Re: [73attendees] Security Label BOF Location and Time

David Quigley wrote:
>
> Background:
>
>  
>
> Originally the term Security Label consisted of MLS and Integrity 
> labels as they were used in the orange book. Since then there have 
> been other forms of mandatory access control(MAC) and some MAC systems 
> such as SELinux which implement several of the forms within the same 
> system(Domain Type Enforcement (DTE), RBAC and MLS). In traditional 
> MAC systems the policy is very rigid with the model being built into 
> the operating system. In more recent MAC systems (SELinux, Trusted 
> BSD, Solaris FMAC) the idea of flexibility of policy and mechanism 
> have made it such that even if two systems use the same MAC model they 
> may each possess completely different policies. Because of this the 
> idea of a Domain of Interpretation(DOI) has become more important. 
> Conceptually a DOI is a collection of systems where a label has a 
> consistant semantic meaning across all of those systems. Traditionally 
> MLS labels were represented as integers and bit fields so a DOI in 
> this context defined what bits corresponded to which categories and 
> what levels were present. In more recent systems labels are more 
> directly represented as strings. For example in a DTE system a label 
> may be httpd_content_t and two systems may possess this label but the 
> semantics of it may be different.
>

This is a significant departure from the DOI definition that I
understood. As you mentioned above, using same DOI implies
all systems agree to same label interpretation and hence enforce
same label policies. I don't quite understand the rationale in
wanting to change that definition to accommodate DTE MAC
systems. Labels can be represented by strings or bitmaps (e.g.
CIPSO). What's important is that systems interpret the labels
the same way, and a DOI value is used to ensure that. If a label
has different meanings on different systems, what do you need a
DOI for? Just to be able interpret a well formed label? I'd think the
ability to interpret a label is implicit. If one doesn't recognize a
label based on label definition, the packet should be dropped.

We can discuss this some more. This post is for people who are
interested in the topic but can't attend the BOF.

Jarrett
_______________________________________________
73attendees mailing list
73attendees@ietf.org
https://www.ietf.org/mailman/listinfo/73attendees