Re: [73attendees] Security Label BOF Location and Time

On Mon, Nov 17, 2008 at 6:42 PM, Jarrett Lu <Jarrett.Lu@sun.com> wrote:

> David Quigley wrote:
>
>>
>> Background:
>>
>>
>> Originally the term Security Label consisted of MLS and Integrity labels
>> as they were used in the orange book. Since then there have been other forms
>> of mandatory access control(MAC) and some MAC systems such as SELinux which
>> implement several of the forms within the same system(Domain Type
>> Enforcement (DTE), RBAC and MLS). In traditional MAC systems the policy is
>> very rigid with the model being built into the operating system. In more
>> recent MAC systems (SELinux, Trusted BSD, Solaris FMAC) the idea of
>> flexibility of policy and mechanism have made it such that even if two
>> systems use the same MAC model they may each possess completely different
>> policies. Because of this the idea of a Domain of Interpretation(DOI) has
>> become more important. Conceptually a DOI is a collection of systems where a
>> label has a consistant semantic meaning across all of those systems.
>> Traditionally MLS labels were represented as integers and bit fields so a
>> DOI in this context defined what bits corresponded to which categories and
>> what levels were present. In more recent systems labels are more directly
>> represented as strings. For example in a DTE system a label may be
>> httpd_content_t and two systems may possess this label but the semantics of
>> it may be different.
>>
>>
> This is a significant departure from the DOI definition that I
> understood. As you mentioned above, using same DOI implies
> all systems agree to same label interpretation and hence enforce
> same label policies. I don't quite understand the rationale in
> wanting to change that definition to accommodate DTE MAC
> systems. Labels can be represented by strings or bitmaps (e.g.
> CIPSO). What's important is that systems interpret the labels
> the same way, and a DOI value is used to ensure that. If a label
> has different meanings on different systems, what do you need a
> DOI for? Just to be able interpret a well formed label? I'd think the
> ability to interpret a label is implicit. If one doesn't recognize a
> label based on label definition, the packet should be dropped.
>
> We can discuss this some more. This post is for people who are
> interested in the topic but can't attend the BOF.
>
>
> Jarrett
>

I didn't mean to imply that there was any accomodation of DTE in there. Your
definition is correct and seems to be an isomorph of what I said. There
shouldn't be anything in there that implies a particular mechanism for
labels I was just giving some examples of the way they are currently done
for those who don't know anything about the topic. If a label has two
different meanings on two different system it is even more important to know
what DOI it is in so you don't confuse the foreign form of that label for
the local one. Sam is going to be at the meeting and said he will be taking
notes so there should be a record posted after the meeting about what was
discussed.

Dave