Subject: [saag] Security Label BOF Location and Time

From: "David Quigley" <[email-masked]>
Date: Mon, 17 Nov 2008 11:12:11 -0600

Hello,

    The Security Label Bar BOF will start by meeting in the lobby of the
Hilton at 8pm. From there we can choose one of the nearby pubs to go to. I
have a list of local restaurants/pubs from the concierge and it lists an
Irish pub (The Local) and a British pub (Brit's Pub) within two blocks of
the Hilton. If people prefer to stay at the hotel we can also use the
restaurant down stairs as well. I figure if we go to one of the pubs people
can eat there if they like or just go for drinks if they have already eaten.

Since I haven't received any other topics people wish to discuss the agenda
at the moment contains one item (all be it a complex one).

Background:

Originally the term Security Label consisted of MLS and Integrity labels as
they were used in the orange book. Since then there have been other forms of
mandatory access control(MAC) and some MAC systems such as SELinux which
implement several of the forms within the same system(Domain Type
Enforcement (DTE), RBAC and MLS). In traditional MAC systems the policy is
very rigid with the model being built into the operating system. In more
recent MAC systems (SELinux, Trusted BSD, Solaris FMAC) the idea of
flexibility of policy and mechanism have made it such that even if two
systems use the same MAC model they may each possess completely different
policies. Because of this the idea of a Domain of Interpretation(DOI) has
become more important. Conceptually a DOI is a collection of systems where a
label has a consistant semantic meaning across all of those systems.
Traditionally MLS labels were represented as integers and bit fields so a
DOI in this context defined what bits corresponded to which categories and
what levels were present. In more recent systems labels are more directly
represented as strings. For example in a DTE system a label may be
httpd_content_t and two systems may possess this label but the semantics of
it may be different.

Discussion Topics:

Since several drafts exist that use security labels (CALIPSO, Labeled NFSv4)
there is a need for a consistent definition of a DOI. The CALIPSO document
has a good starting point for a definition but it is very MLS centric. In
addition to the two documents mentioned above there is also are also a
couple of documents floating around pertaining to labeled IPSec which also
contain a definition of DOIs. Once these make there way to the working group
there will be four documents which will have the concept of a DOI.

In this meeting I would like to see what changes need to be made to the
CALIPSO DOI definition that makes it suitable to Labeled NFS and potentially
Labeled IPSec. Once we come up with this we can draw up an initial draft of
a document outlining DOIs which these documents could use as a normative
reference. In addition to this I would also like to see a discussion on the
administration and management of the DOI space.If people with experience
handling DOIs are present  it would be useful to hear some issues that have
been encountered in traditional systems.

Dave Quigley
_______________________________________________
saag mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/saag

---

From: "David Quigley" <[email-masked]>
Date: Mon, 17 Nov 2008 11:54:56 -0600

Just to clarify that is 8pm Today (Monday) that we are meeting.

Dave

On Mon, Nov 17, 2008 at 11:12 AM, David Quigley
<[email-masked]>wrote:

> Since several drafts exist that use security labels (CALIPSO, Labeled
> NFSv4) there is a need for a consistent definition of a DOI. The CALIPSO
> document has a good starting point for a definition but it is very MLS
> centric. In addition to the two documents mentioned above there is also are
> also a couple of documents floating around pertaining to labeled IPSec which
> also contain a definition of DOIs. Once these make there way to the working
> group there will be four documents which will have the concept of a DOI.
>
>
>
> handling DOIs are present  it would be useful to hear some issues that
> have been encountered in traditional systems.
>
>
>
> Dave Quigley
>

---

From: Jarrett Lu <[email-masked]>
Date: Mon, 17 Nov 2008 16:42:58 -0800

David Quigley wrote:
>
> Background:
>
>  
>
> Originally the term Security Label consisted of MLS and Integrity 
> labels as they were used in the orange book. Since then there have 
> been other forms of mandatory access control(MAC) and some MAC systems 
> such as SELinux which implement several of the forms within the same 
> system(Domain Type Enforcement (DTE), RBAC and MLS). In traditional 
> MAC systems the policy is very rigid with the model being built into 
> the operating system. In more recent MAC systems (SELinux, Trusted 
> BSD, Solaris FMAC) the idea of flexibility of policy and mechanism 
> have made it such that even if two systems use the same MAC model they 
> may each possess completely different policies. Because of this the 
> idea of a Domain of Interpretation(DOI) has become more important. 
> Conceptually a DOI is a collection of systems where a label has a 
> consistant semantic meaning across all of those systems. Traditionally 
> MLS labels were represented as integers and bit fields so a DOI in 
> this context defined what bits corresponded to which categories and 
> what levels were present. In more recent systems labels are more 
> directly represented as strings. For example in a DTE system a label 
> may be httpd_content_t and two systems may possess this label but the 
> semantics of it may be different.
>

This is a significant departure from the DOI definition that I
understood. As you mentioned above, using same DOI implies
all systems agree to same label interpretation and hence enforce
same label policies. I don't quite understand the rationale in
wanting to change that definition to accommodate DTE MAC
systems. Labels can be represented by strings or bitmaps (e.g.
CIPSO). What's important is that systems interpret the labels
the same way, and a DOI value is used to ensure that. If a label
has different meanings on different systems, what do you need a
DOI for? Just to be able interpret a well formed label? I'd think the
ability to interpret a label is implicit. If one doesn't recognize a
label based on label definition, the packet should be dropped.

We can discuss this some more. This post is for people who are
interested in the topic but can't attend the BOF.

Jarrett

---

From: "David Quigley" <[email-masked]>
Date: Mon, 17 Nov 2008 18:55:27 -0600

On Mon, Nov 17, 2008 at 6:42 PM, Jarrett Lu <[email-masked]> wrote:

> David Quigley wrote:
>
>>
>> Background:
>>
>>
>> Originally the term Security Label consisted of MLS and Integrity labels
>> as they were used in the orange book. Since then there have been other forms
>> of mandatory access control(MAC) and some MAC systems such as SELinux which

I didn't mean to imply that there was any accomodation of DTE in there. Your
definition is correct and seems to be an isomorph of what I said. There
shouldn't be anything in there that implies a particular mechanism for
labels I was just giving some examples of the way they are currently done
for those who don't know anything about the topic. If a label has two
different meanings on two different system it is even more important to know
what DOI it is in so you don't confuse the foreign form of that label for
the local one. Sam is going to be at the meeting and said he will be taking
notes so there should be a record posted after the meeting about what was
discussed.

Dave