Re: [saag] Common labeled security (comment on CALIPSO, labeled NFSv4)

Nicolas Williams <> Fri, 03 April 2009 17:30 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id 936F13A6954; Fri, 3 Apr 2009 10:30:08 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -5.805
X-Spam-Status: No, score=-5.805 tagged_above=-999 required=5 tests=[AWL=0.241, BAYES_00=-2.599, HELO_MISMATCH_COM=0.553, RCVD_IN_DNSWL_MED=-4]
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id wF91ZE8fq87j; Fri, 3 Apr 2009 10:30:07 -0700 (PDT)
Received: from (sca-ea-mail-2.Sun.COM []) by (Postfix) with ESMTP id 7CC9B3A6859; Fri, 3 Apr 2009 10:29:59 -0700 (PDT)
Received: from ([]) by (8.13.7+Sun/8.12.9) with ESMTP id n33HV2Rk012473; Fri, 3 Apr 2009 17:31:02 GMT
Received: from binky.Central.Sun.COM (binky.Central.Sun.COM []) by (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id n33HV1T6024004; Fri, 3 Apr 2009 11:31:01 -0600 (MDT)
Received: from binky.Central.Sun.COM (localhost []) by binky.Central.Sun.COM (8.14.3+Sun/8.14.3) with ESMTP id n33Gpili002956; Fri, 3 Apr 2009 11:51:44 -0500 (CDT)
Received: (from nw141292@localhost) by binky.Central.Sun.COM (8.14.3+Sun/8.14.3/Submit) id n33GpiRE002955; Fri, 3 Apr 2009 11:51:44 -0500 (CDT)
X-Authentication-Warning: binky.Central.Sun.COM: nw141292 set sender to using -f
Date: Fri, 03 Apr 2009 11:51:44 -0500
From: Nicolas Williams <>
To: Russ Housley <>
Message-ID: <20090403165143.GC1500@Sun.COM>
References: <20090402154402.GM1500@Sun.COM> <> <>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Disposition: inline
In-Reply-To: <>
User-Agent: Mutt/1.5.7i
Cc:,,,,, Santosh Chokhani <>
Subject: Re: [saag] Common labeled security (comment on CALIPSO, labeled NFSv4)
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Security Area Advisory Group <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Fri, 03 Apr 2009 17:30:08 -0000

On Fri, Apr 03, 2009 at 12:44:30PM -0400, Russ Housley wrote:
> I really do not have time to write about all of my 
> concerns.  However, once you get beyond the basic classifications, 
> the SPIF model breaks.  They are markings that are only to be known 
> to people that have the clearance for those markings, this leads to a 
> SPIF distribution nightmare, as a subset of the real SPIF must be 
> given out based on access (or not) to various compartments and 
> such.  It just does not scale.

I'm aware of the fact that labels can themselves be labeled.  But I
don't think that implies that we can't make a SPIF-like solution scale.

Peers that have access to different subsets of the policy should still
be able to interop if care is taken to specify what happens when a node
sees a label that falls outside its policy subset, and provided, of
course, that the peers can agree that they have subsets of the *same*
master policy.  Peers can check whether they do have subsets of the
*same* master policy by exchanging [for each DOI to both] a master
policy URI that includes a version number.