Finally, a Smack Reference Policy
summary
A Smack reference policy targets an Ubuntu desktop using systemd support and Smack’s bring up mode to log permitted-but-unexpected accesses, implements a three domain model (floor, system, user), and uses transmuting directories and mount options to isolate /run, /var/log and /var/lib/apt. The effort produces a working rule set applied to a stock Ubuntu system and reduces sharing down to a small surface — about 22 rules to reach an active, nearly complete policy — with a few remaining issues (ld.so.cache, network labeling, privilege handling).
AI-written summary · about
chapters (26)
- 0:00Intro
- 0:13Simplified Mandatory Access Control Kernel
- 0:45Compared To SELinux
- 2:26Compared To AppArmor
- 3:19Smack is not a privilege system
- 4:22Built In Smack Access Rules
- 5:27Specified Smack Access Rules
- 6:49Access Modes
- 7:13Access Quirks
- 9:36The Reference Threat
- 12:02Complications
- 13:49Choosing A Use Case
- 14:47Tooling Considerations
- 15:54Choosing A Distribution
- 17:22The Three Domain Model
- 19:12Toolbox
- 25:21What Accesses Are Unwanted?
- 26:57Simple Configuration
- 31:27Transmuting Directories
- 34:23var/lib/apt
- 36:35Graphically
- 37:59With Implicit Access
- 38:49With Privileged Access
- 40:20And Shared Data
- 42:19To Consider
- 43:24Work To Be Done For The Distribution
related talks
22mOverview and Recent Developments: Smack
06mSubsystem Update: The 2019 Smack Update
10mSmack in 2016
08mSub-system Update: Smack Update 2018
09mSub-system Update: AppArmor Update 2018
32mUsing a Different LSM from the Host in a Container
47mRestricting Unprivileged User Namespaces in Ubuntu
01h 14mLSM Updates: IMA, SELinux, AppArmor, SMACK &...