: s0= s0:c0= CompanyConfidential s0:c1= PatientRecord s0:c2= Unclassified s0:c3= TopSecret s0:c1,c3= CompanyConfidentialRedHat s0- s0:c0.c255= SystemLow- SystemHigh s0:c0.c255= SystemHigh 7

  8. Translation  system_u:object_r:user_home_t: s0:c1 ● system_u:object_r:user_home_t: PatientRecord  system_u:object_r:user_home_t: s0 ● system_u:object_r:user_home_t 8

  9. Setting MLS/ MCS Flag  chcon ● chcon - l PatientRecord / opt/ patients/ dwalsh  chcat ● wrapper around chcon ● chcat + PatientRecord / opt/ patients/ dwalsh ● chcat + CompanyConfidential / opt/ patients/ dwalsh user_r:object_r:type_t: PatientRecord,CompanyConfidential ●  Nautilus, Mailers, OpenOffice, Web Browsers 9

  10. Setting Users MLS/ MCS Range  / etc/ selinux/ POLICYTYPE/ seuser ● semanage login - m - r s0- PatientRecord,CompanyConfidential dwalsh ● chcat - l + PatientRecord dwalsh  chcat - L - l dwalsh ● dwalsh: PatientRecord  id - Z ● user_u:system_r:unconfined_t:s0- PatientRecord 10

  11. Graphical Tools 11

  12. What Next?  Labeled Printing ● lpr - P ReceptionistPrinter / opt/ patients/ dwalsh.pdf ● Error: You are not allowed to print this doc on ReceptionistPrinter ● lpr - P LabTech / opt/ patients/ dwalsh.pdf ● Header and footer will identify document as a “PatientRecord”  Labeled Mail ● Mail List associated with MCS Framework ● Mail domain (redhat.com) associated with MCS Framework.  Auditing?  How do I run multiple Apache servers to display different categories? ● MLS Challange as well 12

Download Presentation
Download Policy: The content available on the website is offered to you 'AS IS' for your personal information and use only. It cannot be commercialized, licensed, or distributed on other websites without prior consent from the author. To download a presentation, simply click this link. If you encounter any difficulties during the download process, it's possible that the publisher has removed the file from their server.

Recommend

Proposal for a Category 5, Multi-Department Facility Presentation Outline Turn-Key Solution

Proposal for a Category 5, Multi-Department Facility Presentation Outline Turn-Key Solution

Proposal for a Category 5, Multi-Department Facility Presentation Outline Turn-Key Solution Project Background Building Benefits/Features 1. Location 2. Site Plan 3. Category 5 Construction 4. Power 5. Call Center Specs

478 views • 15 slides
Section 7 CSE 344 - Winter 2015 1 Foreign Key Constraints Example with multi-attribute

Section 7 CSE 344 - Winter 2015 1 Foreign Key Constraints Example with multi-attribute

Section 7 CSE 344 - Winter 2015 1 Foreign Key Constraints Example with multi-attribute primary key CREATE TABLE Purchase ( prodName CHAR(30), category VARCHAR(20), date DATETIME, FOREIGN KEY (prodName, category) REFERENCES

377 views • 17 slides
YURY CHEMERKIN I have 10+ years of experience in information security. Im a multi-skilled

YURY CHEMERKIN I have 10+ years of experience in information security. Im a multi-skilled

S TILL S ECURE . W E E MPOWER W HAT W E H ARDEN B ECAUSE W E C AN C ONCEAL YURY CHEMERKIN MULTI-SKILLED SECURITY EXPERT CJSC ADVANCED MONITORING YURY CHEMERKIN I have 10+ years of experience in information security. Im a multi-skilled

1.43k views • 76 slides
The SAT 2005 Competition Industrial category Certified UNSAT Special track Fourth Edition Non

The SAT 2005 Competition Industrial category Certified UNSAT Special track Fourth Edition Non

The SAT 2005 Competition Whats new this year The benchmarks First stage results All categories Random category Crafted category Industrial category Second stage results Random category Crafted category The SAT 2005 Competition

791 views • 55 slides
Singapore Standard for Multi-Tiered Cloud Security - SS 584:2013 1. To provide an overview of

Singapore Standard for Multi-Tiered Cloud Security - SS 584:2013 1. To provide an overview of

Agenda Singapore Standard for Multi-Tiered Cloud Security - SS 584:2013 1. To provide an overview of Multi-Tier Cloud Security (MTCS SS584:2013) standard 2. To detail the deployment considerations and related initiatives Wong Onn Chee, Cloud

