Cascade - A New High Level SELinux Policy Language
summary
Cascade is a Rust library that compiles to SIL and targets making SELinux policy authoring simpler for app developers by offering typed domain/resource declarations, functions with argument type checking, and resource association plus inheritance to auto-generate per-app types. Current release is 0.0.2 (type enforcement only); cassc produces out.sil which then builds to a binary policy, produces Rust-style, source-anchored errors, and aims for better audit-to-cascade guidance and migration tools.
AI-written summary · about
chapters (24)
- 0:00Start
- 10:10SELinux is hard
- 13:10Building on prior work
- 14:24A policy development team model
- 15:12Cascade goals
- 17:57External tooling
- 19:14Current focus: Type Enforcement
- 19:38Test suite
- 20:10Project status
- 22:38Cascade Policy
- 24:09Functions
- 27:08Annotations
- 31:34Resource Association
- 34:36Cascade inheritance
- 36:11Associated Resources compared to inheritance
- 38:24Flexible build system
- 39:46Helpful error handling
- 42:18Cross language interaction
- 46:12Try it yourself
- 47:36Better file_context support
- 49:06Optional policy improvements
- 51:24Integrations with other security mechanisms
- 53:18audit2cascade
- 56:06For more info
related talks
20mCedar: A New Language for Expressive, Fast, Safe, and Analyzable Authorization
45mNext Generation Authorisation using Cedar
20mBuilding Scalable Access Control Frameworks in React
30mSELint - An SELinux Policy Static Analysis Tool
41mPolicy as Code with Sentinel Language
31mOverview and Recent Developments: SELinux
45mSELinux All the Way Down: Namespaces for SELinux
15mDSP - custom SELinux policy modules done right