Re: IPSEC integration (was Re: SELinux and covert channels)

Sounds like you're thinking along the same lines I am.

Seems to me like there are a few very, very hard parts to this problem.

One is designing a database capable of flexibly representing the sort of permission and delegation relationships that show up in real organizations. That's a currently open problem, and I know lots of people are working on it. I kinda suspect by the time it gets solved, the other bits will be all lined up.

Another piece to the puzzle is providing facilities for a centralized policy specification database to be consistently enforced with a single mechanism; it seems like it's within the bounds of possibility that selinux, with some suitable integration with ipsec, may possibly provide the needed mechanism.

I could believe that a PK database of some sort may provide the glue required to associate identities as specified in the above policy database with real entities. I'd be happier if it didn't look so likely that the PK database will end up being based on the ugliest-of-all-possible-worlds design X.509, but I suppose that can be lived with.

Another component I've been thinking about is more a piece of plumbing that'll be needed to make things work as they should, rather than a fundamentally separate security component. The fantasy of a fine-grained integration of ipsec security associations with fine-grained, user/app level security policy specification, implies that ipsec security associations are going to be coming up and going down in a very fluid fashion. It seems to me that making working distributed apps is going to end up requiring dynamic routing through these transient tunnels. I'm still pondering that one, though. On the one hand it seems like OSPF's dynamically self-configuring, multicast flooding nature would be the responsive and maintainable approach to desire; on the other hand it seems like BGP4's simplicity of running through straight TCP connections is more likely to actually _work_ over ipsec. I'm hoping that this new evolution won't require actually inventing another working dynamic routing protocol, but I've not yet gotten a really happy feeling about that question.

-Bennett

--
You have received this message because you are subscribed to the selinux list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.



application/pgp-signature attachment: stored