352 views • 6 slides
Category Management Coalition for Government Procurement April 10, 2014 Category Management

Category Management Coalition for Government Procurement April 10, 2014 Category Management

Category Management Coalition for Government Procurement April 10, 2014 Category Management Definition of Category Five Responsibilities of Category Management Management Optimize Develops and executes the Contract - Identifying vehicles

257 views • 6 slides
STAT 113 Tests for One and Two Multi-category Variables Colin Reimer Dawson Oberlin College

STAT 113 Tests for One and Two Multi-category Variables Colin Reimer Dawson Oberlin College

Outline Testing "Goodness of Fit" for a Categorical Distribution Testing for Association of Categorical Variables STAT 113 Tests for One and Two Multi-category Variables Colin Reimer Dawson Oberlin College November 30, 2017 1 / 8

187 views • 6 slides
eXtensible Multi Security Contracts for .NET Platform Wiktor Zychla wzychla@ii.uni.wroc.pl

eXtensible Multi Security Contracts for .NET Platform Wiktor Zychla wzychla@ii.uni.wroc.pl

Agenda eXtensible Multi Security Contracts for .NET Platform Wiktor Zychla wzychla@ii.uni.wroc.pl Institute of Computer Science University of Wroclaw, Poland .NET Technologies 2006 Wiktor Zychla eXtensible Multi Security, Contracts for .NET

893 views • 68 slides
A Multi Layer Multi Sensor Approach DETER DETECT DELAY DENY Presentation Approach:

A Multi Layer Multi Sensor Approach DETER DETECT DELAY DENY Presentation Approach:

CONVERGING INTRUSION DETECTION TECHNOLOGY AND PHYSICAL SECURITY A Multi Layer Multi Sensor Approach DETER DETECT DELAY DENY Presentation Approach: Introduction to Slingshot Security Solutions Private Limited and its key technology

662 views • 19 slides
Better Concrete Security for Half-Gates Garbling (in the Multi-Instance Setting) Chun Guo,

Better Concrete Security for Half-Gates Garbling (in the Multi-Instance Setting) Chun Guo,

Better Concrete Security for Half-Gates Garbling (in the Multi-Instance Setting) Chun Guo, Jonathan Katz, Xiao Wang, Chenkai Weng, Yu Yu All widely used GCs have a birthday-bound security Explicit attack GC based on fix-key block cipher

313 views • 7 slides
On the Security of Two-Round Multi-Signatures Manu Drijvers 1 , Kasra Edalatnejad 2 , Bryan Ford 2

On the Security of Two-Round Multi-Signatures Manu Drijvers 1 , Kasra Edalatnejad 2 , Bryan Ford 2

On the Security of Two-Round Multi-Signatures Manu Drijvers 1 , Kasra Edalatnejad 2 , Bryan Ford 2 , Eike Kiltz 3 , Julian Loss 3 , Gregory Neven 1 , Igors Stepanovs 4 1 DFINITY, 2 EPFL , 3 Ruhr-University Bochum, 4 UCSD Multi-signatures (pk 1 ,sk

635 views • 27 slides
Multi-University Partnerships The CanSSOC Proof of Concept Welcome and Introductions Panel

Multi-University Partnerships The CanSSOC Proof of Concept Welcome and Introductions Panel

Improved Cyber Security Through Multi-University Partnerships The CanSSOC Proof of Concept Welcome and Introductions Panel Gordie Mah Chief Information Security Officer University of Alberta Paul Weber Supervisor, IT Security Ryerson

142 views • 10 slides
An Approach to Category Management Leading global excellence in procurement and supply Category

An Approach to Category Management Leading global excellence in procurement and supply Category

An Approach to Category Management Leading global excellence in procurement and supply Category Management: CIPS define category management as: the entire science of the procurement subject applied to a single genre of expenditure. As

258 views • 13 slides
1 1.2. Guidelines for Information Security of Cloud Computing Category Main contents of measure

1 1.2. Guidelines for Information Security of Cloud Computing Category Main contents of measure

Agenda Related Polices to Cloud Computing I. Guidelines for Information Security of Cloud II. Computing Cloud Security Certification Scheme in KOREA Cloud Security Certification Program in Korea III. April. 11, 2017 Jungduk (JD) KIM, Ph.

