general rc_fd_types numbering schema

Hi list,

Here I have a very small test how the rc_fd_types could be numbered. 
This is only an example in action not in setup.
http://www.rsbac.org/wiki/experiences/igraltist/booting#what_to_protect

The goal is to find a generalized rc_fd_type numbering schema. To 
achieve this I split up the setup into four files. The data structure is 
not imported at the moment.
I think the path and policy have to detached from the rc_fd_type 
number.
Then name is set when create a rc_fd_type. Let the rsbac system give 
any number no matter. Numbers just for rsbac internal use. Then only 
need is the name. I am sure its need not long time then an rsbac user 
will learn name like 'ping' and if he is advance he could remember the 
path or know how to get it eg. '/bin/ping'. He never would take any 
attention to the filesystem inode number.

When this setup is realized then RC roles are the next step. I think 
rc_fd_types must be the first like a linux system offers before I add 
any user(subject) to the system a fully working file(object) permission 
setup(owner, group, others).

Structure:
1.find many then possible good names for rc_fd_types
   3 = bin_exe_FD
   100 = init_FD
   123 = firefox_FD

2. activated or deactivated a rc_fd_type
   bin_exec_FD = activated
   init_fd_FD = activated
   firefox_FD = deactivated

3. assign names with paths
   bin_exe_FD = ["/bin", "/usr/bin", "/usr/local/bin"]
   init_FD = ["/sbin/init"]
   firefox_FD = ["/usr/sbin/iceweasel"]

4. policy for names
   bin_exe_FD = "/etc/rsbac/policy/rc/fd_type/bin_exe"
   init_FD = "/etc/rsbac/policy/rc/fd_type/init"
   firefox_FD = "/etc/rsbac/policy/rc/fd_type/firefox"

5. example content of a policy to rc_fd_tyoe 
/etc/rsbac/rc/fd_type/bin_exe
   GET_STATUS_DATA EXECUTE SEARCH GET_PERMISSION DATA


Explaination:

to 1.)
  - all could make with a python dialog script for example.
  - splitted into 3 radio boxes
    1. create new rc_fd_type name
    2. edit rc_fd_type name
    3. delete rc_fd_type name
  - its need just one input field for the name of rc_fd_type.

to 2.)
  - a checkbox list where all rc_fd_type names listed
  - just to enable or disable it

to 3,)
  - a list of all rc_fd_type names
  - one input field to add path with names

to 4.)
  - policies could simple shell scipts or any kind of data structure
  - a policy creation which group thinks in human readable language,
    most of the permission is depends on more then one attribute,
    * Groups could be: READ, WRITE, EXECUTE ...

to 5.)
  - just a test how a policy file could be shaped


Nice weekend


-- 
Mit freundlichen Grüßen

Jens Kasten


http://www.kasten-edv.de
E-bikes: http://www.remsdale.de
_______________________________________________
rsbac mailing list
[email protected]
http://www.rsbac.org/mailman/listinfo/rsbac