403 views • 5 slides
On the Multi-User Security of Short Schnorr Signatures Jeremiah Blocki and Seunghoon Lee

On the Multi-User Security of Short Schnorr Signatures Jeremiah Blocki and Seunghoon Lee

On the Multi-User Security of Short Schnorr Signatures Jeremiah Blocki and Seunghoon Lee Department of Computer Science, Purdue University October 10, 2019 Jeremiah Blocki and Seunghoon Lee On the Multi-User Security of Short Schnorr Signatures

1.23k views • 86 slides
Motivation Why do I study category theory? I find category theoretic arguments to be

Motivation Why do I study category theory? I find category theoretic arguments to be

Emily Riehl Johns Hopkins University A synthetic theory of -categories in homotopy type theory joint with Michael Shulman Octoberfest, Carnegie Mellon University Motivation Why do I study category theory? I find category theoretic

368 views • 26 slides
Computer-aided cryptography Gilles Barthe IMDEA Software Institute, Madrid, Spain December 1,

Computer-aided cryptography Gilles Barthe IMDEA Software Institute, Madrid, Spain December 1,

Computer-aided cryptography Gilles Barthe IMDEA Software Institute, Madrid, Spain December 1, 2015 Introduction Two models of cryptography: Computational: strong guarantees but complex proofs Symbolic: automated proofs but weak

1.42k views • 26 slides
Transport Layer Security Chester Rebeiro IIT Madras Some of the slides borrowed from the book

Transport Layer Security Chester Rebeiro IIT Madras Some of the slides borrowed from the book

Transport Layer Security Chester Rebeiro IIT Madras Some of the slides borrowed from the book Computer Security: A Hands on Approach by Wenliang Du TLS: Protocol to achieve secure communication TLS provides secure communication channel

834 views • 66 slides
Can DREs Provide Long- Lasting Security? The Case of Return-Oriented Programming and the AVC

Can DREs Provide Long- Lasting Security? The Case of Return-Oriented Programming and the AVC

Can DREs Provide Long- Lasting Security? The Case of Return-Oriented Programming and the AVC Advantage Stephen Checkoway, * Ariel J. Feldman, Brian Kantor, * J. Alex Halderman, Edward W. Felten, Hovav Shacham * * UCSD, Princeton,

641 views • 40 slides
Computer-aided cryptographic proofs Gilles Barthe MPI-SP , Germany IMDEA Software Institute,

Computer-aided cryptographic proofs Gilles Barthe MPI-SP , Germany IMDEA Software Institute,

Computer-aided cryptographic proofs Gilles Barthe MPI-SP , Germany IMDEA Software Institute, Spain Computer-aided cryptography Develop tool-assisted methodologies for helping the design, analysis, and implementation of cryptographic

533 views • 26 slides
Economics and computer security Hal R. Varian UC Berkeley http://www.sims.berkeley.edu/~hal

Economics and computer security Hal R. Varian UC Berkeley http://www.sims.berkeley.edu/~hal

Economics and computer security Hal R. Varian UC Berkeley http://www.sims.berkeley.edu/~hal Outline Assignment of liability Role of insurance Efficiency and coordination costs Implications of weakest link technology

304 views • 18 slides
Module 3 Doing a Noise Audit This module and Module 2 provide the necessary training needed

Module 3 Doing a Noise Audit This module and Module 2 provide the necessary training needed

Module 3 Doing a Noise Audit This module and Module 2 provide the necessary training needed to do a noise audit. This module covers the following topics: Conducting basic noise measurements Assessing hearing protection use

506 views • 21 slides
Single Audit Training Workshop Assessing Single Audit Quality of Local Governments in Virginia

Single Audit Training Workshop Assessing Single Audit Quality of Local Governments in Virginia

Single Audit Training Workshop Assessing Single Audit Quality of Local Governments in Virginia _____________________________________ August 6, 2015 Michael A. Sidell, CGFM Audit Supervisor Auditor of Public Accounts Quote The goal is to

496 views • 49 slides
http://cs246.stanford.edu Data contains value and knowledge 1/7/20 Jure Leskovec, Stanford

http://cs246.stanford.edu Data contains value and knowledge 1/7/20 Jure Leskovec, Stanford

Note to other teachers and users of these slides: We would be delighted if you found our material useful for giving your own lectures. Feel free to use these slides verbatim, or to modify them to fit your own needs. If you make use of a

1.21k views • 69 slides

More recommend